Agencies buy a cloud provider’s security culture whether or not the contract mentions it

The week

On April 2, 2024, the Department of Homeland Security published the Cyber Safety Review Board’s report, dated March 20, on the 2023 compromise of Microsoft Exchange Online by the China-linked actor Microsoft tracks as Storm-0558. The intruders used a stolen Microsoft consumer signing key to forge tokens and read email at organizations including US government agencies. The board found the intrusion preventable and said Microsoft’s security culture was inadequate and required an overhaul. It noted that a customer, the State Department, detected the intrusion first. Microsoft still had not determined how the key was stolen. A September 2023 explanation that pointed to a crash dump had not been corrected until March 12, 2024, although Microsoft had found no evidence for it. The board recommended default audit logging across cloud providers and updates to FedRAMP, including special reviews of authorized services after high-impact incidents.

An earlier article in this series examined Microsoft’s own September 2023 account of how signing keys can leak through ordinary engineering. The board’s report went further, and in a direction that matters more to buyers. Its central finding was about culture: how a provider decides between security and everything else. An agency’s FedRAMP package, contract and license terms describe controls. None of them describes culture, and yet every agency on a major cloud platform depends on it. Culture cannot be audited directly. It does leave evidence, and the report shows where to look. The evidence falls in three places: how a provider treats its most critical secrets over time, how it detects and discloses its own failures, and what it ships as the default. Each points to a question an agency can put in a solicitation or renewal.

Secrets: what happens to the crown jewels over years

The stolen key dated from 2016. According to the board, it should have been retired in 2021, but Microsoft had stopped routine rotation of consumer keys that year after an earlier cloud incident. A key that should have expired was still trusted. Flaws in token validation then let a consumer key sign tokens that enterprise email accepted.

No control assessment at a single point in time is designed to catch that kind of drift. Key management policies existed. The failure was that a known risk was deferred, year after year, while other work took priority. That is what a culture problem looks like from the outside: a gap between policy and practice that widens over time.

A buyer can ask for evidence of practice rather than policy. Useful questions include when signing keys for the services the agency uses were last rotated, whether rotation is automated, and who approves exceptions. Others ask how the provider would know if a key were used outside its intended scope. Agencies can also ask for any open findings on key management from the provider’s own audits. The answers matter less than whether the provider can give them quickly and specifically.

Who asks matters as well. These questions belong in the security review that supports the authorization decision, and the contracting officer should put them in writing so the answers become part of the record. Asked informally by a program office, they tend to get marketing answers. Asked as a condition of renewal, with the authorizing official’s name attached, they tend to get engineers.

Disclosure: who finds the failure, and what they say

The State Department found the intrusion, not Microsoft. Afterward, the provider’s public root-cause explanation stood for about six months after Microsoft knew it lacked evidence for it. The board treated both facts as part of the cultural failure.

For agencies, the second fact may matter more. Agency leaders brief inspectors general, oversight committees and their own boards from the provider’s account. If that account is wrong, the agency’s own record is wrong. Its risk decisions, such as whether to rotate credentials, which logs to search and whether to notify affected people, rest on facts it cannot independently check.

Contracts can address this directly. They can require incident notification within defined hours, root-cause reports to a defined standard, and a duty to correct earlier statements within a set period once facts change. They can also give the agency a right to a technical briefing with the provider’s investigators, not only its account team. FedRAMP’s incident reporting runs through its own channels. An agency-level clause ensures the agency hears directly, in time to act.

Defaults: what the provider ships to everyone

The State Department saw the intrusion because it had a premium license that included detailed mailbox audit logs. Agencies without it would have had a harder time. Microsoft announced broader logging for standard customers in July 2023, after the intrusion was disclosed and under pressure from federal customers. The board recommended a minimum standard for default audit logging across cloud providers.

Defaults are the most visible signal of how a provider weighs security against revenue and convenience. Logging sold as an upgrade, multifactor authentication that is optional at setup, and administrative features enabled by default all reveal those priorities. They are also negotiable. An agency’s security baseline can list the logs, retention periods and secure settings it requires, and price the offer on that basis rather than on the base tier.

There is a market dimension too. Federal agencies together are among the largest cloud buyers anywhere. When several large agencies ask for the same defaults at renewal, a provider has reason to make them standard for everyone. The 2023 logging change showed that public pressure from federal customers can move a default. Coordinating those asks through shared contract language is one of the few ways agencies can change a provider’s behavior without regulation.

The three kinds of evidence should be read together. A provider that answers key management questions specifically, corrects its statements promptly and ships strong defaults is showing the culture the board found missing. One that cannot do so has told the buyer something no authorization package will.

With hindsight

Microsoft responded quickly in public. In May 2024 it expanded its Secure Future Initiative, and its chief executive said security would be prioritized above other features. Its president testified before the House Homeland Security Committee in June 2024 and accepted responsibility for the failures the board described. Whether those commitments changed practice is something buyers have had to judge from evidence of the kind described here.

The board itself did not last. In January 2025, DHS terminated the memberships of its advisory committees, the CSRB’s among them, and the board’s review of the Salt Typhoon telecom intrusions ended with it. That left agencies without the one federal body set up to investigate such failures independently. The questions in their own contracts, about secrets, disclosure and defaults, carry more of the weight.