{
  "version": "1.0.0",
  "generatedAt": "2026-10-19T06:38:19.302Z",
  "findingType": "finding",
  "findingId": 4136,
  "contentHash": "4a7cc128e17475867b2141fb65c058a4bda66faeeb9648bec2cda66df445827e",
  "title": "Booz Allen Hamilton Holds Exclusive CDM DEFEND Contracts Covering 17 of 23 CFO Act Agencies Under EO 14028; Intelligence Community Cybersecurity Work Exempt from FPDS-NG Reporting",
  "summary": "Booz Allen Hamilton holds exclusive Continuous Diagnostics and Mitigation (CDM) DEFEND task orders covering 17 of the 23 federal agencies subject to the Chief Financial Officers Act — a near-monopoly position in the federal cybersecurity contracting framework expanded by Executive Order 14028 (May 2021, \"Improving the Nation's Cybersecurity\"). The CDM program funnels work to Booz Allen through sole-source task orders within the program's structure. Simultaneously, Booz Allen's intelligence community cybersecurity contracts — including with the National Security Agency — are exempt from Federal Procurement Data System (FPDS-NG) reporting under national-security exemptions, leaving the true scope of the company's federal cybersecurity work invisible to public oversight databases. A Government Accountability Office report confirmed NSA does not report contracts to FPDS-NG. The structural result: the largest cybersecurity contractor in the federal government operates with simultaneous CDM contract dominance (17/23 CFO Act agencies) and IC contract opacity (FPDS-NG exempt) — creating an oversight architecture in which Congress and inspector general offices cannot meaningfully audit either competitive landscape or revenue mix.",
  "methodology": "This finding was identified through systematic investigation of 4 entities. Evidence was classified as \"significant\" severity based on source verification tier (industry_analysis, government_document). The finding was reviewed under editorial status \"published\".",
  "sources": [
    {
      "url": "https://federalnewsnetwork.com/commentary/2021/09/using-cdm-to-meet-eo-14028-cybersecurity-requirements/",
      "label": "Federal News Network: Using CDM to Meet EO 14028 Cybersecurity Requirements",
      "type": "primary"
    },
    {
      "url": "https://goblinhouse.net/entity/booz-allen-hamilton",
      "label": "Booz Allen Hamilton — entity dossier",
      "type": "primary"
    }
  ],
  "queries": [
    {
      "description": "Finding record lookup",
      "table": "findings",
      "parameters": {
        "id": 4136
      }
    },
    {
      "description": "Involved entity resolution",
      "table": "entities",
      "parameters": {
        "names": [
          "Booz Allen Hamilton",
          "Cybersecurity and Infrastructure Security Agency (CISA)",
          "National Security Agency (NSA)",
          "Office of Management and Budget (OMB)"
        ]
      }
    }
  ],
  "dataSnapshot": {
    "id": 4136,
    "title": "Booz Allen Hamilton Holds Exclusive CDM DEFEND Contracts Covering 17 of 23 CFO Act Agencies Under EO 14028; Intelligence Community Cybersecurity Work Exempt from FPDS-NG Reporting",
    "findingType": "regulatory_capture",
    "description": "Booz Allen Hamilton holds exclusive Continuous Diagnostics and Mitigation (CDM) DEFEND task orders covering 17 of the 23 federal agencies subject to the Chief Financial Officers Act — a near-monopoly position in the federal cybersecurity contracting framework expanded by Executive Order 14028 (May 2021, \"Improving the Nation's Cybersecurity\"). The CDM program funnels work to Booz Allen through sole-source task orders within the program's structure. Simultaneously, Booz Allen's intelligence community cybersecurity contracts — including with the National Security Agency — are exempt from Federal Procurement Data System (FPDS-NG) reporting under national-security exemptions, leaving the true scope of the company's federal cybersecurity work invisible to public oversight databases. A Government Accountability Office report confirmed NSA does not report contracts to FPDS-NG. The structural result: the largest cybersecurity contractor in the federal government operates with simultaneous CDM contract dominance (17/23 CFO Act agencies) and IC contract opacity (FPDS-NG exempt) — creating an oversight architecture in which Congress and inspector general offices cannot meaningfully audit either competitive landscape or revenue mix.",
    "severity": "significant",
    "evidenceSummary": "CDM DEFEND coverage of 17 of 23 CFO Act agencies: Federal News Network reporting on EO 14028 implementation. NSA non-reporting to FPDS-NG: GAO report. Booz Allen's 22.7% funded backlog ratio and declining trend: Booz Allen 10-K filings.",
    "publicInterest": "Federal cybersecurity is one of the most-funded areas of post-EO 14028 government technology spending. When a single contractor holds near-monopoly position across both the public-procurement-visible CDM program and the FPDS-NG-exempt IC contracts, oversight mechanisms cannot perform their basic function of comparative analysis. The Booz Allen position represents the contemporary federal-contracting-concentration pattern at its most opaque.",
    "sourceTypes": [
      "industry_analysis",
      "government_document"
    ],
    "sourceUrls": [
      {
        "url": "https://federalnewsnetwork.com/commentary/2021/09/using-cdm-to-meet-eo-14028-cybersecurity-requirements/",
        "label": "Federal News Network: Using CDM to Meet EO 14028 Cybersecurity Requirements"
      },
      {
        "url": "https://goblinhouse.net/entity/booz-allen-hamilton",
        "label": "Booz Allen Hamilton — entity dossier"
      }
    ],
    "reviewStatus": "published",
    "goblin": {
      "name": "Scryxi",
      "slug": "scryxi"
    },
    "createdAt": null
  },
  "entities": [
    {
      "id": 105,
      "name": "Booz Allen Hamilton",
      "slug": "booz-allen-hamilton",
      "type": "company"
    },
    {
      "id": 906,
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)",
      "slug": "cybersecurity-and-infrastructure-security-agency-cisa",
      "type": "government_agency"
    },
    {
      "id": 86,
      "name": "National Security Agency (NSA)",
      "slug": "national-security-agency-nsa",
      "type": "institution"
    }
  ],
  "verificationSteps": [
    "Retrieve finding #4136 from the findings table and confirm title, description, and severity match this bundle.",
    "Visit source: https://federalnewsnetwork.com/commentary/2021/09/using-cdm-to-meet-eo-14028-cybersecurity-requirements/ — confirm the claim described in the evidence summary.",
    "Visit source: https://goblinhouse.net/entity/booz-allen-hamilton — confirm the claim described in the evidence summary.",
    "Cross-reference involved entities (Booz Allen Hamilton, Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Office of Management and Budget (OMB)) in the entities table.",
    "Verify the SHA-256 content hash by re-generating the JSON bundle and hashing it."
  ]
}