- A DHS OIG audit found that CISA has no legal power to enforce directives
- The watchdog said 88 of 102 federal civilian agencies failed to adopt required SCuBA safeguards by June 2025
- Forty agencies missed the February 2025 deadline to submit complete cloud tenant inventories to CISA
The Cybersecurity and Infrastructure Security Agency does not have the authority to compel federal civilian agencies to meet required cloud security deadlines, according to a Department of Homeland Security Office of Inspector General audit published Monday.
Lauren Wind, acting deputy CTO of CISA, will join a panel at the Potomac Officers Club’s 2026 Homeland Security Summit on Nov. 10, to discuss key technology priorities facing DHS. Book your seat now!
What Limits CISA’s Role in Cloud Security?
CISA retains authority to draft cybersecurity policies, provide implementation guidance and evaluate agency adherence, but the agency lacks legal powers to enforce its directives, according to the audit. The enforcement gap specifically affects the Secure Cloud Business Applications project, dubbed SCuBA, which establishes baseline protection standards for cloud-stored data across federal networks.
The DHS inspector general found that 88 out of 102 federal civilian agencies failed to adopt required SCuBA safeguards prior to the June 20, 2025, deadline. Without explicit authority to compel agency compliance, federal cloud infrastructure remains vulnerable to preventable cyber threats, the report noted.
How Many Agencies Missed SCuBA Requirements?
Federal civilian entities regularly fell behind on earlier checkpoints outlined in Binding Operational Directive 25-01. A total of 40 out of 102 agencies failed to submit full inventories of their cloud tenants to CISA by the Feb. 21, 2025, cutoff. By April 25, 2025, 53 agencies had failed to implement required analytical tools across applicable cloud environments.
These unenforced standards encompass core defense protocols, including restrictions on legacy authentication mechanisms, mandatory multifactor login controls and administrative safeguards designed to protect sensitive personal records.
How Did CISA Assist Federal Agencies?
Ahead of the implementation deadlines, CISA led upwards of 80 outreach sessions for 1,000 participants and facilitated over 130,000 downloads of software assessment tools. CISA personnel provided hands-on setup support to 17 civilian organizations while launching direct communications with noncompliant enterprise leaders.
In addition to sending formal compliance records for each deadline to the Office of Management and Budget, CISA issued alerts to delinquent agencies. The inspector general refrained from providing formal corrective action recommendations, citing CISA’s lack of statutory enforcement mechanisms under current law.
What Is SCuBA?
CISA established the SCuBA project in 2022 to address cybersecurity and visibility gaps exposed by software-as-a-service intrusions. In April 2024, the project released guidance to help agencies as they migrate identity authentication from on-premises enterprise networks to the cloud. CISA continues to issue binding operational directives. In June, the agency released BOD 26-04, requiring federal civilian agencies to remediate security flaws on timelines determined by risk.
