Auditors found that the state legislature and court system lack strategic cybersecurity plans, while many local entities did not even reply.