A recent study requested by the chairman of the U.S. House of Representatives Committee on Government Reform found that many federal agencies are not properly testing their information security controls.