Although many of these recommendations have been implemented , similar weaknesses continue to surface because agencies have not implemented a management framework for overseeing information security on an agencywide and ongoing basis .
All of these recommendations have been implemented