CISA Can Improve Efforts to Ensure Dam Security and Resilience

The Cybersecurity and Infrastructure Security Agency (CISA) cannot demonstrate how its oversight has improved Dams Sector security and resilience. We attribute this to CISA’s inadequate management of Dams Sector activities. Specifically, CISA has not:  coordinated or tracked its Dams Sector activities;  updated overarching national critical infrastructure or Dams Sector plans; or  collected and evaluated performance information on Dams Sector activities. In addition, CISA does not consistently provide information to the Federal Emergency Management Agency (FEMA) to help ensure FEMA’s assistance addresses the most pressing needs of the Dams Sector. CISA and FEMA also do not coordinate their flood mapping information. Finally, CISA does not effectively use the Homeland Security Information Network Critical Infrastructure Dams Portal to provide external Dams Sector stakeholders with critical information. As a result, CISA could improve its oversight, coordination, and communication to better support the Dams Sector security and resilience. These changes would enhance the Sector’s ability to adapt to the risk environment and decrease the likelihood of future dam failures and flooding events.