In a February 1997 series of reports to the Congress, GAO designated information security as a governmentwide high-risk area.
Congress was never notified that information security was a governmentwide high-risk area