The U.S. Cybersecurity and Infrastructure Security Agency (CISA) offers two free tools to help organizations find security misconfigurations in Microsoft 365 and Google Workspace. ScubaGear and ScubaGoggles compare cloud settings against recommended security baselines, giving administrators a clearer view of weaknesses that need attention. Both are available to government agencies and private businesses.
The tools belong to CISA’s Secure Cloud Business Applications project, known as SCuBA. Established in 2022, the project addresses security and visibility gaps exposed by attacks against cloud services. CISA introduced the assessment tools in 2023, making them existing resources rather than newly launched products.
Although SCuBA primarily supports Federal Civilian Executive Branch agencies, its guidance is available to any organization. The baselines aim to protect information created, accessed, shared, or stored in cloud applications while allowing organizations to consider their own business needs and risk levels.
ScubaGear Checks Microsoft 365 Security
ScubaGear checks a Microsoft 365 tenant, an organization’s cloud environment, against CISA’s secure configuration baselines. Its coverage includes Microsoft Entra ID, Exchange Online, Teams, SharePoint, Power BI, and Power Platform. These checks help administrators review identity, email, collaboration, and application security settings through one assessment process.
The tool uses PowerShell to query Microsoft 365 application programming interfaces for configuration data. It then passes those settings to Open Policy Agent, which evaluates them using rules written in the Rego policy language. Results are generated in HTML, JSON, and CSV formats for review and further analysis.
Administrators can install ScubaGear through PowerShell Gallery using Install-Module -Name ScubaGear. However, they must first review required permissions and dependencies. The assessment identifies gaps without automatically fixing tenant settings, leaving administrators responsible for reviewing findings, making changes, or documenting accepted risks.
The project also connects with CISA’s wider cloud security requirements. Cyber Security News previously covered CISA’s Microsoft 365 security directive, which requires federal civilian agencies to strengthen cloud configurations and use SCuBA assessments.
ScubaGoggles Evaluates Google Workspace Settings
ScubaGoggles provides a similar assessment for Google Workspace. It primarily uses the Google Admin SDK API, alongside other Google APIs, to collect relevant settings, logs, organization details, and user privileges. Open Policy Agent compares the collected data with baseline requirements, producing HTML and JSON reports.
An important limitation needs attention. CISA’s repository labels ScubaGoggles as an alpha tool under active development and warns that results could be incorrect. Administrators should carefully validate findings and complete any required manual checks rather than treating an automated report as a complete security review.
CISA also provides Hybrid Identity Solutions Guidance for organizations connecting local identity systems with cloud services. This complements the identity security concerns covered in CISA’s Active Directory security guidance, particularly where organizations need to understand and reduce weaknesses across connected environments.
For security teams, these tools provide a repeatable way to measure configuration gaps. Reviewing findings, recording justified exceptions, and running assessments after changes can help organizations track improvements without confusing baseline alignment with a guarantee against compromise.
AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?
