In February 1997 and again in January 1999 , our reports to the Congress designated information security as a governmentwide highrisk area .
Information security was initially designated as a high-risk area in late 1999 .