CISA CDM — Continuous Diagnostics and Mitigation (AI-agent asset accountability)

CISA CDM — Continuous Diagnostics and Mitigation (AI-agent asset accountability) — 100% of in-scope requirements covered.

11 requirements · 11 in scope (11 enforced). The 100% is weighted over the in-scope base.

CISA CDM: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. HWAM · enforced

    Asset Management — HWAM: inventory every device/agent acting on the network (for AI: every agent that can act…

    Audit events: kye.compliance.attestation.v1 · Constitution: 14 agents and engines

  2. SWAM · enforced

    Asset Management — SWAM: inventory the software/models/tools each agent is composed of

    Audit events: kye.compliance.attestation.v1 · Constitution: 14 agents and engines, 52 delegated agent binding

  3. CSM · enforced

    Asset Management — CSM: manage configuration settings against an approved baseline before deployment

    Audit events: kye.compliance.attestation.v1 · Constitution: 18 operating model

  4. VUL · enforced

    Asset Management — VUL: detect deviation of live behaviour from the approved design (vulnerability/variance)

    Audit events: kye.reality_coupling_check.v1, kye.agency_drift.event.v1 · Constitution: 13 resilience loop

  5. TRUST · enforced

    Identity & Access Management — TRUST: determine who/what is acting and on whose behalf

    Audit events: kye.purpose.admissibility.v1, kye.evidence.decision_map.v1 · Constitution: 12 purpose permission, 14 agents and engines

  6. CRED · enforced

    Identity & Access Management — CRED: bind credentials/authority tokens with expiry and revocation

    Audit events: kye.evidence.decision_map.v1 · Constitution: 12 purpose permission, 13 resilience loop

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: CISA Continuous Diagnostics and Mitigation (CDM) Program — capability areas: Asset Management (HWAM/SWAM/CSM/VUL), Identity & Access Management (TRUST/CRED/PRIV/BEHAVE), Network Security Management (BOUND/MNGEVT), Data Protection Management (DPM). Mapped to the agentic-AI asset surface: an AI agent that holds credentials, reaches data, and acts on systems is a reportable cyber asset. · License: U.S. Government work — CISA CDM program documentation is public

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Asset Management (what is on the network / acting)44000100%
Identity & Access Management (who/what is on the network)44000100%
Network Security Management (what is happening on the network)22000100%
Data Protection Management (how is data protected)11000100%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
cisa-cdm.HWAMAsset Management — HWAM: inventory every device/agent acting on the network (for AI: every agent that can act is a reportable asset)enforcedregistries: internal
audit_events: kye.compliance.attestation.v1
constitution_refs: constitution/14-AGENTS-AND-ENGINES.md
cisa-cdm.SWAMAsset Management — SWAM: inventory the software/models/tools each agent is composed ofenforcedregistries: internal
audit_events: kye.compliance.attestation.v1
constitution_refs: constitution/14-AGENTS-AND-ENGINES.md, constitution/52-DELEGATED-AGENT-BINDING.md
cisa-cdm.CSMAsset Management — CSM: manage configuration settings against an approved baseline before deploymentenforcedaudit_events: kye.compliance.attestation.v1
constitution_refs: constitution/18-OPERATING-MODEL.md
cisa-cdm.VULAsset Management — VUL: detect deviation of live behaviour from the approved design (vulnerability/variance)enforcedengines: internal
audit_events: kye.reality_coupling_check.v1, kye.agency_drift.event.v1
constitution_refs: constitution/13-RESILIENCE-LOOP.md
cisa-cdm.TRUSTIdentity & Access Management — TRUST: determine who/what is acting and on whose behalfenforcedaudit_events: kye.purpose.admissibility.v1, kye.evidence.decision_map.v1
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/14-AGENTS-AND-ENGINES.md
cisa-cdm.CREDIdentity & Access Management — CRED: bind credentials/authority tokens with expiry and revocationenforcedaudit_events: kye.evidence.decision_map.v1
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/13-RESILIENCE-LOOP.md
cisa-cdm.PRIVIdentity & Access Management — PRIV: enforce least privilege / bounded purpose at the action boundaryenforcedaudit_events: kye.purpose.admissibility.v1
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
cisa-cdm.BEHAVEIdentity & Access Management — BEHAVE: monitor agent behaviour against expected operating designenforcedengines: internal
audit_events: kye.agency_drift.event.v1
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/52-DELEGATED-AGENT-BINDING.md
cisa-cdm.BOUNDNetwork Security Management — BOUND: manage boundaries / isolate each tenant and trust domainenforcedaudit_events: kye.compliance.attestation.v1
constitution_refs: constitution/16-EDGE-RUNTIME.md
cisa-cdm.MNGEVTNetwork Security Management — MNGEVT: prepare for and respond to events (suspend / revoke / freeze)enforcedaudit_events: kye.evidence.decision_map.v1
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/21-DELEGATED-AUDITABILITY.md
cisa-cdm.DPMData Protection Management — DPM: protect data with tamper-evident, replayable evidence of every access decisionenforcedaudit_events: kye.evidence.pack.v1, kye.compliance.attestation.v1
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md, constitution/21-DELEGATED-AUDITABILITY.md

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.