What can your agency learn from the CDM rollout at DHS?
Connecting state and local government leaders
Agencies can gain valuable insight on the logistics of the Continuous Diagnostics and Mitigation program from the Department of Homeland Security’s experience with Phase I implementation.
It’s been a long 18 months since the Continuous Diagnostics and Mitigation (CDM) program was launched by the Department of Homeland Security in September 2013. With lots of eyes on the program and questions on how it will unfold and work, some of the answers and fruits of that planning may soon be coming into view.
DHS, the first award recipient under Task Order 2 in February, is No. 1 in line to begin implementing the Phase I capabilities, which include hardware and software asset management, configuration management and vulnerability assessment. With DHS as the “guinea pig,” so to speak, this presents a unique opportunity for your agency to learn from early experiences before undertaking your own.
As a former chief information security officer at two federal civilian agencies, I can’t overstate the value of benefitting from another agency’s trials, lessons learned and successes when anticipating and preparing for your own endeavor. The CDM integration across 11 DHS organizational units will deliver a great deal of insight for other agencies, helping them avoid hazards as well as optimize technical implementation and project management to reduce information security risk.
Let’s consider how your agency might benefit:
Technical implementation
Pilots are typically the most effective way to roll out projects of this magnitude. By fast-tracking the technical project at one of its organizational units, the DHS results serve as an instruction set of sorts for the rest of DHS, as well as a prototype for the other agencies soon to follow.
Other benefits gleaned from the pilot include know-how on integrating Phase 1 products, overcoming issues connecting with the federal dashboard and learning how best to aggregate and normalize the sensor data. Similarly, the application programming interfaces and integration packs that DHS develops could be repurposed and made available to agencies to help facilitate problem resolution.
Project management
Understandably, there’s great interest in knowing what effort and resources will be needed for Task Order 2 implementation. Rather than relying simply on initial labor and timeline estimates, agencies can draw on DHS’s actual experience to gain a far more realistic idea of the staff required and the project’s duration. Details about how the actual implementation varied from the planned project estimates will be useful to both agencies and vendors.
Other lessons from the implementation across DHS business units include how to get staff engaged and involved and the type of communications and reporting that are most effective for managing the process and keeping it on track.
Risk management
Once the CDM capabilities are in place, agencies can see how DHS is using the system outputs to manage and lower risk and how it’s progressing in achieving ongoing authorization goals. This insight could include the metrics and processes DHS devised for risk scoring and prioritization. Equally important are the measures of time and money saved with this new paradigm.
This is a great opportunity to show how CDM actually moves from a compliance-based, three-year cycle of risk management to one of ongoing, real-time information security. These results will help agencies build support for CDM throughout their organizations and position the program for success.
As one can imagine, information about how DHS handles the above issues could ease the path for agencies as they prepare their own deployments. The more they can learn about the integration and operation of these capabilities, the better they’ll be positioned for managing information security risk. This cycle of feedback also benefits the CDM/CMaaS vendors, helping them refine and improve the products and services associated with their solutions and learning how they can best train and assist agencies on their use.
Ultimately, the success of the CDM program hinges on the communications among DHS, other agencies and vendors. We all have a stake in this information security partnership. By sharing the right information and feedback at the right time, we can learn and adjust, making improvements as we go forward.
From your agency or department’s perspective, what would you like to see? If you have thoughts or recommendations please let us know and share your comments.