Federal agencies continue to be lax in their implementation of information security programs, according to a new report from the Government Accountability Office.