CISA Scales Free SIEM-as-a-Service to Shorten Federal Response Windows

WASHINGTON - The Cybersecurity and Infrastructure Security Agency is expanding its security information and event management as a service offering for federal civilian agencies, aiming to give agency and CISA hunters shared SIEM telemetry at no cost to participating departments while cutting the time needed to start an investigation.

Officials described the expansion at the Federal Cyber Defense Breakfast in mid-September 2026. Richard Grabowski, deputy program manager for CISA's Continuous Diagnostics and Mitigation program, said SIEMaaS is moving from early adoption into a larger onboarding push, with added staffing and 24/7 infrastructure support. Elastic supplies the underlying SIEM technology through prime contractor ECS, and the CDM Program Management Office hosts and operates the platform for Federal Civilian Executive Branch agencies.

Grabowski said CISA already runs more than 115 Elastic deployments across 94 FCEB agencies through CDM and wants to extend SIEMaaS to those customers. Matt House, CDM program manager, said the service is designed to be largely compliant out of the box with Office of Management and Budget Memorandum M-26-14 logging and Threat Hunting, Investigation, Response and Forensics requirements, with a cost profile for agencies that is radically reduced and in some cases near zero. House also said only a couple of agencies are fully operational on SIEMaaS so far, while a large civilian agency is in deployment and others have inquired.

For security operations teams, the operational claim is speed. Grabowski said initiating a response under traditional CDM processes can take as long as 14 days because of administrative, access, and investigative steps, while the same path on SIEMaaS can take about 40 minutes. Later roadmap items include agentic artificial intelligence and potentially brokered SOC services. Operators outside the federal market should treat those figures as CISA's own program metrics rather than a vendor benchmark, and map whether their SIEM already meets equivalent logging, hunting, and access controls before using the federal service as a comparison.