designated to lead the national effort to protect the Nation’s infrastructure, DHS must also act as a backstop to ensure that cybersecurity threats do not disrupt the provision of essential services to the American people. DHS must, therefore, smartly leverage its regulatory authorities in tailored ways, and engage with other agencies to ensure that their policies and efforts are informed by cybersecurity risks and aligned to national objectives to address critical cybersecurity gaps. To properly allocate resources and prioritize efforts, DHS must maintain substantial awareness of the cybersecurity risk posture across critical infrastructure. This includes understanding the potential consequences of infrastructure-related cybersecurity incidents. DHS must prioritize its engagement efforts based upon those with the highest risk, such as entities where a cyber incident could result in catastrophic impacts. 6 Objective 3.1: Mature cybersecurity offerings and engagements to address significant national risks to critical infrastructure. DHS must improve the cybersecurity of critical infrastructure through the development and deployment of tools, services, and other offerings, as well as through targeted outreach to critical infrastructure owners and operators, service providers, and other key enablers of risk management activity. DHS must routinely evaluate the value of these risk management efforts and assess capability gaps. In particular, DHS must engage sector-specific agencies, nonfederal cybersecurity firms, individual critical infrastructure entities, and other stakeholders to assess interdependencies and systemic risk across critical infrastructure, and identify gaps in risk management efforts. DHS offerings must be prioritized to focus on systemic risk or address risk at individual entities that have the greatest potential impact on national security, public health and safety, and economic security. Offerings that do not address identified gaps or provide DHS with access to unique cybersecurity information should be reconsidered. To ensure effective outreach, DHS must take a disciplined approach to identify its key stakeholders, including entities across all 16 critical infrastructure sectors and key enablers of risk management activities. DHS must expand efforts to encourage adoption of applicable cybersecurity best practices, including NIST’s Framework for Improving Critical Infrastructure Cybersecurity. 7 DHS must also increasingly leverage field personnel to engage geographically diverse stakeholders to encourage the adoption of cybersecurity risk management best practices and provide access to available cybersecurity information, risk management offerings, and other DHS-wide capabilities. DHS must also be prepared to engage with officials at the appropriate levels within an organization to ensure that gaps in critical infrastructure cybersecurity involving potentially significant impacts on national security, public health and safety, or economic security are addressed. 6 Executive Order 13636, “Improving Critical Infrastructure Cybersecurity” (2013), section 9 (https://www.gpo.gov/fdsys/pkg/FR-2013-02-19/pdf/2013-03915.pdf). 7 Available at https://www.nist.gov/cyberframework. 12