Continuous Diagnostics and Mitigation (CDM) Program Manager Kevin Cox on July 21 discussed the importance of data quality in the CDM ecosystem that stretches from sensors on Federal agency networks, up to agency-level dashboards, and then through to a Federal-level dashboard that gives the Cybersecurity and Infrastructure Security Agency (CISA) a wide view of the civilian Federal agency security posture.
“We can’t just assume that the data is coming in correctly,” Cox said at an event organized by ATARC. “So we work with agency and system integrator partners to make sure that data” matches up “with the reality closer to the action on the ground,” he said.
To further that effort, Cox said the program finalized a data quality management plan in May, and that agencies and integrators “are now in the process of integrating it.” Data elements that are deemed “critical” are getting priority attention, while work is also being done on elements considered less critical, Cox indicated.
Getting the data certified according to the plan is ongoing, he said, and will improve usefulness of the data to agencies, security operations centers, and at the Federal CDM dashboard level. “Then we can get a sense of what the Federal landscape looks like,” he said.
Ensuring data quality also will improve the utility of the program’s Agency-Wide Adaptive Risk-Enumeration (AWARE) algorithm which provides relative security scoring data to agencies. “That’s a multi-year effort, but operationalizing the data is the first step,” Cox said.
