Hi All,
CISA just cleared Continuous Diagnostics and Mitigation (CDM) Program Architecture CDM Data Model Document Version 4.1.1 for publication
The Cybersecurity and Infrastructure Security Agency (CISA) Continuous Diagnostics and Mitigation (CDM) Program operates on the premise of a common architecture that relies on capabilities provided by commercial-off-the-shelf tools and sensors. The CDM Program has identified a need to overlay similar data requirements on the solution to ensure that common program objectives are met and to clarify integration needs. This document outlines fundamental data elements that are expected in each agency-deployed CDM solution.
The CDM Data Model Document provides a comprehensive description of a common data schema that supports the associated logical data model (LDM) to ensure that prescribed diagnostic activities within CDM solutions are consistent across all participating federal agencies. It identifies the minimum set of data requirements needed to leverage the CDM solution to accomplish program objectives, specifically: to reduce agency threat surface; increase visibility into the federal cybersecurity posture; improve federal cybersecurity response capabilities; and streamline Federal Information Security Modernization Act (FISMA) reporting.
Additionally, this document delivers guidance regarding the data that CDM solutions must collect at the agency level. This comes with an explicit understanding that the system will be required to produce datasets from specific interrogations of the CDM data. It is expected that agencies and CDM integrators will enrich these datasets with other relevant information security continuous monitoring (ISCM) data that fulfills their agency-specific needs.
CDM integrators should use this document to drive development and refinement for a holistic implementation solution, incorporating these data requirements into the operational rhythm of security tools and sensors. This will provide data to facilitate the execution of CDM Program objectives.
------------------------------
Michael Roza CPA, CISA, CIA, CC, MBA, Exec MBA, CSA Research Fe
------------------------------