Within the Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency (CISA) is primarily responsible for working with components and partners to defend against current threats to the commercial facilities sector and build a more secure and resilient infrastructure. However, CISA does not effectively coordinate and share best practices to enhance security across the commercial facilities sector. Specifically, CISA does not coordinate within DHS on security assessments to prevent potential overlap, does not always ensure completion of required After Action Reports to share best practices with the commercial facilities sector, and does not adequately inform all commercial facility owners and operators of available DHS resources.
This occurred because CISA does not have comprehensive policies and procedures to support its role as the commercial facilities’ Sector-Specific Agency (SSA). Without such policies and procedures, CISA cannot effectively fulfill its SSA responsibilities and limits its ability to measure the Department’s progress toward accomplishing its sector-specific objectives.