CISA and ONCD Push Cybersecurity for Federal Grants with New Playbook

CISA and the Office of the National Cyber Director released a Playbook for Strengthening Cybersecurity in Federal Grant Programs for Critical Infrastructure, offering recommended actions, model NOFO and T&C language, templates for cyber risk assessments and project security plans, and resource lists to embed cybersecurity throughout the grant lifecycle. Concurrently, CISA issued Binding Operational Directive 25-01 mandating federal civilian agencies identify cloud tenants, deploy SCuBA assessment tools, and implement secure configuration baselines (e.g., for Microsoft 365) by June 2025 to reduce risks from cloud misconfigurations and evolving threats, emphasizing minimal administrative burden while maximizing security.