sentence1: In our September 1996 report, we stated that an underlying cause of federal information security weaknesses was that agencies had not implemented information security programs that (1) established appropriate policies and controls and (2) routinely monitored their effectiveness.
sentence2: In the report, we said an underlying cause of federal information security weaknesses was that the agencies had implemented faulty information security protocols.