CISA Issues Secure Practices for Cloud Services To Strengthen U.S Federal Agencies

In a decisive move to bolster cloud security, the Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive (BOD) 25-01: Implementing Secure Practices for Cloud Services.

This directive mandates federal civilian agencies to adopt stringent security measures for their cloud-based systems in response to the growing threat of cyberattacks targeting cloud environments.

 CISA recently released new best practice guidance to safeguard mobile communications amid rising concerns over cyber espionage activities linked to People’s Republic of China (PRC)-affiliated threat actors.

What is Binding Operational Directive 25-01?

Binding Operational Directives are legally enforceable instructions issued to federal executive branch agencies to protect federal information systems, as authorized under Title 44 of the U.S. Code.

These directives do not apply to national security systems or certain Defense Department and Intelligence Community systems, but are compulsory for all other federal agencies.

Under BOD 25-01, agencies must implement secure configuration baselines for approved Software-as-a-Service (SaaS) products, deploy CISA assessment tools, integrate with CISA’s monitoring systems, and address any security deviations promptly.

Background and Rationale

The directive comes as malicious actors increasingly exploit vulnerabilities in cloud environments through sophisticated tactics.

Recent security incidents have highlighted how improper cloud configurations can lead to devastating breaches, exposing federal systems to significant risks.

In response, CISA launched the Secure Cloud Business Applications (SCuBA) project, which provides secure configuration guidelines, assessment tools, and monitoring solutions.

The overarching goal is to standardize and strengthen cloud security practices across Federal Civilian Executive Branch (FCEB) agencies.

By requiring the adoption of SCuBA Secure Configuration Baselines, the directive aims to significantly reduce vulnerabilities and enhance resilience to cyber threats.

Maintaining these security baselines is crucial, as the cybersecurity landscape constantly evolves with new threats, vendor updates, and best practices.

Outdated configurations leave systems vulnerable to attacks that could be mitigated through timely updates. CISA’s directive ensures that agencies remain proactive, leveraging the latest security measures to stay ahead of adversaries.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free

Scope of the Directive

BOD 25-01 applies to all operational cloud systems classified as federal information systems, provided they fall under finalized SCuBA Secure Configuration Baselines published by CISA.

As of now, these baselines cover Microsoft Office 365, though CISA plans to expand coverage to other cloud products in the future. Products not updated within a year will be removed from the SCuBA scope.

Mandatory configurations within SCuBA Secure Baselines, noted as “shall” actions, are legally binding.

Recommended actions, termed “should,” remain at the discretion of agencies. A comprehensive list of these configurations is available on CISA’s Binding Operational Directive 25-01 Required Configurations website.

Key Requirements for Federal Agencies

CISA has laid out specific actions and timelines for federal agencies under BOD 25-01:

Requirement	Details
Cloud Inventory Reporting	Agencies must identify and report all cloud systems within the directive’s scope by February 21, 2025.
	Inventories must be updated annually in the first quarter.
Deployment of SCuBA Assessment Tools	Agencies must deploy CISA-provided assessment tools for cloud systems by April 25, 2025.
	Results must either integrate with CISA’s continuous monitoring systems or be manually submitted quarterly in a machine-readable format.
Implementation of Mandatory Policies	Agencies are required to implement all mandatory SCuBA policies by June 20, 2025.
	Future updates to mandatory policies must be adopted according to timelines on the CISA-managed Required Configurations website.
New Cloud Tenants	Agencies must apply all secure configuration baselines and enable continuous monitoring for new cloud tenants before granting an Authorization to Operate (ATO).
Deviation Management	Authorizing Officials (AOs) may accept risks for operational deviations, but these must be identified, explained, and reported to CISA using SCuBA assessment tools.

Collaborative Efforts for Enhanced Security

The directive builds on existing federal cloud security frameworks, such as the Federal Risk and Authorization Management Program (FedRAMP), guidance from the National Institute of Standards and Technology (NIST), and CISA’s Trusted Internet Connections (TIC) 3.0 Cloud Use Case.

By integrating these resources, BOD 25-01 ensures federal agencies can maintain robust, adaptive defenses against evolving cyber threats. Agencies are encouraged to coordinate with CISA for compliance and questions via CyberDirectives@cisa.dhs.gov.

The implementation of Operational Directive 25-01 marks a significant milestone in federal cybersecurity strategy, underscoring the significance of secure cloud configurations and ongoing monitoring.

With a clear roadmap and defined timelines, CISA is ensuring that federal agencies are better equipped to defend against increasingly sophisticated cyberattacks.

As the February 21, 2025 inventory deadline approaches, federal agencies must act swiftly to comply with the directive, safeguard critical systems, and protect the nation’s digital infrastructure from persistent threats.

2024 MITRE ATT&CK Evaluation Results Released for SMEs & MSPs -> Download Free Guide