CISA is telling agencies they need to follow the "SCuBA" cloud security configurations for widely used applications, including Microsoft 365 products.