The report makes note of the use of "password," but it cites other head-scratchers common within the federal system such as expired virus protection and security patches in need of updates.
Original article here
Information Security, SSAE 16, ISO 27001, CISA, Cert-IN