An auditor-general review of seven major government agencies found that none complied with the required cyber security measures which were due to be in place by mid-2014.