The June 2025 deadline for implementing CISA's SCuBA cloud security baselines has passed, and 86% of federal agencies missed it. As a compliance officer at a defense contractor or public sector organization, you might wonder: "If federal agencies can't meet CISA directives, what does that mean for my program?"
The Department of Homeland Security inspector general report reveals that CISA lacks enforcement authority under the Federal Information Security Modernization Act. However, the technical requirements in CISA's Secure Cloud Business Applications project are not going away. They're increasingly referenced in contract language, audit criteria, and authorization frameworks you already work with.
This guide walks you through implementing SCuBA baselines in your environment, whether you're managing a FedRAMP authorization, preparing for CMMC assessments, or maintaining NIST SP 800-171 compliance.
What You Need Before Starting
Authority and Access:
- Administrative access to your Microsoft 365 tenant or equivalent cloud service
- Budget approval for any licensing changes required by security configurations
- Change control authority or an expedited path for security-critical configuration updates
Technical Prerequisites:
- Current inventory of your cloud services and administrative boundaries
- Documented Shared Responsibility Matrix showing which controls you own versus your cloud provider
- PowerShell 5.1 or later on your assessment workstation
- Network access to download CISA's SCuBA tools from GitHub
Organizational Readiness:
- Stakeholder buy-in from business units that will experience workflow changes (mandatory MFA, session timeouts, external sharing restrictions)
- Communication plan for users affected by stricter authentication requirements
- Documented exception process for configurations that conflict with mission requirements
The resource constraint is significant. Implementing SCuBA settings requires substantial effort to test configurations across your user base before enforcement.
Step-by-Step Implementation
Phase 1: Baseline Assessment (Week 1)
Download the SCuBA assessment tools from CISA's GitHub repository. These PowerShell modules extract your current cloud configurations and compare them against CISA's mandatory and recommended baselines.
For Microsoft 365, run the ScubaGear module:
Install-Module -Name ScubaGear
Invoke-SCuBA -ProductNames teams,exo,defender,aad,powerplatform,sharepoint
The tool generates an HTML report showing compliance gaps. Focus first on "Shall" statements in the baseline documents, which represent mandatory controls. "Should" statements are recommended but may be deprioritized if resources are constrained.
Review the output with your security architecture team. Flag any configurations that conflict with existing authorization decisions documented in your System Security Plan or FedRAMP authorization package.
Phase 2: Pilot Configuration (Weeks 2-3)
Create a pilot group of 20-50 users representing different roles: administrators, standard users, and external collaborators if applicable. Apply SCuBA configurations to this group's cloud tenant settings.
Critical configurations to test:
- Conditional Access policies requiring Authenticator Assurance Level 2 (AAL2) authentication per NIST SP 800-63B
- Session timeout settings (typically 12 hours for standard users, 1 hour for privileged access)
- External sharing restrictions on collaboration platforms
- Data Loss Prevention policies blocking CUI or export-controlled information from unauthorized destinations
Document user friction points. If your organization handles Controlled Unclassified Information under NIST SP 800-171, your authentication requirements already exceed most SCuBA baselines. But if you're operating in a FedRAMP Moderate environment, you may encounter conflicts between SCuBA's Microsoft-specific guidance and your 3PAO-approved control implementations.
Phase 3: Exception Documentation (Week 4)
For any SCuBA "Shall" requirement you can't implement, document a compensating control or risk acceptance. This is crucial: even though CISA can't enforce BODs on your contractor organization, assessors increasingly reference CISA guidance when evaluating practices during CMMC or FedRAMP assessments.
Your exception documentation should reference:
- The specific SCuBA policy identifier (e.g., "MS.AAD.7.3v1")
- Technical or mission reason for non-compliance
- Compensating controls mapped to NIST SP 800-53 Rev 5 or NIST SP 800-171 Rev 2 requirements
- Risk acceptance signed by your Authorizing Official or equivalent
If you're operating under a Common Control Provider arrangement, coordinate with your provider to determine which SCuBA configurations they own versus which you must implement in your tenant.
Phase 4: Production Rollout (Weeks 5-8)
Roll out configurations in phases by user group. Start with administrative accounts, then standard users, then external accounts if your authorization boundary includes them.
Monitor your Security Information and Event Management system for authentication failures, session terminations, and blocked file sharing attempts. A spike in these events during rollout is normal; sustained high rates indicate configuration problems or inadequate user training.
Update your continuous monitoring dashboard to track SCuBA compliance alongside your existing NIST SP 800-53 or NIST SP 800-171 metrics. If you're using Enterprise Mission Assurance Support Service for DoD authorizations, add SCuBA compliance status to your monthly reporting package.
Validation: How to Verify It Works
Run the ScubaGear assessment tool monthly. Your target: 100% compliance with "Shall" statements, documented exceptions for any gaps, and continuous improvement on "Should" statements.
Compare your SCuBA compliance report against your System Security Plan control implementations. For FedRAMP systems, map SCuBA policies to specific 800-53 controls (particularly AC, IA, and SC families). For CMMC Level 2 organizations, cross-reference against your System Security Plan's implementation of NIST SP 800-171 requirements.
Test authentication flows quarterly:
- Attempt login with non-compliant authentication methods
- Verify session timeouts trigger at configured intervals
- Test Data Loss Prevention rules by attempting to share controlled information externally
- Confirm administrative access requires elevated authentication
If you're preparing for a Third-Party Assessment Organization audit, include SCuBA compliance evidence in your assessment package. While not formally required for CMMC or FedRAMP, demonstrating alignment with CISA guidance strengthens your "defense in depth" narrative.
Maintenance: Ongoing Tasks
CISA updates SCuBA baselines as cloud providers release new features and threats evolve. Subscribe to CISA's cybersecurity alerts and review the SCuBA GitHub repository monthly for baseline updates.
Monthly:
- Run automated ScubaGear assessment
- Review new authentication failures or DLP blocks for legitimate business need
- Update exception documentation for any new non-compliances
Quarterly:
- Validate compensating controls for documented exceptions
- Review SCuBA baseline updates and assess impact on your configurations
- Test disaster recovery procedures for cloud tenant configuration backup
Annually:
- Reassess exceptions with business owners (can you eliminate any with budget or process changes?)
- Update System Security Plan to reflect SCuBA implementation
- Brief your Authorizing Official on compliance status and residual risks
The inspector general report notes that CISA held over 80 engagements with more than 1,000 participants on SCuBA implementation, and assessment tools have been downloaded over 130,000 times. You're not alone in this work. Engage with CISA's Federal Enterprise Improvement Team if you're a federal agency, or use your Third-Party Assessment Organization's experience with similar implementations if you're a contractor.
The lack of enforcement authority doesn't make SCuBA optional. It's a shared responsibility that, while not mandated, will be assessed by others.
