By Brent Hansen Feb 22, 2021 Agencies likely have the Continuous Diagnostics and Mitigation (CDM) program on their minds as a result of the Office of Management and Budget’s November memo requiring they share cyber risk data to a new federal dashboard. Specifically, the memo notes, agencies are required to “report the status of their information security programs to OMB,” with inspectors general conducting “annual independent assessments of those programs.” What should an agency’s “information security program” include? With agencies’ increased emphasis on big data throughout their operations, if the program does not include a strategy for big data and cloud security, it is incomplete.