Watchdog Finds 86% of Federal Agencies Missed CISA Cloud Security Deadline
Summary
A DHS inspector general report found 88 of 102 federal civilian agencies missed mandatory SCuBA policies, with 78 still noncompliant as of February. The IG warned that limited CISA enforcement leaves cloud environments exposed to preventable threats.
Key points
- The December 2024 directive set a June 2025 deadline for agencies to implement mandatory SCuBA cloud security policies.
- The DHS inspector general found 88 of 102 agencies had not implemented all required policies.
- As of February, 78 agencies—76% of those assessed—remained noncompliant.
- Unimplemented measures included blocking outdated authentication, enforcing multifactor authentication, and protecting sensitive and personally identifiable information.
- The IG warned that noncompliance increases exposure to preventable threats and weakens federal cloud security.
- The report said CISA lacks authority to require full and timely implementation of its binding operational directives.
Article Details
- Event Type
- DHS inspector general report on federal agencies’ failure to meet CISA cloud security directives
- Impact
- The IG found that 88 of 102 federal civilian executive branch agencies had not implemented all mandatory SCuBA policies, and 78 remained noncompliant with BOD 25-01 as of February. The report warned that gaps—including outdated authentication procedures, lack of multifactor authentication, and insufficient protection for sensitive and personally identifiable information—leave cloud environments more exposed to preventable threats and weaken the federal cloud security posture.