Federal agencies face obstacles in implementing FISMA, says GAO