Continuous Diagnostics & Mitigation (CDM) Program

The Continuous Diagnostics and Mitigation (CDM) program helps strengthen the cybersecurity of government networks and systems. CDM provides federal agencies with capabilities and tools that

  • Find cybersecurity risks on an ongoing basis;
  • Prioritize these risks based upon potential impacts; and
  • Enable cybersecurity personnel to focus on the most significant problems first.

For CDM Tools SIN (132-44) Information for Ordering Organizations.

For CDM Tools SIN (132-44) Information for Vendors.

Get more information on the CDM Program.

Key Program objectives are to:

  • Reduce agency threat surface;
  • Streamline Federal Information Security Modernization Act (FISMA) reporting;
  • Increase visibility into federal cybersecurity; and
  • Improve the ability to respond to federal cybersecurity issues.

We provide both products and services to meet the CDM mission:

  • Products - CDM Tools Special Item Number (SIN) (132-44)* on IT Schedule 70; and
  • Services - a series of task orders referred to as CDM Dynamic and Evolving Federal Enterprise Network Defense (DEFEND) against the Governmentwide Acquisition Contract (GWAC), Alliant.

*Only CDM program validated products on the Approved Products List (APL) can be offered on the CDM Tools SIN. The Information for Vendors webpage has APL facts and submission instructions for new products.

In August 2013, the Department of Homeland Security (DHS) in partnership with the General Services Administration (GSA) established governmentwide Blanket Purchase Agreements (BPAs) under Multiple Award GSA IT Schedule 70.

The BPAs, known as the CDM Tools/Continuous Monitoring as a Service (CMaaS) BPAs, provided a consistent governmentwide set of information security continuous monitoring (ISCM) tools and services at a reduced cost that enhances the government's ability to identify and mitigate the impact of emerging cyber threats. The BPA offered 34 tiered price bands, providing for cumulative quantity discounts for each product available for purchase. The CDM Tools/CMaaS BPAs expired in August 2018 and was replaced with the CDM program’s new acquisition strategy.

CDM delivers capabilities to agencies across all aspects of the program and at varying timelines, tailored to best meet agency readiness and agency specific needs.

These capabilities are outlined in two volumes:

  • CDM Technical Capabilities Volume One Actual Desired States [PDF - 652 KB] – This document discusses how agencies can define the desired state within the CDM program, leveraging three frameworks: that of the CDM architecture, the Cybersecurity Framework, and the security controls framework outlined by the National Institute of Standards and Technology (NIST).
  • CDM Technical Capabilities Volume Two Requirements Catalog [PDF - 707 KB] – This document describes the requirements for the CDM program that are consistent with the overarching goal of enabling U.S. government entities to assess and improve the security posture of agencies’ information systems. These requirements will be used for the CDM solicitations called DEFEND (Dynamically Evolving Federal Enterprise Network Defense).

For more information on CDM capabilities, please visit the DHS CDM website.

Resources for assessing and managing information risk:

Websites

Agency Contacts

  • All acquisition-related questions, eligibility requirements, and ordering guide requests:
  • Technical questions regarding the program:
    CDM Program Office – cdm@hq.dhs.gov
  • CDM Approved Products List and CDM Tools SIN questions:
    DHS Acquisition and Requirements Management – cdm.arm@hq.dhs.gov

The shortcut to this page is gsa.gov/cdm.

Last Reviewed: 2019-10-09