A recent Government Accountability Office study shows the Federal Protective Service is not protecting General Services Administration buildings because of underfunding. And that's just the story for GSA buildings. What steps has your agency taken to assess the quality of physical protection at your GSA and non-GSA facilities?
The response to this GAO report from most agency heads is likely to be "What does that have to do with me? Are Congress or the Office of Management and Budget going to give my agency a bad grade because FPS is not doing the job?"
Senior managers understand that lots of money must be spent on computer security lest their agency get a "bad grade" (or perhaps even because current computer security is lousy). But they have no idea about the true cost of mission security or what sorts of investments are necessary to improve mission security.