DHS Watchdog Finds Over 75% of Federal Agencies Noncompliant with CISA Cloud Security Mandate

A newly released report from the Department of Homeland Security Office of Inspector General (DHS OIG) revealed that the vast majority of Federal Civilian Executive Branch (FCEB) agencies have failed to comply with mandatory cloud security baselines established by the Cybersecurity and Infrastructure Security Agency (CISA). Under Binding Operational Directive 25-01, 86% of civilian agencies (88 out of 102) missed the initial implementation deadline for CISA's Secure Cloud Business Applications (SCuBA) requirements. Follow-up assessments confirmed that 76% of agencies remained noncompliant, leaving critical cloud controls unapplied across production environments. The unfulfilled SCuBA mandates target foundational identity security and data governance controls, specifically the blocking of legacy authentication protocols, the universal enforcement of multifactor authentication (MFA), and safeguards for sensitive and personally identifiable information (PII). In cloud-hosted productivity suites and enterprise SaaS platforms, legacy authentication bypasses modern MFA checks entirely, making basic credential stuffing and password spraying attacks viable against public sector assets. The watchdog report underscores a critical structural vulnerability: while CISA issues directives to standardize federal cloud defense, the agency lacks formal enforcement authority to compel agency adoption or remediate noncompliance. This widespread implementation gap highlights the persistent friction between centralized compliance directives and decentralized cloud operations. While modern Zero Trust architectures rely on strict identity verification as the new perimeter, enterprise-scale remediation of legacy authentication often runs into legacy application dependencies and fragmented operational ownership. The SCuBA framework was designed to provide automated, configuration-as-code baselines across major enterprise cloud platforms, but without programmatic policy-as-code guardrails embedded into agency provisioning workflows, manual compliance efforts predictably falter. For cloud security leaders and DevOps practitioners, the takeaway is clear: mandate-driven security is ineffective without automated, programmatic enforcement. Organizations must move beyond periodic policy audits to automated configuration management, using Infrastructure as Code (IaC) and cloud security posture management (CSPM) tools to continuously audit and disable legacy authentication endpoints. Engineering teams should audit all SaaS and Identity Provider (IdP) configurations for remaining legacy authentication protocols, implement conditional access policies that enforce phishing-resistant MFA by default, and isolate unmigratable legacy dependencies behind secure application proxies.