Federal agencies fail to meet cloud security directive deadline

According to CyberScoop, nearly nine out of 10 federal civilian executive branch agencies failed to meet a recent deadline for implementing cloud security directives from the Cybersecurity and Infrastructure Security Agency (CISA). A watchdog report found that a significant majority of agencies are not in compliance with mandatory Secure Cloud Business Applications (SCuBA) policies.

The inspector general for the Department of Homeland Security reported that 86% of agencies did not implement all mandatory SCuBA policies by the June 2025 deadline. As of February, compliance had not improved, with 76% of agencies still non-compliant. These unaddressed policies include critical security measures such as blocking outdated authentication procedures, enforcing multifactor authentication, and protecting sensitive personally identifiable information. The report highlights that this lack of implementation leaves federal cloud environments exposed to preventable cyberattacks and undermines the national cloud security posture.

The inspector general concluded that CISA lacks the necessary authority to compel full and timely implementation of these Binding Operational Directives (BODs), which are crucial for mitigating vulnerabilities. The report also noted that CISA did not respond to the findings.

Source: CyberScoop