DHS watchdog finds 86% of agencies missed CISA cloud security deadline

September 24, 2026 at 12:40 AM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

A DHS inspector general report found that 88 of 102 federal civilian agencies, or 86%, failed to meet the June 2025 deadline for CISA's cloud security directives. The watchdog concluded that CISA lacks authority to compel compliance, leaving agencies exposed to preventable cyberattacks. The report was published Wednesday.

Key Facts

88 of 102 federal civilian executive branch agencies, or 86%, failed to implement all mandatory SCuBA policies from BOD 25-01 by the June 2025 deadline.
As of February 2026, 78 of 102 agencies (76%) were still not in compliance with BOD 25-01.
The DHS inspector general concluded that CISA lacks the authority necessary to require full and timely implementation of Binding Operational Directives.
The SCuBA project was created in response to the 2022 SolarWinds attack to provide secure configuration baselines for cloud applications.
CISA did not respond to the inspector general's report, according to the watchdog.

Compliance Failure

The DHS inspector general examined the Secure Cloud Business Applications (SCuBA) project, which was created in response to the 2022 SolarWinds attack. A December 2024 directive, BOD 25-01, gave agencies a list of requirements to align with SCuBA, with a deadline of June 2025. The IG found that 88 of 102 agencies, or 86%, did not implement all the mandatory SCuBA policies from BOD 25-01. As of February 2026, compliance had not improved: 78 out of 102 agencies (76%) were still not in compliance. Examples of unimplemented baselines included blocking outdated authentication procedures, enforcing multifactor authentication, and protecting sensitive and personally identifiable information.

CISA Authority Limits

The inspector general concluded that CISA lacks the authority necessary to require full and timely implementation of Binding Operational Directives. The report states that without defined enforcement oversight of SCuBA policy compliance, the federal cloud security posture across the federal enterprise is weakened. When agencies do not adopt required configurations or meet implementation deadlines, their cloud environments remain exposed to preventable threats. CISA did not respond to the report, according to the inspector general, and did not immediately respond to a request for comment from CyberScoop.