Advisory Committee for Information Security, Information Security Review (June 2002) (not available online).