In our September 1996 report, we stated that an underlying cause of federal information security weaknesses was that agencies had not implemented information security programs that (1) established appropriate policies and controls and (2) routinely monitored their effectiveness.
In the report, we said an underlying cause of federal information security weaknesses was that the agencies hadn't implemented information security protocols.