Audit finds weaknesses in DOE cybersecurity