The State Department released a report earlier this month on implementation of the Best Practices Panel’s (BPP) recommendations on diplomatic security. Interestingly, the two most important ones were rejected by the State Department.

The panel of five seasoned security experts was established according to the recommendation of the Benghazi Accountability Review Board (ARB). The BPP delivered its recommendations on August 29, 2013. The implementation report reveals that the BPP made 40 recommendations to improve diplomatic security. Thirty-eight of those recommendations were accepted by State, including establishing a risk management model and policy; increasing training for diplomats posted to dangerous environments; and developing a security accountability framework.

Two recommendations were rejected by State, including the first and most urgent one:

Recommendation 1. “The Department should as a matter of urgency establish an Under Secretary for Diplomatic Security.”

Recommendation 13. “Waivers [exceptions] to established security standards should only be provided subsequent to the implementation of mitigating measures as agreed by regional bureau or other program managers, as advised by DS [Diplomatic Security], and as informed by the Department risk management model.

The BPP notes that diplomatic security has suffered in the Bureau of Management because of “confusion regarding clear lines of authority, responsibility and accountability for security within the department.” The review board that followed the 1998 East Africa Embassy bombings made the same recommendation that an Undersecretary for Diplomatic Security was needed. While that recommendation was approved by then-Secretary of State Madeleine Albright, it was never implemented. Back in 1998, Patrick Kennedy was the Acting Undersecretary for Management. He is still Undersecretary for Management, and in both East Africa and Benghazi, he failed to heed appeals from the embassies for increased security.

As for waivers regarding standards diplomatic security installations (like the Benghazi compound), the Best Practices Panel recommended that local and program staff be involved and that mitigating security measures have to be taken. This makes sense. In Benghazi, as noted by whistleblower and regional security officer Eric Nordstrom, no one even knows who issued the waiver of adequate security.

Both Tripoli and Benghazi had received a rating of “high” on State’s risk assessment scale, the only two U.S. facilities to do so out of 226. And still former Secretary State Hillary Clinton made opening Benghazi the top priority for Christopher Stephens when he was appointed ambassador in the spring of 2012.

Granted, changing State’s management structure does not necessarily change the performance of poor managers. Yet, someone at State needs to have ownership of diplomatic security, which was considered secondary to political priorities in Benghazi. As the Congressional Select Committee gets up and running, diplomatic security reform has to be one of its priorities.