One of the more precise findings in the GAO’s April 2026 industrial security report is that DCSA has built risk assessment capabilities at the national level while leaving its regional operators without meaningful tools to analyze risk in their own portfolios. The gap matters because the facilities within each of DCSA’s four regions — Mid-Atlantic, Eastern, Central, and Western — have substantially different characteristics, and national-level trend data does not capture the distinctions that should drive local prioritization.

The workforce shortfall in DCSA’s industrial security mission is not a new discovery. In June 2023, DCSA’s director sent a memorandum to the Under Secretary of Defense for Intelligence and Security documenting that the agency was resourced to conduct required oversight of only 25 to 30 percent of the cleared industrial base. The memorandum offered three investment options — a 100 percent option, a 70 percent option, and a 30 percent option — each projecting the additional security violations, vulnerabilities, and undetected threats that could be identified at varying staffing levels. The 100 percent option, DCSA’s recommended proposal, called for adding 230 Industrial Security Representatives, 164 Information Systems Security Professionals, 25 field office chiefs, and 17 ISSP Team Leads across the Future Years Defense Program.

The National Access Elsewhere Security Oversight Center was established by DCSA in 2019 with a reasonable premise: take the roughly 5,000 cleared facilities that do not possess classified information onsite — about 40 percent of the entire National Industrial Security Program — and consolidate oversight of them in a centralized unit, freeing regional field operators to focus on more complex, higher-risk possessing facilities. After six years, the consensus among DCSA’s own field personnel is that the center has not delivered on that premise.