Findings come after CISA issues binding Directive on Improving Asset Visibility and Vulnerability Detection on All Federal Networks.