The GCSB spy agency has taken six times longer than it should have to address questions about lax cyber security identified in a Treasury report - and then refused to answer most of them.