---
title: "CISA CDM — Continuous Diagnostics and Mitigation (AI-agent asset accountability) — KYE Protocol™ coverage"
description: "CISA CDM — Continuous Diagnostics and Mitigation (AI-agent asset accountability) coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it."
url: https://kyeprotocol.com/compliance/cisa-cdm/
lang: en
source: "KYE Protocol"
---

> CISA CDM — Continuous Diagnostics and Mitigation (AI-agent asset accountability) coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it.

CISA CDM — Continuous Diagnostics and Mitigation (AI-agent asset accountability)

# CISA CDM — Continuous Diagnostics and Mitigation (AI-agent asset accountability) — 100% of in-scope requirements covered.

11 requirements · 11 in scope (11 enforced). The 100% is weighted over the in-scope base.

**Source:** CISA Continuous Diagnostics and Mitigation (CDM) Program — capability areas: Asset Management (HWAM/SWAM/CSM/VUL), Identity & Access Management (TRUST/CRED/PRIV/BEHAVE), Network Security Management (BOUND/MNGEVT), Data Protection Management (DPM). Mapped to the agentic-AI asset surface: an AI agent that holds credentials, reaches data, and acts on systems is a reportable cyber asset. · **License:** U.S. Government work — CISA CDM program documentation is public

## By category

| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
| --- | --- | --- | --- | --- | --- | --- |
| Asset Management (what is on the network / acting) | 4 | 4 | 0 | 0 | 0 | **100%** |
| Identity & Access Management (who/what is on the network) | 4 | 4 | 0 | 0 | 0 | **100%** |
| Network Security Management (what is happening on the network) | 2 | 2 | 0 | 0 | 0 | **100%** |
| Data Protection Management (how is data protected) | 1 | 1 | 0 | 0 | 0 | **100%** |

## Every requirement → the KYE™ artefact that enforces it

| ID | Title | Status | KYE™ enforcement |
| --- | --- | --- | --- |
| `cisa-cdm.HWAM` | Asset Management — HWAM: inventory every device/agent acting on the network (for AI: every agent that can act is a reportable asset) | enforced | **registries**: `internal` **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `cisa-cdm.SWAM` | Asset Management — SWAM: inventory the software/models/tools each agent is composed of | enforced | **registries**: `internal` **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md`, `constitution/52-DELEGATED-AGENT-BINDING.md` |
| `cisa-cdm.CSM` | Asset Management — CSM: manage configuration settings against an approved baseline before deployment | enforced | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/18-OPERATING-MODEL.md` |
| `cisa-cdm.VUL` | Asset Management — VUL: detect deviation of live behaviour from the approved design (vulnerability/variance) | enforced | **engines**: `internal` **audit\_events**: `kye.reality_coupling_check.v1`, `kye.agency_drift.event.v1` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `cisa-cdm.TRUST` | Identity & Access Management — TRUST: determine who/what is acting and on whose behalf | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.evidence.decision_map.v1` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md`, `constitution/14-AGENTS-AND-ENGINES.md` |
| `cisa-cdm.CRED` | Identity & Access Management — CRED: bind credentials/authority tokens with expiry and revocation | enforced | **audit\_events**: `kye.evidence.decision_map.v1` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md`, `constitution/13-RESILIENCE-LOOP.md` |
| `cisa-cdm.PRIV` | Identity & Access Management — PRIV: enforce least privilege / bounded purpose at the action boundary | enforced | **audit\_events**: `kye.purpose.admissibility.v1` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `cisa-cdm.BEHAVE` | Identity & Access Management — BEHAVE: monitor agent behaviour against expected operating design | enforced | **engines**: `internal` **audit\_events**: `kye.agency_drift.event.v1` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/52-DELEGATED-AGENT-BINDING.md` |
| `cisa-cdm.BOUND` | Network Security Management — BOUND: manage boundaries / isolate each tenant and trust domain | enforced | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/16-EDGE-RUNTIME.md` |
| `cisa-cdm.MNGEVT` | Network Security Management — MNGEVT: prepare for and respond to events (suspend / revoke / freeze) | enforced | **audit\_events**: `kye.evidence.decision_map.v1` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/21-DELEGATED-AUDITABILITY.md` |
| `cisa-cdm.DPM` | Data Protection Management — DPM: protect data with tamper-evident, replayable evidence of every access decision | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md`, `constitution/21-DELEGATED-AUDITABILITY.md` |

Canonical KYE™ surfaces referenced on this page: [KYE Protocol™](https://kyeprotocol.com/).