The agency’s director cites a failure to secure the building the shooter fired from among a litany of security breakdowns.