Watchdog finds most agencies failed to meet CISA cloud security orders, heightening risk of attack

DHS watchdog finds 86 percent of civilian agencies missed CISA’s cloud security directive deadline.

The DHS inspector general reported that 88 of 102 federal civilian executive branch agencies, about 86 percent, missed the June 2025 deadline to implement all mandatory Secure Cloud Business Applications policies in CISA Binding Operational Directive 25-01. By February 2026, 78 of 102 agencies, or 76 percent, were still noncompliant. Unimplemented baselines included blocking outdated authentication, enforcing multifactor authentication, and protecting sensitive and personally identifiable information. The IG concluded CISA lacks authority to compel timely BOD implementation, weakening the federal cloud posture; SCuBA was developed after the 2022 SolarWinds attack, and CISA did not respond to the report.