OMB needs an enterprise risk officer to help protect infrastructure and supply chain, report says