From the GAO, Critical Infrastructure Protection: Challenges for Selected Agencies and Industry Sectors. GAO-03-233, February 28. According to this report, four federal agencies (DOE, HHS, Commerce and the EPA) have not completed an analysis of their respective critical infrastructure assets and their associated vulnerabilities to cyberattacks, five years after mandates to do so.
See also Fed Agencies Asleep at the Wheel.