GAO: Defense agency not fully protecting information systems