The information security management practices identified in GAO's executive guides have been incorporated into policy guidance at many federal agencies.
Many federal agencies use tools associated with GAO.
All federal agencies ignored the GAO executive guides.