The secure configuration baselines that the U.S. agency CISA has defined for Microsoft 365 and Google Workspace can be checked automatically and for free with two open-source tools, ScubaGear and ScubaGoggles, a way to measure the security posture of cloud office software without hiring an audit. Both belong to the SCuBA project, which CISA started in 2022, and they target both public agencies and private companies.
CISA’s SCuBA tools for the cloud in 30 seconds
- CISA publishes security baselines for Microsoft 365 and Google Workspace as part of its SCuBA project.
- ScubaGear and ScubaGoggles automatically check whether a tenant meets them and generate reports.
- The controls are mapped to NIST SP 800-53 and MITRE ATT&CK, useful for regulatory compliance.
- ScubaConnect automates their periodic execution for anyone managing many tenants.
- They are free and open source, but only detect drift: they don’t fix anything.
Most companies no longer run their own mail, document and identity servers; they run on SaaS platforms such as Microsoft 365 and Google Workspace. That shifts much of the risk to configuration: a poorly defined conditional access policy or an overly broad SharePoint permission can matter more than a software vulnerability. The SCuBA project (Secure Cloud Business Applications) was created to give U.S. federal agencies a secure configuration reference, and CISA has published both the baselines and the tools to check them.
Configuration as code for cloud office software
The two tools follow the same model, close to the idea of policy as code. ScubaGear, for Microsoft 365, uses PowerShell to read the configuration through Microsoft’s APIs; ScubaGoggles, for Google Workspace, uses Python and Google’s Admin SDK API. In both cases, the Open Policy Agent engine compares what it reads against rules written in the Rego language, and the result is delivered in HTML and JSON, and in CSV as well for ScubaGear.
ScubaGear covers Microsoft Entra ID, Exchange Online, Teams, SharePoint, Power BI, Power Platform and advanced threat protection options. ScubaGoggles reviews the organization’s configuration, logs and user privileges in Google Workspace. Opensecurity explains how to install and use ScubaGear and ScubaGoggles step by step. The JSON results can be fed into monitoring dashboards or compliance processes, and SCuBA’s controls are mapped to the NIST SP 800-53 catalog and the MITRE ATT&CK framework, which makes them easier to use as audit evidence.
Automating reviews with ScubaConnect
For managed service providers or large organizations with several tenants, CISA publishes ScubaConnect, cloud-native infrastructure that automates running ScubaGear and ScubaGoggles. It allows moving from a one-off review to a periodic check that flags when a configuration change pushes an environment away from the baseline. ScubaGear also includes a graphical interface for generating the YAML configuration files used to document accepted exceptions and risks.
The tools have limits. They don’t fix the configuration, only assess it, and they need broad read permissions on the tenant, which should be granted carefully. ScubaGoggles’ documentation lists known issues, so its results are worth validating manually. The baselines also reflect CISA’s judgment for the U.S. public sector, so each organization has to decide which recommendations apply to its own context and regulations, such as Spain’s National Security Framework (Esquema Nacional de Seguridad) for Spanish public administrations.
Frequently asked questions
What is CISA’s SCuBA project?
Secure Cloud Business Applications, a CISA project started in 2022 that defines secure configuration baselines for Microsoft 365 and Google Workspace.
What tools does it include?
ScubaGear for Microsoft 365, ScubaGoggles for Google Workspace, and ScubaConnect, which automates running both.
How much do they cost?
Nothing. They are free, open-source tools published by CISA on GitHub.
Sources:
