CISA Orders Secure Cloud Configurations for Federal Agencies

The U.S. federal cyber defense agency is requiring civilian agencies to adopt secure configuration baselines for key software-as-a-service products and integrate automated monitoring tools to address vulnerabilities exposed by recent adversary activity.

See Also: The CIS Security Operations Center (SOC)

The Cybersecurity and Infrastructure Security Agency issued a binding operational directive with standardized cloud security configurations to strengthen monitoring capabilities, while enhancing security settings and providing federal agencies with improved assessment tools to better protect cloud-hosted assets and mitigate potential risks. The directive’s configurations were developed through CISA’s Secure Cloud Business Applications project, which aimed to secure federal agencies’ cloud environments and protect sensitive information stored and processed in those systems.

Officials told reporters the new directive was not prompted by a specific threat or a recent attack. Matt Hartman, deputy executive assistant director for cybersecurity at CISA, said outdated security configurations “expose systems to exploits that can be easily mitigated by recommended and mandatory security configuration.”

“Security configuration best practices evolve over time as new threats are discovered and countermeasures are developed,” Hartman added. “This evolution necessitates periodic review and adjustments of security configuration baselines.”

While CISA officials emphasized the directive wasn’t triggered by a specific hacking incident, the Secure Cloud Business Applications project followed the SolarWinds attack, which targeted federal networks and highlighted security gaps surrounding security configurations for cloud-hosted assets. Russian hackers behind the 2020 cyberespionage campaign targeted a large swath of victims through password spraying and exploits of vulnerabilities found in cloud software, CISA said at the time (see: SolarWinds Hackers Cast a Wide Net).

Federal agencies are required under the directive to report their cloud systems to CISA by Feb. 21 and implement all configurations listed on its website, which currently only features configurations for Microsoft cloud offerings. CISA did not immediately respond to a request for comment.

The directive’s security policies will take effect on June 20, 2025, with agencies required to start sharing security monitoring results with CISA in late April.

“Malicious threat actors are increasingly targeting cloud environments and evolving their tactics to gain initial cloud access,” CISA Director Jen Easterly said in a statement, describing the actions included in the directive as an “important step in reducing risk to the federal civilian enterprise.”