CISA releases ScubaGear v2.0 and ScubaGoggles v1.1.0 to check security settings in Microsoft 365 and Google Workspace

The US Cybersecurity and Infrastructure Security Agency (CISA) announced on Tuesday, October 27 the release of new versions of its tools for auditing cloud security settings: ScubaGear v2.0 for Microsoft 365 and ScubaGoggles v1.1.0 for Google Workspace. The agency calls them a “major leap” for its Secure Cloud Business Applications (SCuBA) project.

SCuBA is the CISA project that publishes guidance for the secure configuration of cloud services, known as Secure Configuration Baselines. The two tools assess whether an organisation’s account, the “tenant” in Microsoft 365 or the organisation in Google Workspace, follows that guidance. CISA addresses federal agencies, state, local, tribal and territorial (SLTT) governments, and private businesses.

For US federal agencies the updates also have a practical purpose: they let them comply with Binding Operational Directive BOD 25-01 on implementing secure practices in cloud services. Other organisations, public or private, can use them to strengthen their defences. The releases are available in CISA’s GitHub repositories, where ScubaGear is described as automation for assessing an M365 tenant against the service’s baselines.

ScubaGear v2.0 is, according to CISA, the most comprehensive upgrade of the tool since its start. The architecture of the baselines was rebuilt and the tool now calls the REST interfaces of each supported M365 product directly, for faster and more accurate assessments. Fully automated coverage was added for Power BI. A new “Security Suite” baseline brings together the checks for Defender, Purview, Exchange Online and Teams in a single framework.

The GitHub release notes give more detail. ScubaGear now also checks a new Microsoft Entra ID policy for blocking high-risk AI agents, and adds a severity rating for risky applications, CSV output for them and the Invoke-SCuBADiff command, which compares two runs of the tool. The updated configuration interface makes it easier to move policies, includes a built-in policy view and simplifies navigation of the documentation.

ScubaGoggles v1.1.0 covers Google Workspace. CISA notes that the tool no longer relies on admin logs, which solves long-standing visibility problems such as the short retention of logs and hidden default settings. A graphical interface with built-in validation and export replaces editing YAML files in a text editor, significantly lowering the barrier to entry.

The release also brings an “assured controls” baseline for teams with limited resources, strengthened checks for Gemini, Google’s AI system, and integration of Google’s Policy API, which gives near-real-time insight into settings. The GitHub release notes add a run-comparison feature, a new policy, GWS.MEET.6.3v1, and an OSCAL catalogue of the baselines, while Gemini moved from alpha to beta. The same notes state that this release did not add, remove or change any of the settings required by BOD 25-01.

CISA attributes the changes to testing and collaboration with federal partners, SLTT authorities and the private sector, and calls on administrators and stakeholders to download the tools and apply the baselines. Questions go to the SCuBA team at scuba@cisa.dhs.gov.

For the wider context, see our coverage of the CISA 2030 strategy for proactive cyber defence and of CISA’s warning that AI token consumption is becoming an operational resilience issue.