The information security management practices identified in GAO 's executive guides have been incorporated into policy guidance at many federal agencies .
All federal agencies ignored the GAO executive guides .