“Combined with the inadequacy and non-compliance of OPM's continuous monitoring program, we are very concerned that the agency's systems will not be protected against another attack,” Esser said.

While the massive OPM hack may have been impossible to prevent, auditors had previously identified weaknesses in the OPM's IT management system, the report said.

“Our recommendations appeared to garner little attention, as the same findings were repeated year after year,” it said.

Additionally, the report strongly suggested the OPM's inability to accurately inventory its systems and network devices severely limits the efficacy of its security controls.

“(The) OPM has implemented a large number of improved security monitoring tools, but without a complete understanding of its network, it cannot adequately monitor its environment and therefore the usefulness of these tools is reduced,” the report stated.

Information security governance changes made this fall by the OPM satisfied a long-standing weakness cited by the OIG. At the OIG's advice, the OPM implemented a centralized information security governance structure where all information security practitioners, including designated security officers, report to the chief information security officer.

Nevertheless, key weaknesses still exist, according to the report. For example, the OPM does not have a thorough inventory of its servers, databases and network devices, which drastically diminishes the effectiveness of its security tools, the report stated. The OIG also found the OPM has not configured its virtual private network servers to automatically log out of remote sessions.

The report also revealed only 65% of employees with “significant security responsibilities” had completed special IT training during the 2015 fiscal year.

“The OPM has been neglecting security best practices for a long time and has not spent enough of its resources, long term, on solving this,” Stu Sjouwerman, founder/CEO of the Clearwater, Fla.-based cybersecurity company KnowBe4, stated. “It is no surprise they are having trouble catching up. Cybersecurity needs to be a much higher priority, especially now.”

“The government needs to change the speed of IT security projects execution,” Ondrej Krehel, founder/CEO of the New York City-based cybersecurity intelligence firm LIFARS, said. “In the past, any government project generally took longer to implement with many corrective actions.”

Krehel also pointed out hackers work with high velocity and speed, and that cybersecurity remediations must run at a similar tempo and with similar precision.

“This is not the current state of actions at many government institutions, which is a combination of a lack of a talent as well as a project management skill set in cybersecurity,” he said. “Cybersecurity is not a cookie cutter solution. Tailoring the proper solution takes multiple steps and proper design is needed.”