The Department of Homeland Security has not fully implemented a comprehensive information security program, according to the Governmental Accountability Office.