An audit found the agency has fallen well short in applying a set of six widely accepted IT security controls, including inventories of devices and software.