The Cybersecurity and Infrastructure Security Agency (CISA) is moving its new security information and event management (SIEM) as a service (SIEMaaS) offering into expansion mode. Officials are working to scale the service across federal civilian agencies and strengthen governmentwide visibility into cyber threats.
Richard Grabowski, deputy program manager for CISA’s Continuous Diagnostics and Mitigation (CDM) program, said today that the agency has a “healthy backlog” for SIEMaaS and is ramping up staffing and support as adoption grows.
“This is going to be big for us. It’s a core cyber capability. Every SOC needs to have something that sits and does SIEM-like things,” Grabowski said at the Federal Cyber Defense Breakfast in Arlington, Va.
CISA launched the offering for Federal Civilian Executive Branch (FCEB) agencies earlier this year, with Elastic providing the underlying SIEM technology through prime contractor ECS.
CISA’s CDM Program Management Office oversees hosting and operations for the platform, which is available to FCEB agencies at no cost.
Grabowski said CISA moved from SIEMaaS ideation in the third quarter of fiscal year 2025 to early adoption in the second quarter of fiscal year 2026.
Now, he said the agency is focused on expanding and enhancing the program. That includes increasing onboarding capacity and staffing, building out 24/7 infrastructure support, and aligning the service with new federal logging requirements under the Office of Management and Budget’s (OMB) Memorandum M-26-14.
Matt House, CDM program manager at CISA, said the agency is designing SIEMaaS to be “fully compliant out of the box” with respect to the M-26-14 requirements – reducing complexity for agencies.
“From an agency perspective, they should see something that’s fairly well baked, something that should be relatively straightforward to integrate into their environment if they need to migrate away from a legacy SIEM, and one that has a radically reduced – if not close to zero – cost profile to them,” House said.
House called SIEMaaS the “next big opportunity” for CISA to expand operational visibility, giving both agency and CISA threat hunters more information to detect and respond to threats.
That cross-agency visibility is central to CISA’s pitch for the service. Grabowski described SIEMaaS as a “rosetta stone” that could give defenders timely and trustworthy data during major cyber incidents.
CISA already operates more than 115 Elastic deployments across 94 FCEB agencies through CDM, according to Grabowski.
“We would like to continue to deliver SIEM-as-a-Service to every single one of those customers,” he added.
Grabowski said CISA plans to offer tailored training for participating agencies and establish recurring engagements and communities of practice. He added that later phases of the SIEMaaS roadmap will look at integrating agentic artificial intelligence and potentially brokered security operations center services.
SIEMaaS is part of a broader push to reposition CDM for the next generation of federal cyber defense. Acting Federal Chief Information Security Officer (CISO) Michael Duffy said the program has a unique ability to provide governmentwide visibility.
“CDM is stepping back into the spotlight after a few years of thinking about what it would mean to evolve those capabilities,” Duffy said. He added that “there’s no other program that allows us that level of visibility.”
Duffy said the program has his backing and other high-level support to “push this important work forward.”
“CDM has shown us what’s possible to do at federal scale like no program has before,” Duffy said. “The opportunity now is to position that model for what is to come.”