Earlier this year, program managers in the Department of Homeland and the General Services Administration\u2019s FEDSIM undertook a redesign of the Continuous Diagnostics and Mitigation (CDM) program, the largest cybersecurity effort in the federal government.<\/p>\n\n\n\n
While the program has a shiny new name \u2014 CDM DEFEND, which stands for Dynamic and Evolving Federal Enterprise Network Defense \u2014 program managers assert that this is more than just a rebranding.<\/p>\n\n\n\n
\u201cIt\u2019s an effort to replace the CDM BPAs that expire in August of 2018,\u201d explained Kevin Cox, CDM program manager at DHS, during a discussion Oct. 30 at the annual American Council for Technology and Industry Advisory Council (ACT-IAC) Executive Leadership Conference in Williamsburg, Va. \u201cIt will follow the same model of how the agencies are grouped, then we will be competing different task orders for system integrators to partner with those agencies.\u201d<\/p>\n\n\n\n
The focus on partnerships is key, said Cox, as the new CDM model will be less about buying specific services and technologies and more about creating a strong cybersecurity posture that can evolve over time.<\/p>\n\n\n\n
\u201cWe\u2019re not looking for a specific technology; we\u2019re not looking for a specific cyber solution,\u201d said Jim Piche, homeland security director for FEDSIM. \u201cWe\u2019re going to take the acquisition cycles out of it so that we can identify, acquire and deploy those cybersecurity tools at the speed they need to be deployed rather than getting into another procurement cycle.\u201d<\/p>\n\n\n\n
Using GSA\u2019s Alliant contract vehicle \u2014 and, subsequently, Alliant 2 as that contract goes into effect \u2014 CIO offices will issue a task order with a system integrator that will help the agency develop cybersecurity goals and discover the right technical solutions to achieve those goals. Then, over the life of the task order \u2014 five to six years, according to Cox \u2014 that framework can be adjusted as new tools and solutions are developed, and those products can be acquired without having to issue a new task order or contract.<\/p>\n\n\n\n
\u201cThis is not a BPA, it\u2019s not an IDIQ,\u201d Piche said. \u201cIt is a single-award task order to an integrator that is incrementally funded as a cost-type task order.\u201d<\/p>\n\n\n\n
That doesn\u2019t mean the whole CDM system will be thrown out.<\/p>\n\n\n\n
\u201cWhat\u2019s still the same is the inextricable relationship that Kevin and I have, the CDM program office and GSA \u2026 to bring the best innovation solutions to support the CDM program,\u201d Piche said. \u201cThe other thing that hasn\u2019t changed is the scope: every federal agency is a customer.\u201d<\/p>\n\n\n\n
Finally, Piche noted the program\u2019s reliance on industry. The program currently works with more than 100 companies and that isn\u2019t expected to change going forward.<\/p>\n\n\n\n
\u201cWhat we\u2019re trying to get out of the CDM program is better cybersecurity,\u201d Piche said. \u201cYou can also read that as \u2018compliant cybersecurity\u2019 or \u2018more efficient cybersecurity.\u2019 But we\u2019re also trying to do it more affordably.\u201d<\/p>\n\n\n\n
To be both effective and affordable, the contract vehicle needs to be able to adapt to the ever-changing landscape of cybersecurity.<\/p>\n\n\n\n
\u201cWe don\u2019t know today what better cybersecurity is going to look like in 2019 or 2020 or as we get to the tail end of this project,\u201d Piche said. Using this more flexible model will allow agencies to \u201credefine what is better cybersecurity in 2019 and 2020.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
CDM DEFEND will take the acquisition cycle out of the equation for agencies looking for new cybersecurity solutions.<\/p>\n","protected":false},"author":7,"featured_media":47732,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":36,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[104,106,36,31,33,6],"tags":[],"coauthors":[2349],"class_list":["post-16467","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-acquisition-update","category-daily-brief","category-gsa","category-home","category-newsletters","category-acquisition"],"acf":{"subheadline":"","legacy_arc_id":"4ULRATZS3JCODFJUO2ED5AWGFI","arc_canonical_url":"\/civilian\/dhs\/2017\/10\/30\/governments-biggest-cybersecurity-program-is-evolving\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n