Dive Brief:

• The Cybersecurity and Infrastructure Security Agency ordered federal civilian agencies to meet configuration baselines in their Microsoft 365 environments, the agency said Tuesday in a binding operational directive.
• “In a number of recent cybersecurity incidents, the improper configuration of security controls in cloud environments introduced substantial risk and has resulted in actual compromises,” Matt Hartman, deputy executive assistant director for cybersecurity at CISA, said in a Tuesday media briefing.
• The mandate requires federal civilian agencies to identify all Microsoft 365 cloud tenants by Feb. 21, 2025, and implement CISA’s Secure Cloud Business Applications (SCuBA) secure configuration baselines by June 20, 2025. 

Dive Insight:

CISA said the mandate to secure cloud environments is a response to recent cybersecurity incidents, but not one specific threat. Officials declined to provide details about recent malicious activity that prompted the agency’s binding operational directive.

The directive continues CISA’s work to create a consistent approach to securing federal cloud environments, an effort that began after the 2019 supply chain attack spree targeting SolarWinds.

“Outdated security configurations expose systems to exploits that can be easily mitigated by recommended and mandatory security configurations,” Hartman said.

The order requires federal civilian agencies to provide CISA with the tenant name and system owning agency for all Microsoft 365 cloud tenants and update that inventory in annual reports to the agency.

“While this directive only applies to federal civilian agencies, the threat to cloud environments extends to every sector. We urge all organizations to adopt this guidance,” CISA Director Jen Easterly said in a statement. “When it comes to reducing cyber risk and ensuring resilience, we all have a role to play.”

CISA’s current list of required configurations includes baselines for multiple Microsoft 365 services, including Azure Active Directory and Entra ID, Microsoft Defender, Exchange Online, Microsoft Teams, Power Platform, SharePoint Online and OneDrive.

The directive only applies to Microsoft 365 environments, but CISA said it may release SCuBA secure configuration baselines for other cloud services.

”Microsoft has been an active supporter and participant in helping CISA develop SCuBA to create a consistent baseline across civilian agencies,” a Microsoft spokesperson said in a Wednesday email. “We support CISA’s expeditious efforts and close partnership in the co-development of actionable and scalable security guidance via the directive issued yesterday.”