In contrast, both the information systems security manager and the internal auditor think that top
management at Institution C provides significant budgetary support for information security. In addition, they
provide explicit incentives for information security, as indicated in these comments by the information
security manager.