# CISA Expands SIEMaaS for Federal Cybersecurity

The Cybersecurity and Infrastructure Security Agency (CISA) is scaling its Security Information and Event Management as a Service (SIEMaaS) platform across federal civilian agencies in 2026 to enhance cyber threat detection, compliance, and response capabilities. This cloud-based service supports compliance with updated Office of Management and Budget (OMB) logging and monitoring mandates, aiming to reduce incident response times from up to 14 days to approximately 40 minutes. CISA is increasing staffing and 24/7 support to onboard agencies efficiently, while vendors like Elastic, ECS, and Tines are positioned to provide technology and automation solutions aligned with these federal cybersecurity modernization efforts.

- **Why this matters:** Federal agencies must comply with OMB Memorandum M-26-14 requiring risk-based logging and continuous event monitoring, creating demand for scalable SIEM and automation platforms.
- Contractors specializing in SIEMaaS, cybersecurity automation, and cloud-based monitoring services have significant opportunities to support CISA’s expanding CDM program.
- Agencies migrating from legacy SIEM systems can leverage this cost-effective, government-provided service to improve cyber incident detection and reduce response times.
- Procurement professionals should evaluate contract vehicles and partnerships with prime contractors like Elastic and ECS, as well as emerging automation providers such as Tines, to align with federal cybersecurity priorities.

**Jurisdictions:** federal
**Industries:** Information Technology, Defense & Military
**Topics:** Cybersecurity, Cloud Services
**Published:** September 16, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)
- Office of Management and Budget (OMB)
- Continuous Diagnostics and Mitigation Program (CDM)
- Federal Civilian Executive Branch (FCEB)

### Vendors
- Elastic (Prime contractor technology provider)
- ECS (Prime contractor)
- Tines (automation platform provider)

### Key Quotes
> CDM program has been working on what is next and what the new generation of cyber capabilities should be and the way that we as a federal government should be thinking about the strategic landscape and where CDM fits into all of this.
> — Michael Duffy, Acting Federal Chief Information Security Officer

> From an agency perspective, they should see something that28099s fairly well baked, something that should be relatively straightforward to integrate into their environment if they need to migrate away from a legacy SIEM, and one that has a radically reduced 28093 if not close to zero 28093 cost profile to them.
> — Matt House, CDM Program Manager

> This is going to be big for us. It28099s a core cyber capability. Every SOC needs to have something that sits and does SIEM-like things.
> — Richard Grabowski, Deputy Program Manager, CDM Program

### Sources
- [Tines Positions Automation Platform for Federal Cybersecurity Logging Demands - TipRanks.com](https://www.tipranks.com/news/private-companies/tines-positions-automation-platform-for-federal-cybersecurity-logging-demands) - TipRanks
- [CISA Looks to Scale SIEM as a Service Across Federal Agencies – MeriTalk](https://www.meritalk.com/articles/cisa-looks-to-scale-siem-as-a-service-across-federal-agencies) - MeriTalk
- [New CDM Security Service Aims to Cut Cyber Response Times | GovCIO Media & Research](https://govciomedia.com/new-cdm-security-service-aims-to-cut-cyber-response-times) - GovCIO Media & Research