In a February 1997 series of reports to the Congress , GAO designated information security as a governmentwide high-risk area .
Congress was never notified that information security was a governmentwide high-risk area