The 60-page audit found widespread failures to identify vulnerable cryptographic systems, develop reliable funding estimates, and test replacement technologies.
The results showed that only one agency had fully developed a prioritized inventory of vulnerable cryptographic systems.
The shortcomings extended to the information agencies maintained about their own technology.
Without this information, agencies cannot reliably identify which technologies must be upgraded, which require replacement, or how to prioritize systems containing sensitive information.
It directs agencies to prioritize high-impact systems, high-value assets, sensitive information, and cryptographic access controls.