CISA delivers new directive to agencies on securing cloud environments

CISA issued Binding Operational Directive (BOD) 25-01 requiring federal civilian agencies to identify and inventory all cloud instances, deploy Secure Cloud Business Applications (SCuBA) assessment tools, and align cloud environments with SCuBA configuration baselines. Deadlines include Microsoft 365 instance inventories by Feb 21, 2025; SCuBA assessment tool deployment by Apr 25, 2025; and implementation of required SCuBA policies by Jun 20, 2025. The directive is presented as a proactive, agency-wide effort to reduce cloud-related risk and will be supported and monitored by CISA.