premise: Several organizations had developed quarterly reporting mechanisms to summarize the status of security-related efforts.
hypothesis: The quarterly reports give just enough time to see real progress concerning security.