iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CISA delivers new directive to agencies on securing cloud environments through BOD 25-01, issued December 17, 2024. The binding directive applies to federal civilian executive-branch agencies, not every government or private organization. Its 2025 deadlines have passed, but tenant inventory, SCuBA assessments, baseline maintenance, continuous reporting, and new-tenant monitoring remain ongoing obligations.
BOD 25-01, formally titled “Implementing Secure Practices for Cloud Services”, is designed to reduce the exposure created by misconfigured cloud business applications and inconsistent security controls.
Key takeaways
- BOD 25-01 was issued by CISA on December 17, 2024, and is binding on Federal Civilian Executive Branch agencies.
- The directive required agencies to identify in-scope cloud tenants by February 21, 2025, deploy assessment tools by April 25, 2025, and implement mandatory SCuBA baselines by June 20, 2025.
- ScubaGear assesses Microsoft 365 tenants, while ScubaGoggles assesses Google Workspace tenants against applicable SCuBA configuration baselines.
- FedRAMP authorization for a cloud service does not automatically prove that an agency configured its individual tenant according to SCuBA requirements.
- After the original deadlines, agencies still need continuous reporting, configuration-drift monitoring, baseline updates, remediation evidence, and security review for new cloud tenants.
What is CISA’s BOD 25-01 cloud directive?
BOD 25-01 is a binding CISA operational directive that requires covered federal civilian agencies to secure and assess certain cloud business applications. CISA issued the directive on December 17, 2024, to address risks caused by weak cloud configurations, limited visibility, and inconsistent administrative controls.
BOD 25-01 is not a universal cloud-security law and does not impose identical requirements on every organization using cloud services. The directive establishes mandatory operational requirements for a defined federal audience and uses CISA’s Secure Cloud Business Applications, or SCuBA, resources to support implementation.
Popular on Amazon
The distinction matters: SCuBA is the broader CISA program containing baselines, assessment tools, architecture guidance, and related cloud-security resources. BOD 25-01 is the mandatory directive that requires covered agencies to use the applicable requirements and processes. CISA’s SCuBA project page describes the program’s purpose as securing cloud business applications through consistent, manageable configurations and assessment capabilities.
Which organizations does BOD 25-01 cover?
BOD 25-01 applies to Federal Civilian Executive Branch agencies. The directive generally does not apply directly to the Department of Defense or Intelligence Community agencies, which operate under different authorities and security frameworks.
| Organization | Directly bound by BOD 25-01? | How the directive may still matter |
|---|---|---|
| Federal Civilian Executive Branch agency | Yes | Must meet the directive’s applicable inventory, assessment, baseline, reporting, and monitoring requirements. |
| Department of Defense or Intelligence Community agency | Generally no | May use SCuBA resources voluntarily or under separate agency-specific requirements. |
| State, local, tribal, or territorial government | No | Can use SCuBA as a security benchmark, but BOD 25-01 is not directly binding. |
| Private company | Not ordinarily | May face indirect requirements through a federal contract, authorization package, security plan, or agency procurement rule. |
| Federal contractor or cloud provider | Not solely because of BOD 25-01 | May need to support an agency’s compliance obligations when contract terms, authorization conditions, or operating procedures incorporate the requirements. |
CISA’s announcement of BOD 25-01 identifies federal civilian agencies as the directive’s covered audience while encouraging other organizations to use the associated resources voluntarily.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What cloud services are in scope?
BOD 25-01 focuses primarily on cloud business applications, especially agency-managed software-as-a-service environments. The directive should not be read as treating every cloud workload, infrastructure service, container, or application identically.
Common examples include:
- Microsoft 365 services, including identity, email, collaboration, document-sharing, and administrative functions.
- Google Workspace services, including identity, Gmail, Drive, collaboration, and administrative functions.
- Other agency-managed cloud tenants identified as in scope under the directive and its implementation guidance.
- Cloud applications connected to agency identity systems, storing federal information, or providing business functions that require agency security oversight.
SCuBA’s published material contains product-specific baseline collections for Microsoft 365 and Google Workspace. The CISA SCuBA FAQ explains that the Microsoft 365 and Google Workspace baseline collections cover multiple business applications, including more than 200 Microsoft 365 controls.
That product focus does not mean other cloud services are automatically risk-free or outside an agency’s broader security obligations. Infrastructure-as-a-service workloads, cloud databases, containers, Kubernetes clusters, endpoints, identity systems, and third-party applications may require separate controls under FedRAMP, NIST, OMB, agency authorization, or other requirements.
What did BOD 25-01 require agencies to do?
BOD 25-01 converted cloud-configuration guidance into an operational process with four major activities: inventory tenants, deploy assessment tools, implement mandatory baselines, and report and monitor results.
1. Identify and report in-scope cloud tenants
Agencies had to identify all cloud tenants within the directive’s scope and report them through the government’s designated reporting process. Tenant inventory is the foundation of the directive because an agency cannot secure a cloud environment that it does not know exists.
Inventory work should look beyond the central IT department. Common sources of missed tenants and cloud services include:
- Department-level or bureau-level purchases.
- Cloud services acquired outside centralized procurement.
- Test or development tenants that contain production data.
- Duplicate tenants created for field offices or separate business units.
- Former contractor-managed environments that remain active.
- Dormant tenants with active administrator accounts.
- OAuth-connected applications that are not recorded in the formal cloud inventory.
- Identity-synchronized tenants that create unexpected privilege paths.
A useful inventory record should identify the tenant, platform, business owner, technical owner, data handled, identity connections, administrator population, logging destination, authorization status, and current assessment status. The directive’s inventory requirement is not satisfied merely by listing the agency’s primary enterprise tenant while ignoring acquisitions, subsidiaries within the agency structure, or unmanaged environments.
Also popular on Amazon
2. Deploy CISA assessment tools
Agencies had to deploy CISA’s automated SCuBA assessment tools for applicable tenants and begin continuous reporting. The tools are:
| Tool | Platform | Primary purpose | What the tool does not do |
|---|---|---|---|
| ScubaGear | Microsoft 365 | Assesses tenant settings against applicable SCuBA Microsoft 365 baselines and produces findings and reports. | It does not automatically create a complete security program or remove the need for administrator review. |
| ScubaGoggles | Google Workspace | Assesses Google Workspace settings against applicable SCuBA baselines and produces findings and reports. | It does not automatically remediate every finding or replace governance and authorization decisions. |
CISA describes ScubaGear and ScubaGoggles as automated configuration-assessment tools intended to reduce the manual effort involved in reviewing cloud settings. Agencies should download the tools and supporting material from CISA’s official SCuBA resources or the official repositories identified there.
The safe operating pattern is to run an assessment against an authorized tenant using an appropriately privileged and monitored account, export the results, preserve the raw output, assign every finding to an owner, and retain before-and-after evidence after remediation. Generic PowerShell, Microsoft Graph, Google Admin, or Terraform commands should not be treated as BOD 25-01 requirements because command syntax and permissions can change with tool releases, tenant licensing, and agency architecture.
3. Implement mandatory SCuBA baselines
Agencies had to configure in-scope cloud services to meet the mandatory SCuBA Secure Configuration Baselines by the applicable deadline. A baseline defines required or expected settings for a supported cloud business application; it is not a complete cloud-security program.
Baseline implementation commonly affects identity, privileged administration, multifactor authentication, external sharing, audit logging, access policies, data handling, and other tenant-level controls. The exact setting and technical availability can depend on the cloud edition, agency architecture, connected identity provider, and product capabilities.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsA failed check does not always mean that an agency can change a setting immediately. Legacy applications, external collaboration, accessibility requirements, specialized mail flow, law-enforcement workflows, shared tenants, or interoperability needs may create legitimate conflicts. The appropriate response is to document the conflict, assess the risk, apply compensating controls where possible, obtain the required authorization, and track the exception. Silently disabling a control or ignoring a finding leaves the agency without defensible evidence.
4. Report continuously and monitor for drift
The directive moves agencies away from a one-time compliance scan. Covered agencies must maintain recurring assessment and reporting processes, detect configuration drift, track remediation, and monitor newly created or newly acquired tenants.
Continuous reporting does not mean that an assessment result remains valid forever. Cloud providers change features, administrators change settings, identities change roles, applications gain new permissions, and tenants acquire new integrations. Agencies need a process that connects assessment results to change management, security operations, authorization, and incident response.
What were the BOD 25-01 deadlines?
The original BOD 25-01 deadlines were all in 2025. As of August 18, 2026, those dates are historical deadlines that explain when the initial implementation steps were due; they are not future dates for a newly issued directive.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Deadline | Required action | What the date means now |
|---|---|---|
| February 21, 2025 | Identify and report in-scope cloud tenants. | The initial inventory deadline has passed. Agencies should now validate that the inventory is complete and current. |
| April 25, 2025 | Deploy SCuBA assessment tools for applicable tenants and begin continuous reporting. | Agencies should be operating an assessment, reporting, and remediation process rather than treating deployment as a finished project. |
| June 20, 2025 | Implement mandatory SCuBA Secure Configuration Baseline policies. | Agencies should maintain baseline compliance, document exceptions, and address drift and newly published baseline changes. |
| After June 20, 2025 | Apply future mandatory baseline updates and monitor new cloud tenants before granting an Authorization to Operate. | New-tenant governance and baseline maintenance remain continuing responsibilities. |
Readers should consult the current CISA implementation guidance for applicable reporting instructions and updates. The research available for this article does not establish a single universal assessment interval, so agencies should not assume that “continuous reporting” means a particular weekly, monthly, or quarterly schedule unless current official guidance or an agency-specific requirement says so.
Also popular on Amazon
- NEVER WORRY about losing important files and photos again! With 25GB of secure online storage, you know your files are safe and sound.
- KEEP YOUR COMPUTER RUNNING FAST with our system optimizer. By removing unnecessary files, it works like a PC tune-up, so you can keep working smoothly.
- Our PASSWORD MANAGER by Last Pass creates, encrypts, and saves all your passwords, so you only have to remember one.
- As the #1 TRUSTED PROVIDER OF THREAT INTELLIGENCE, Webroot protection is quick and easy to download, install, and run, so you don’t have to wait around to be fully protected.
- STAY PROTECTED EVERYWHERE you go, at home, in a café, at the airport—everywhere—on ALL YOUR DEVICES with cloud-based protection against viruses and other online threats.
What do SCuBA, ScubaGear, and ScubaGoggles each mean?
SCuBA is CISA’s Secure Cloud Business Applications program. SCuBA includes secure-configuration baselines, assessment tools, cloud architecture guidance, identity and hybrid-cloud guidance, and visibility and logging material.
ScubaGear is the SCuBA assessment tool for Microsoft 365. ScubaGear evaluates observable tenant settings against applicable Microsoft 365 baselines and creates findings that administrators and security teams must interpret and remediate.
ScubaGoggles performs a comparable assessment function for Google Workspace. The two tools are product-specific; using ScubaGear does not assess a Google Workspace tenant, and using ScubaGoggles does not assess a Microsoft 365 tenant.
Neither tool is a fully managed remediation service. Assessment output still requires cloud administrators to determine whether a setting can be changed safely, security teams to prioritize the risk, application owners to test dependencies, and governance teams to approve exceptions or compensating controls.
How does BOD 25-01 relate to FedRAMP?
BOD 25-01 complements FedRAMP; it does not replace FedRAMP authorization or make FedRAMP authorization unnecessary. FedRAMP evaluates the security of a cloud service offering and its authorization boundary, while SCuBA focuses more specifically on how an agency configures and operates supported cloud business applications inside its tenant.
A FedRAMP-authorized service is therefore not automatically configured correctly for every agency. The agency remains responsible for tenant configuration, identity and access controls, privileged administration, logging, sharing policies, data governance, and operational monitoring. Agencies must continue to follow applicable NIST, OMB, CISA, agency authorization, and privacy requirements. The FedRAMP program remains a separate authorization framework for cloud services used by federal agencies.
The practical distinction is straightforward:
| Question | FedRAMP | SCuBA and BOD 25-01 |
|---|---|---|
| What is evaluated? | A cloud service offering and its authorization boundary. | Specific cloud business-application configurations and agency operating practices. |
| Who has the main configuration responsibility? | The provider must meet the requirements of its authorization, while the agency operates within its authorization boundary. | The agency must configure and operate its tenant according to applicable baseline requirements. |
| Does one automatically satisfy the other? | No. | No. A FedRAMP authorization does not automatically demonstrate SCuBA compliance. |
What does shared responsibility mean under BOD 25-01?
Under the shared-responsibility model, the cloud provider secures the underlying SaaS platform, the agency secures its tenant and its use of the service, and CISA supplies baselines, architectures, tools, and guidance.
Recommended Free Tools
CISA’s SCuBA Technical Reference Architecture emphasizes the division between the provider’s responsibility for the underlying platform and the agency’s responsibility for properly configuring its chosen cloud business-application environment.
| Party | Typical responsibility | Example |
|---|---|---|
| Agency | Tenant configuration, identity, privileged access, multifactor authentication, sharing, logging, data governance, drift detection, exceptions, and tenant-level incident response. | The agency must restrict external file sharing even when the provider securely operates the data centers. |
| Cloud provider | Underlying SaaS infrastructure, service availability, platform security, and the security capabilities exposed to customers. | The provider secures the service platform but cannot decide which agency administrators may access a tenant. |
| CISA | Baseline requirements, assessment tools, reference architectures, and shared implementation guidance. | CISA publishes SCuBA requirements and tools, while agency personnel implement and govern the resulting changes. |
For example, a provider may offer phishing-resistant multifactor authentication, but the agency must decide which users must use it and enforce the policy. A provider may retain audit data, but the agency must configure collection, retention, alerting, access, and response. A provider may secure its infrastructure, but an agency administrator can still expose sensitive files through an overly broad sharing setting.
How should an agency assess BOD 25-01 compliance now?
An agency assessing BOD 25-01 compliance in 2026 should treat the work as an operating process rather than a completed 2025 project.
Also popular on Amazon
- Validate the tenant inventory. Search procurement records, identity integrations, cloud billing, security logs, bureau inventories, contractor relationships, and OAuth connections for unrecorded tenants or applications.
- Assign ownership. Give every tenant a named business owner, technical owner, security contact, authorization status, and escalation path.
- Confirm the applicable platform baseline. Determine whether the tenant is Microsoft 365, Google Workspace, or another environment covered by current CISA guidance, and verify the applicable baseline release through official CISA resources.
- Run the current assessment tool. Use ScubaGear for Microsoft 365 or ScubaGoggles for Google Workspace through an authorized, monitored administrative process.
- Preserve evidence. Retain the raw assessment output, tool and baseline information, execution date, tenant identifier, scope, permissions used, and resulting report.
- Prioritize findings. Address high-risk identity, privileged-administrator, multifactor-authentication, external-sharing, and logging issues first, while considering exploitability, data sensitivity, mission impact, and dependencies.
- Remediate safely. Test changes where possible, record the implementation owner and date, and re-run the assessment after remediation.
- Document exceptions. For controls that cannot be implemented immediately, record the reason, affected systems, risk decision, compensating controls, approval, expiration or review date, and remediation plan.
- Establish recurring reporting. Connect assessment results to security governance, authorization, change management, and agency reporting processes. Do not invent a reporting cadence that is not specified by current official guidance or agency policy.
- Control new tenants. Require registration, ownership, identity and logging integration, baseline evaluation, authorization review, and approval before a new tenant enters production.
- Test response and recovery. Exercise scenarios involving account takeover, malicious sharing, data deletion, stolen tokens, administrator compromise, and loss of access to cloud audit data.
- Reassess after significant changes. Repeat assessment after major provider updates, identity changes, application integrations, tenant migrations, licensing changes, or changes to administrative roles.
CISA guidance and pilot consultation are described as CISA-funded, but an agency still supplies the personnel needed to inventory tenants, operate assessment tools, remediate findings, test changes, manage exceptions, and preserve evidence. “No-cost” CISA resources do not mean that implementation requires no labor, licensing, engineering, procurement, or change-management budget.
Free tools Windows power users keep installed
One-click scans. No signup required.
What can go wrong during implementation?
Incomplete tenant discovery
An agency may believe it has completed the inventory while missing a bureau tenant, an old contractor environment, a test tenant containing real data, or a cloud application authorized through an OAuth connection. Inventory should be reconciled across procurement, identity, finance, security operations, and business-unit records.
Configuration changes that break mission functions
A stricter sharing, authentication, mail-flow, or retention policy can disrupt external collaboration, legacy applications, accessibility workflows, or specialized operations. Agencies should test changes, communicate user impact, and use documented exceptions and compensating controls rather than silently weakening the baseline.
Assessment results treated as an absolute security rating
Automated tools can produce false positives, false negatives, findings requiring manual validation, stale results after tenant changes, or incomplete coverage when a product license does not expose a required setting. Assessment output is evidence for a risk-management process, not proof that an environment is breach-proof.
Tool deployment mistaken for remediation
Installing ScubaGear or ScubaGoggles does not change unsafe settings by itself. Agencies still need administrators and security teams to investigate findings, understand dependencies, implement fixes, validate results, and manage exceptions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
New tenants placed into production without review
“Secure later” deployment undermines the directive’s continuing purpose. A new tenant should be registered, assigned an owner, connected to identity and logging systems, assessed against the current baseline, approved through the agency’s authorization process, and monitored for drift after launch.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What does BOD 25-01 not solve?
BOD 25-01 and SCuBA address important cloud business-application configuration risks, but passing a SaaS assessment does not secure an agency’s entire technology environment.
- Cloud workloads: Infrastructure-as-code, virtual machines, databases, containers, Kubernetes, and serverless services require additional controls.
- Endpoints: Workstations and mobile devices still need endpoint detection, patching, hardening, and access controls.
- Network architecture: Segmentation, secure connectivity, traffic inspection, and other network controls remain separate concerns.
- Data protection: Data-loss prevention, classification, retention, backup, recovery, and encryption require broader governance.
- Incident response: Agencies need procedures for account takeover, token theft, malicious sharing, data deletion, and provider outages.
- Supply-chain risk: Vendors, integrations, contractors, software dependencies, and connected applications create risks not eliminated by tenant baseline checks.
BOD 25-01 should therefore be treated as one layer of an agency’s security and authorization program, not as a substitute for enterprise risk management.
Are private companies and contractors required to comply?
Private companies and contractors are not directly bound by BOD 25-01 merely because they use cloud services or do business with the federal government. Direct obligations can arise indirectly when a federal agency incorporates SCuBA controls into a contract, authorization package, security plan, statement of work, or operating procedure.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchContractors operating an agency tenant, managing identity services, providing cloud administration, or handling federal information may need to support the agency’s inventory, assessment, remediation, evidence, reporting, and incident-response processes. The exact obligation depends on the contract and the agency’s applicable requirements; BOD 25-01 alone should not be described as a blanket private-sector mandate.
Also popular on Amazon
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download] | Includes Scam Protection, Advanced VPN, Dark Web Monitoring, & PC Cloud Backup](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Organizations outside the directive’s direct scope can still use SCuBA voluntarily as a practical benchmark for Microsoft 365 and Google Workspace security. Organizations that need broader continuous SaaS monitoring or asset discovery may evaluate commercial complements, but paid platforms are not presented by CISA as necessary for BOD 25-01 compliance. CISA’s official small and medium-sized business resources describe SCuBA as a no-cost assessment and hardening resource, while organizations remain responsible for providing their own personnel and implementation effort.
What is the practical meaning of BOD 25-01 after the deadlines?
The practical meaning of BOD 25-01 in 2026 is that cloud security cannot end with a completed checklist. A covered agency needs evidence that it knows which tenants it operates, assesses the applicable configurations, remediates or governs findings, reports results, monitors drift, updates baselines, and stops unreviewed tenants from entering production.
The directive also clarifies ownership. CISA can provide the baseline and tools, and a cloud provider can secure the underlying platform, but the agency must decide how its tenant is configured and operated. The central compliance questions are therefore operational: Who owns the finding? What will break if the setting changes? What evidence proves remediation? Who approved the exception? How will the agency detect a regression?
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFrequently Asked Questions
Is BOD 25-01 a law that applies to every cloud user?
No. BOD 25-01 is a binding CISA operational directive for Federal Civilian Executive Branch agencies, generally excluding the Department of Defense and Intelligence Community agencies. State and local governments, private companies, contractors, and cloud providers are not directly bound solely because they use cloud services, although contracts or agency requirements can impose related obligations.
What is the difference between BOD 25-01 and SCuBA?
BOD 25-01 is the mandatory federal directive, while SCuBA is CISA’s Secure Cloud Business Applications program containing configuration baselines, assessment tools, architectures, and guidance used to implement the directive. ScubaGear and ScubaGoggles are SCuBA assessment tools for Microsoft 365 and Google Workspace, respectively.
Does FedRAMP authorization satisfy BOD 25-01?
No. FedRAMP evaluates a cloud service offering and its authorization boundary, while BOD 25-01 and SCuBA address how an agency configures and operates applicable cloud business-application tenants. A FedRAMP-authorized service can still have agency tenant settings that do not meet SCuBA requirements.
Do ScubaGear and ScubaGoggles automatically fix cloud-security findings?
No. ScubaGear and ScubaGoggles assess configurations and generate findings; they are not fully managed remediation platforms. Agency administrators, security teams, application owners, and governance personnel must investigate findings, implement changes, validate remediation, and document exceptions or compensating controls.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What should an agency do if a SCuBA baseline conflicts with a mission requirement?
The agency should document the conflict, assess the associated risk, test whether a safer configuration is possible, apply compensating controls, obtain the required authorization, and track the exception. The agency should not silently disable the control or treat an assessment failure as irrelevant.
The Bottom Line
BOD 25-01 made secure cloud-business-application configuration a continuing federal operational requirement rather than a one-time recommendation. The initial deadlines—February 21, April 25, and June 20, 2025—have passed, but covered agencies still need accurate tenant inventories, current SCuBA assessments, baseline maintenance, continuous reporting, documented exceptions, configuration-drift detection, and pre-authorization review for new tenants. FedRAMP and provider security remain important, but neither removes the agency’s responsibility for its own tenant.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
