CISA ORDERS FEDERAL AGENCIES TO SECURE MICROSOFT CLOUD SYSTEMS AFTER RECENT INTRUSIONS

Summary from the TLDR InfoSec newsletter

In 2022, CISA published the Secure Cloud Business Applications (SCuBA) secure cloud baselines for Microsoft 365 with other cloud applications to come later. Citing a wave of recent attacks that were caused by improper configuration of cloud systems, CISA has issued a binding directive that federal agencies must abide by the SCuBA baselines. Federal civilian agencies will have until June 20, 2025, to implement the full binding directive with milestone deadlines along the way.