In our September 1996 report , we stated that an underlying cause of federal information security weaknesses was that agencies had not implemented information security programs that ( 1 ) established appropriate policies and controls and ( 2 ) routinely monitored their effectiveness .
In the report , we said an underlying cause of federal information security weaknesses was that the agencies hadn 't implemented information security protocols that addressed email .