Loading story…
A Department of Homeland Security inspector general found that 88 of 102 Federal Civilian Executive Branch agencies failed to fully implement CISA's mandatory Secure Cloud Business Applications (SCuBA) policies by the June 2025 deadline under Binding Operational Directive 25-01. As of February 2026, 78 agencies remained noncompliant, leaving required cloud-security baselines only partially deployed.
The missing measures include blocking legacy authentication methods, enforcing multifactor authentication, and safeguarding sensitive and personally identifiable information. The inspector general warned that the gaps leave federal cloud environments vulnerable to preventable attacks and concluded that CISA lacks sufficient authority to compel agencies to implement Binding Operational Directives completely and on time.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
As of February 2026, 78 of 102 agencies remained noncompliant with SCuBA requirements, including baselines for outdated authentication, multifactor authentication, and protection of sensitive and personally identifiable information.
By the deadline for mandatory SCuBA policies, 88 of 102 federal civilian executive branch agencies, or 86%, had not fully implemented the required controls.
CISA issued Binding Operational Directive 25-01 requiring federal civilian executive branch agencies to align with specified Secure Cloud Business Applications (SCuBA) requirements.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA issued **Binding Operational Directive `26-04`** requiring U.S. federal civilian agencies to prioritize vulnerability remediation by risk instead of treating all flaws as equally urgent. The directive tells agencies to rank vulnerabilities using four factors: whether the affected asset is public-facing, whether exploitation can be fully automated, whether compromise could enable full system takeover, and whether there is evidence of active exploitation, including inclusion in CISA’s **Known Exploited Vulnerabilities** catalog. Based on those criteria, agencies now face remediation deadlines ranging from **three days** for the highest-risk cases to **60 days** for lower-priority flaws, while some low-risk issues may be deferred until a planned major system upgrade. CISA said the overhaul is meant to help agencies “patch smarter, not harder” as AI shortens the time between disclosure and weaponization and defenders struggle with limited resources. Agencies must immediately update vulnerability management policies, revise remediation processes within 60 days, and fully implement the directive’s timelines within 180 days; vulnerabilities meeting all four criteria also require forensic triage to determine whether systems were already compromised before patching. CISA said an initial review at one large civilian agency found only about **1%** of vulnerability instances would require the three-day response, while more than **60%** could be deferred, and the agency urged private-sector organizations to adopt similar risk-based practices alongside hardening, segmentation, and phishing-resistant MFA.
Jul 13, 2026
CISA has issued updated implementation guidance for Emergency Directive 25-03, highlighting that federal agencies are not fully patching critical vulnerabilities in Cisco Adaptive Security Appliances (ASA) and Firepower devices. Despite previous directives, CISA identified that some agencies reported devices as patched when, in fact, they were still running vulnerable software versions. The vulnerabilities, CVE-2025-20333 and CVE-2025-20362, continue to be actively exploited by advanced threat actors, prompting CISA to urge immediate corrective action and recommend the use of tools like RayDetect to check for evidence of compromise. The ongoing exploitation campaign has targeted federal civilian agencies since September, with CISA warning that incomplete patching leaves organizations exposed to significant risk. Agencies are directed to verify software versions, apply the minimum required updates, and follow additional mitigation steps if updates were applied after September 26, 2025. CISA has not confirmed whether any agencies have been breached but emphasizes the need for strict compliance to prevent further compromise. All organizations using Cisco ASA and Firepower devices are strongly encouraged to review and implement the latest guidance to mitigate ongoing threats.
Jun 29, 2026
Bipartisan lawmakers and private-sector cybersecurity leaders warned that the U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) has been significantly weakened after roughly a year of personnel cuts and layoffs under the second Trump administration, with reporting indicating the agency has lost about **one-third of its workforce** and shuttered or reduced entire divisions. Sources described diminished ability to execute core missions such as coordinating with industry and protecting federal civilian networks, with some organizations reportedly seeking alternatives (industry alliances, outside consultants, or direct government-to-government partnerships) rather than relying on CISA support. Reporting also tied the degradation to a prolonged **leadership vacuum**—with the administration’s nominee **Sean Plankey** not confirmed and Acting Director **Madhu Gottumukkala** criticized by some sources as struggling to lead—alongside political and operational pressures that deprioritized the agency. Specific capability impacts cited include reduced **counter-ransomware** efforts, work to promote **secure software development**, and losses affecting **election security** functions; additional strain was attributed to reassignment of staff to other DHS priorities and to a partial federal government shutdown that further reduced available staffing levels, raising concerns about CISA’s readiness to respond to a major cyber crisis.
Jun 29, 2026