The Small Business Administration’s information security program is largely ineffective after falling below the federal baseline for controls in nine of 10 domains, according to a new watchdog report.