CDM Phase 2: How to avoid déjà vu all over again

You don’t get many do-overs in life, but if you did – like Bill Murray in the movie Groundhog Day – what might you revisit?  While I can’t promise a life-changing replay, here’s food for thought as it relates to the Homeland Security Department’s Continuous Diagnostics and Mitigation Program (CDM).  

The program, begun in 2013, was divided into three implementation phases, with the next Phase 2 devoted to various identity and access management services.  So as we round the quarter rail with CDM, agencies may want to consider how Phase 1 unfolded and what they can do differently or better in preparing for Phase 2. 

When we look back to 2013, there were valuable lessons learned as Phase 1 began with a requirements definition process.  At the time, agencies were asked to assess their capabilities and identify deficiencies or gaps that DHS could then help them fill through its CDM/Continuous Monitoring as a Service (CMaaS) blanket purchase agreement. 

But back then perhaps the concepts of CDM weren’t as clearly understood as they are now, and the exercise wasn’t given the attention or priority it deserved.  Or maybe assessments weren’t conducted agencywide, weren’t performed by those with the right skillsets or the information was outdated.

In fact, a 2014 survey by the SANS Institute found that only 21 percent of government-focused IT professionals had conducted a formal foundational assessment before starting the program. Considering you can only improve security by knowing your baseline and where the holes are, this indicates that many groups may need to go back and conduct additional preparation work prior to starting Phase 2.  

Soon it will be déjà vu all over again, as Phase 2 also requires an assessment process. This time, the assessment will be for a set of requirements that include management of network access controls, people granted access, security-related behavior, credentials and authentication.  Considering that Phase 2 builds on Phase 1, it’s vital the process be done right, and that agencies revisit their Phase 1 assessment strategy before they tackle it again. 

To help agencies ensure their Phase 2 needs are thoroughly and accurately identified, here are four key recommendations: 

1. Get the right people involved.  The process of determining whether Phase 2 requirements are being met should include all those with a relevant perspective on agencywide business needs. Rather than being performed by just one person or limited to one component, the team should involve IT operations, affected business units, security compliance, legal, human resources and privacy specialists.  Getting  a comprehensive assessment requires input from a broad range of people with the right skills. 

2. Address the non-technical.  Not all gaps in continuous monitoring are attributable to products and technology. Many are a function of human factors –processes and behaviors involved in managing and operating a CDM program.  When evaluating Phase 2 requirements, review your agency’s personnel and the skills they’ll need to deploy and operate CDM tools, along with any training that will be required.  Personnel processes that need to change should also be reflected in the policies and procedures that support them.  

3. Use what works.  Look for pockets of excellence that can be leveraged, and identify gaps that can be closed in-house.  For example, there may be an identity management solution that’s working well in one corner of the agency that can be used enterprisewide, eliminating the need to procure a duplicate. By evaluating the tools or products it already owns, an agency may also uncover capabilities that simply aren’t being used.  It may be just a matter of activating or licensing additional features or modules, without deploying an entirely new solution that would demand more funding or retraining.

4. Continue to evaluate gaps.  Considering that change is a constant, other gaps may arise and priorities may shift.  Just because the initial task of identifying Phase 2 gaps has been successful does not mean the work is done.  Continue to evaluate and report as needed to stay aware of the agency’s current state.  Ongoing risk management means bringing a CDM strategy to life, not just dusting it off once a year for the Inspector General. 

Performing a proper foundational assessment is not only the best way to avoid the déjà vu of previous mistakes, it’s also the essential first step for improving security through CDM. 

While the CDM program offers great promise and benefits, there will be challenges along the way.  But there’s no need to go it alone.  Agencies without the necessary expertise or resources can rely on the CDM/CMaaS program for help.  The BPA holders selected by DHS are experienced in assessing Phase 1 and Phase 2 requirements, recommending mitigation strategies and implementing capabilities.