CISA Publishes Significant Updates to ScubaGear and ScubaGoggles

Whether you are defending a federal agency, managing IT for a state, local, tribal or territorial (SLTT) government, or overseeing cloud strategy for a private enterprise, the challenge is the same: securing modern cloud environments against evolving threats. To meet this shared challenge, the Cybersecurity and Infrastructure Security Agency (CISA) announces the release of updated ScubaGear v2.0 and ScubaGoggles v1.1.0, a major leap forward for the Secure Cloud Business Applications ( SCuBA ) project.

Since initial release of ScubaGear in 2022 and ScubaGoggles in 2023 , CISA has diligently collaborated and worked with government and industry partners to update these tools so they remain current and beneficial. The updates to the assessment tools and secure configuration baselines (SCBs) for Microsoft 365 (M365) and Google Workspace (GWS) provide:

Federal agencies with capabilities to comply with Binding Operational Directive (BOD) 25-01, and

Public or private organizations with actions to elevate their cloud security posture.

What’s New in ScubaGoggles (GWS) v1.1.0

GWS administrators and cybersecurity professionals have enhanced GWS security posture visibility.

No reliance on administrator log events, which addresses long-standing visibility issues like short log-retention windows and hidden default settings.

A clean, intuitive graphical user interface (GUI) replaces the need to use a text editor for creating and managing YAML files. The GUI, complete with built-in validation and export functionality, significantly lowers barriers to entry.

More precise and transparent baseline that more specifically includes: Assured controls baseline: Resource-strapped teams can deploy a new, high-confidence set of controls tailored specifically for GWS environments, saving time and reducing friction. Enhanced Gemini-focused controls: As organizations integrate generative Super Intelligence (SI) into their daily workflows, security must follow. ScubaGoogles expands coverage to help ensure Google Gemini is safely configured. Policy API integration: Leveraging Google’s Policy API provides enhanced near-real time security posture visibility, enabling security leaders to make faster, data-driven decisions based on current configurations.

Assured controls baseline: Resource-strapped teams can deploy a new, high-confidence set of controls tailored specifically for GWS environments, saving time and reducing friction.

Enhanced Gemini-focused controls: As organizations integrate generative Super Intelligence (SI) into their daily workflows, security must follow. ScubaGoogles expands coverage to help ensure Google Gemini is safely configured.

Policy API integration: Leveraging Google’s Policy API provides enhanced near-real time security posture visibility, enabling security leaders to make faster, data-driven decisions based on current configurations.

What’s New in ScubaGear (M365) v2.0

Most comprehensive update to ScubaGear since its inception.

Completely restructured baseline architecture designed to give enterprise and government stakeholders more control over their M365 environments to include: Structural evolution: ScubaGear now relies on direct REST API calls across every supported M365 product, providing faster and more accurate assessments. It also introduces fully automated coverage for Power BI. Security Suite baseline: Reduced clutter. The new Security Suite baseline consolidates controls for Defender, Purview, Exchange Online and Teams into a single, unified framework to maximize defensive coverage. Increased support: This release delivers enhanced application management policies and a new severity scoring feature, allowing security teams to quickly identify and prioritize risky applications. Configuration User Interface (Config UI) improvements: The upgraded Config UI streamlines policy migration, adds a built-in policy viewer, and simplifies navigating complex baseline documentation.

Structural evolution: ScubaGear now relies on direct REST API calls across every supported M365 product, providing faster and more accurate assessments. It also introduces fully automated coverage for Power BI.

Security Suite baseline: Reduced clutter. The new Security Suite baseline consolidates controls for Defender, Purview, Exchange Online and Teams into a single, unified framework to maximize defensive coverage.

Increased support: This release delivers enhanced application management policies and a new severity scoring feature, allowing security teams to quickly identify and prioritize risky applications.

Configuration User Interface (Config UI) improvements: The upgraded Config UI streamlines policy migration, adds a built-in policy viewer, and simplifies navigating complex baseline documentation.

Collaboration and Impact

These powerful updates are the direct result of rigorous testing, shared expertise, and continuous collaboration with our federal partners, SLTT network defenders, and private sector stakeholders. Your insights are instrumental in making these tools highly effective and easy to adopt.

For a more resilient and secure cyber landscape, CISA encourages agency users, cloud security stakeholders, SLTT administrators, and members of the public relying on secure digital infrastructure, to download the updated assessment tools and implement these baselines.

For more information and to access the updated policies and assessment tools, visit the SCuBA webpage on CISA.gov page, or the SCuBA Team at [email protected]