OB JEC TIVE 2. 3 Provide cybersecurity capabilities and services that fill gaps and help measure progress Our nation benefits from a robust commercial market for cybersecurity capabilities and services, which CISA cannot and will not seek to supplant or duplicate. Instead, CISA will provide modern cybersecurity capabilities and services in three cases: (1) for federal civilian executive branch agencies, where our authorities and resources enable provision of centralized and shared services that offer necessary visibility, expedited risk reduction, and significant cost savings; (2) for target rich/resource poor organizations, where limited resources and sustained adversary interest provide a compelling justification for government assistance to the degree our authorities allow; and (3) to measure the state of American cybersecurity and associated trends, which is necessary to guide actionable and impactful information sharing, guidance, and direction. In the first case, this will include continuing to expand and modernize the Continuous Diagnostics and Mitigation program, which now provides extraordinary visibility across nearly every federal civilian executive branch agency and enables host-level persistent hunting and response, and our Cybersecurity Shared Services Office, which provides a broadening portfolio of commercial services from Protective DNS Resolution to Vulnerability Disclosure Platforms. In the second case, we will provide cybersecurity assessments and, in cases where our authorities allow us, shared services that meet identified capability gaps and are C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 16