In 2016, Russian President Vladimir Putin orchestrated a comprehensive attack on U.S. sovereignty by attempting to shape the outcome of our presidential election. Special Counsel Robert Mueller and his investigative team should be commended for providing amazing details about some aspects of this Russian intervention.

But Mueller’s accounting should not be confused with the 9/11 Commission report that was issued after the terrorist attacks against the United States on Sept. 11, 2001. Mueller and his team had a specific task, not a comprehensive mandate. They did not analyze all aspects of the Russian interference campaign, which extended beyond social media strategies and computer-intrusion operations. They did not assess how the Obama administration, social media companies and media organizations responded to Russian meddling. They did not evaluate the appropriateness of a number of interactions between the Trump campaign and Russian officials. Most importantly, they did not propose policies for preventing future attacks. The Mueller report is an important first step, but only a first step.

Volume I of Mueller’s report focuses principally on the two operations conducted by the Internet Research Agency (IRA) and the GRU, Russia’s military intelligence agency. This scope is reasonable, since they probably had the biggest impact. As the Mueller report reveals in fantastic detail, the IRA deployed multiple methods to influence U.S. electoral preferences and political views – primarily in the virtual world, on social media platforms, but also, at times, in the physical one. The GRU stole private property from the Democratic National Committee and Democratic Congressional Campaign Committee, as well as from Clinton campaign chairman John Podesta, and then published this data to try to damage candidate Hillary Clinton and help candidate Donald Trump.

Yet the Russian government and its proxies ran several other plays only partially discussed in the Mueller report. Russian media companies, including primarily RT and Sputnik, sought to influence American voter attitudes. Most audaciously and frighteningly, cyber operatives closely tied to the Russian government probed the U.S. electoral infrastructure in 21 states in 2016. And we still have little transparency about the economic ties between Russian actors and U.S. candidates and their campaign officials involved in the 2016 elections. The U.S. national interest would be well served by Mueller-size reports on these other Russian activities as well.

We also need in-depth studies of how policymakers (and others) responded or failed to respond effectively to these Russian efforts. The bipartisan commission established after 9/11 investigated thoroughly what measures the George W. Bush administration did and did not take to prevent that attack. There has been no such accounting of President Barack Obama’s administration and congressional efforts. Should the FBI have moved more quickly to communicate with the campaigns under attack or with the social media platforms being exploited by the IRA? Should the White House have spoken more forcefully and more often about these attacks? What did Congress do right and wrong? We need to learn from past mistakes to avoid them in the future.

The actions of social media companies and traditional media organizations require similar scrutiny. How could Russian actors so easily broadcast partisan and false information on social media platforms? Why did the “sweeping and systematic” Russian attacks (to use Mueller’s words) get so little attention from the broadcast and print media in 2016? Why did some journalists and commentators wrongly label this attack on our country a “hoax”? Were government officials, including those in charge of the investigation at the time, deliberately misleading the media, or could more have been done to dig deeper into this story before November 2016? What is the proper use of stolen data in future reporting?

We also need a more thorough and precise assessment of the intentions behind contacts between campaigns and foreign governments, companies or individuals to develop policy prescriptions — be they norms or laws — for future elections. (If these assessments are in the classified parts of the Mueller report, they should be published.) Mueller decided that these contacts were not criminal, but they were, in my view, wrong. They should not be repeated.

Candidates should not be in direct contact with foreigners to obtain compromising material on their opponents. They should not encourage foreign governments to steal property from their opponents and then promote the widespread dissemination of that illicit material. And they should not engage in business deals with foreign partners in ways that could be construed as conflicts of interest. At minimum, all candidates should disclose their business interests in foreign companies; publishing one’s tax returns would be an easy way to provide this necessary transparency. And foreign companies, organizations and consultants (e.g., Orbis Business Intelligence, Cambridge Analytica, WikiLeaks) should not be allowed to work on U.S. campaigns.

The report appears to clear Trump and his campaign team of the crime of conspiring with the Russians. That means that the president and his associates should feel free to acknowledge and criticize forcefully what the Russians did to us in 2016. The Trump administration should seize this chance to work with Congress, the media and election officials to protect our elections from the malign influence of foreign forces. Some policy prescriptions are obvious and ripe for implementation. Other issues, however, will require more analysis and more creative solutions.

The Mueller report is good start. But it is only a start.

McFaul is director of the Freeman Spogli Institute for International Studies and a Hoover fellow at Stanford University and a contributing columnist to The Post. He is the author of “From Cold War to Hot Peace: An American Ambassador in Putin’s Russia.”