'Young' CISA gets funds but still has work to do, GAO says