The Government Accountability Office has called on the Department of Homeland Security to craft network security and data protection guidance for its Continuous Diagnostics and Mitigation, or CDM, program.
In a new report, the congressional watchdog warned that the lack of guidance has negative impacts on data protection and quality across several agencies.
Launched in 2012, CDM aims to strengthen government cybersecurity by providing tools and integration services to federal agencies. The Cybersecurity and Infrastructure Security Agency oversees the program.
CDM Progress and Persistent Challenges
GAO pointed out that CDM has already met two goals: to minimize exposure to insecure configurations and known vulnerabilities at 22 out of 23 agencies and implement incident response capability.
However, officials from 21 of 23 agencies admitted that they have yet to fully implement network security and data protection capabilities.
CDM has automated Federal Information Security Management Act of 2002, or FISMA, reporting, but seven agencies also reported that data quality issues are preventing them from streamlining the process, forcing personnel to conduct manual updates and correct errors.
CISA also has not met the Office of Management and Budget’s expectations on endpoint detection and response and cloud asset management. GAO said implementing an endpoint solution and updated guidance on cloud asset management for all agencies would improve their cybersecurity posture.
DHS and CISA concurred with all of GAO’s recommendations.
