Two days after the Securities and Exchange Commission posted a detailed checklist on its website of cybersecurity protections that it expects firms to provide, the Government Accountability Office issued a report faulting the SEC for its own lax cybersecurity, the Wall Street Journal reports.

The GAO report, released last Thursday, states that the SEC failed to consistently protect against possible cyberintrusions. It also states that the agency failed to encrypt sensitive data on an important financial system, although it did not disclose what that system is, the Wall Street Journal reports.