Lack of Cybersecurity Guidance Could Leave Federal Systems Vulnerable, Watchdog Warns

Federal agencies relying on a key Department of Homeland Security cybersecurity program may not be receiving enough guidance to fully protect their networks and data, according to a newly released government report. The program, known as Continuous Diagnostics and Mitigation (CDM), is meeting some of its goals, but shortcomings in implementation could put federal systems—and potentially public services—at risk.

The CDM program, overseen by DHS’s Cybersecurity and Infrastructure Security Agency (CISA), is intended to help agencies monitor their networks, identify vulnerabilities, and respond to cybersecurity incidents. It has succeeded in reducing exposure to known vulnerabilities and aiding in incident response efforts. However, the program is falling short in increasing federal agencies’ visibility into their cybersecurity posture and streamlining reporting under the Federal Information Security Modernization Act (FISMA). A key issue is that most agencies surveyed said they had not yet fully implemented CDM’s capabilities due to limited guidance from CISA.

Another major concern identified by the Government Accountability Office (GAO) involves the quality of the data used in the program. Several agencies reported having to manually correct data errors when compiling required cybersecurity reports, undermining the intended efficiency of the system. Additionally, while the CDM program is expected to support government-wide cybersecurity initiatives like zero trust architecture and endpoint detection, CISA has not completed critical tasks such as implementing an endpoint solution across all agencies or updating its cloud asset management strategy.

To address these gaps, the GAO issued four recommendations to DHS and CISA. These include providing updated guidance to help agencies implement network security and data protection measures, establishing milestones to correct data quality issues, rolling out an endpoint detection capability, and finalizing cloud asset management plans. DHS has agreed with the recommendations, but they remain open until concrete action is taken. Residents who rely on federal digital services or have concerns about data privacy may want to pay attention to how quickly these improvements are implemented, as delayed action could affect the resilience of key public systems.

Article by multiple contributors, based upon information from the Government Accountability Office press release GAO-25-107470, published June 11, 2025.

---