One limitation of this study relates to the selection of participants. At the beginning of the survey questionnaire, each
respondent was asked whether his organization had established an ISP and whether the respondent was aware of the
ISP’s requirements, and we excluded from the survey those who worked in an organization without a written ISP or who
were not aware of the requirements of their organizations’ ISPs.