DHS Has Made Limited Progress Implementing the Continuous Diagnostics and Mitigation Program

DHS had not yet strengthened its cybersecurity posture by implementing a Continuous Diagnostics and Mitigation (CDM) Program. DHS spent more than $180 million between 2013 and 2020 to design and deploy a department-wide continuous monitoring solution but faced setbacks. DHS initially planned to deploy its internal CDM solution by 2017 using a “One DHS” approach that restricted components to a standard set of common tools. We attributed DHS’ limited progress to an unsuccessful initial implementation strategy, significant changes to its deployment approach, and continuing issues with component data collection and integration. As of March 2020, DHS had developed a key element of the program, its internal CDM dashboard. However, the dashboard contained less than half of the required asset management data. As a result, the Department cannot leverage intended benefits of the dashboard to manage, prioritize, and respond to cyber risks in real time. Finally, we identified vulnerabilities on CDM servers and databases. This occurred because DHS did not clearly define patch management responsibilities and had not yet implemented required configuration settings. Consequently, databases and servers could be vulnerable to cybersecurity attack, and the integrity, confidentiality, and availability of the data could be at risk. We made three recommendations for DHS to update its program plan, address vulnerabilities, and define patch management responsibilities.