CGI won a six-year, $267 million task order to complete the work for CISA.

Correcting inaccuracies and errors is another privacy risk, according to a department assessment.

Third-party contractors are prohibited from using or sharing data collected with CISA in their task orders, but that's no guarantee.

The program, which the Department of Homeland Security uses to monitor and protect federal networks, is adding more data and connections all the time. Congress enters another year without giving it official legislative authority.

The scores won't be public, though, "because we know adversaries will be looking to see which agencies are having problems," says Continuous Diagnostics and Mitigation program manager Kevin Cox.

App vetting solutions, in particular, vary in their strengths and weaknesses, so it's up to agencies to determine what meets their needs.