Government Accountability Office audit of four federal agencies. NASA, the Nuclear Regulatory Commission, the Office of Personnel Management and the Department of Veterans Affairs have all been inconsistent in their implementation of access controls. The agencies generally concurred with GAO’s recommendations, with the exception of OPM’s response to the audit. The audit also revealed that the attacks delivered through email were deemed the most serious and frequent. The auditors called on NASA, NRC, OPM and VA to fully implement key elements of their information security programs.”]
Source: https://www.govinfosecurity.com/gao-sensitive-government-data-at-risk-disclosure-a-9217