CISA RELEASES MAJOR SCUBAGEAR AND SCUBAGOGGLES UPDATES TO STRENGTHEN MICROSOFT 365 AND GOOGLE WORKSPACE CLOUD SECURITY

THREAT SUMMARY

Category: Cloud Security / Secure Configuration / SaaS Security / Federal Cybersecurity
Affected Platform(s): Microsoft 365, Google Workspace
CISA Tool(s): ScubaGear v2.0, ScubaGoggles v1.1.0
Primary Objective: Improve cloud security visibility, configuration assessment, policy compliance evaluation, and secure deployment practices across Microsoft 365 and Google Workspace environments
Primary Risks Addressed: Cloud misconfiguration, excessive permissions, weak application controls, limited configuration visibility, insecure collaboration settings, and gaps in generative AI security controls
Federal Relevance: Supports Federal Civilian Executive Branch agencies implementing secure cloud practices under BOD 25-01
Broader Relevance: Applicable to state, local, tribal and territorial governments, private enterprises, cloud administrators, and cybersecurity teams
CISA Action: Released major updates to ScubaGear and ScubaGoggles on October 27, 2026
Required Response: Organizations using Microsoft 365 or Google Workspace should evaluate the updated tools, compare existing configurations against the revised Secure Configuration Baselines, and address identified weaknesses according to organizational risk

---

CISA has released major updates to its ScubaGear and ScubaGoggles cloud-security assessment tools, significantly expanding the agency’s Secure Cloud Business Applications program for organizations using Microsoft 365 and Google Workspace.

Released October 27, 2026, ScubaGear v2.0 and ScubaGoggles v1.1.0 are designed to give federal agencies, state and local governments, tribal and territorial organizations, private enterprises, and cybersecurity teams greater visibility into cloud configuration and security posture.

The new versions build on tools CISA first released in 2022 and 2023 and represent a broader effort to standardize secure configuration across major cloud collaboration platforms. The updates include direct API-based assessments, new security baselines, expanded application-management controls, improved graphical interfaces, automated Power BI coverage, Google Policy API integration, and additional security controls focused on Google Gemini.

The importance of these changes extends beyond configuration convenience. Microsoft 365 and Google Workspace environments can contain email, identity information, files, shared documents, collaboration data, administrative privileges, application permissions, cloud storage, and access to connected services. Misconfigured settings or overly broad permissions within these environments can create opportunities for unauthorized access even when endpoints themselves remain secure.

CISA’s updated tools are intended to help organizations identify those weaknesses before they become part of an intrusion path.

---

Secure Cloud Business Applications

CISA developed the Secure Cloud Business Applications, or SCuBA, project to provide secure configuration baselines and assessment capabilities for widely used cloud business applications.

The project focuses on helping organizations determine whether their Microsoft 365 and Google Workspace configurations align with security practices developed through collaboration between CISA, government partners, state and local defenders, and private-sector stakeholders.

The updated tools are not vulnerability scanners in the traditional sense. They are configuration-assessment platforms designed to evaluate how cloud services are configured against defined security baselines.

Cloud compromise does not always begin with exploitation of a software vulnerability. Attackers can gain access through stolen credentials, excessive privileges, weak application permissions, insecure configurations, poorly controlled third-party applications, or insufficient identity protections.

A properly patched cloud environment can still present significant risk if configuration and access controls are weak.

---

ScubaGoggles v1.1.0 — Expanded Google Workspace Security Visibility

CISA describes ScubaGoggles v1.1.0 as an update designed to improve security visibility across Google Workspace environments while reducing several administrative barriers present in earlier versions.

One of the most important changes is that the updated tool no longer depends on administrator log events to assess configuration posture. This addresses limitations created by short log-retention periods and configuration settings that may not generate clear administrative events.

The update also introduces a graphical user interface that replaces the previous requirement to create and manage YAML configuration files manually. Built-in validation and export capabilities are intended to make the tool easier to deploy while reducing configuration mistakes during assessment.

Major ScubaGoggles v1.1.0 improvements include:

• Enhanced Google Workspace security-posture visibility.
• Removal of dependence on administrator log events.
• A graphical user interface for configuration and policy management.
• Built-in validation and export functionality.
• A new Assured Controls baseline designed for organizations with limited resources.
• Expanded security controls addressing Google Gemini.
• Integration with Google’s Policy API.
• Near-real-time visibility into applicable configuration posture.
• More precise baseline definitions for Google Workspace environments.

The Assured Controls baseline is intended to give resource-constrained teams a smaller set of high-confidence controls that can be deployed without requiring organizations to implement the entire configuration framework immediately.

That approach can be especially valuable for smaller governments and organizations that do not have dedicated cloud-security teams.

---

Gemini-Focused Security Controls

One of the most notable additions to ScubaGoggles is expanded coverage for Google Gemini.

As organizations integrate generative AI capabilities into workplace applications, the security boundary surrounding collaboration platforms is changing. AI features can interact with files, communications, documents, application data, and organizational information already stored within cloud environments.

CISA’s expanded Gemini-focused controls recognize that AI configuration should be treated as part of cloud security rather than as a separate technology problem.

Organizations adopting generative AI tools should understand what information those systems can access, which users can enable or administer AI capabilities, how permissions interact with existing data controls, and whether sensitive organizational content can become available through AI-assisted workflows.

The addition of Gemini controls to ScubaGoggles provides organizations with another mechanism for evaluating those risks within their existing Google Workspace security architecture.

---

Google Policy API Integration

ScubaGoggles v1.1.0 also integrates Google’s Policy API, giving administrators improved visibility into current configuration settings.

CISA says the change provides near-real-time security posture visibility, allowing security leaders to evaluate current settings rather than depending entirely on historical administrative events.

Policy-based assessment can help organizations detect drift from approved configurations, identify unauthorized or unintended changes, and confirm whether remediation actions actually produced the expected security result.

Organizations should still maintain independent logging and monitoring because configuration visibility does not replace incident detection. The two functions serve different purposes and should operate together.

---

ScubaGear v2.0 — Major Microsoft 365 Architecture Overhaul

CISA describes ScubaGear v2.0 as the most comprehensive update to ScubaGear since the tool was introduced.

The new version restructures the underlying baseline architecture and expands automation across Microsoft 365 environments.

ScubaGear now relies on direct REST API calls across every supported Microsoft 365 product, which CISA says provides faster and more accurate assessments.

Major ScubaGear v2.0 improvements include:

• Direct REST API calls across supported Microsoft 365 products.
• Faster and more accurate configuration assessments.
• Fully automated Power BI coverage.
• A consolidated Security Suite baseline.
• Unified controls covering Defender, Purview, Exchange Online, and Teams.
• Expanded application-management policies.
• New severity scoring for identifying risky applications.
• Improved policy migration through the Config UI.
• A built-in policy viewer.
• Simplified navigation of baseline documentation.

The expanded architecture gives administrators a more centralized method for assessing cloud security controls across services that are often managed separately.

That can reduce gaps created when different Microsoft 365 products are administered by different teams or reviewed through different security processes.

---

Security Suite Baseline

ScubaGear v2.0 introduces a consolidated Security Suite baseline designed to bring several Microsoft 365 security controls into a unified framework.

The baseline combines controls associated with:

• Microsoft Defender.
• Microsoft Purview.
• Exchange Online.
• Microsoft Teams.

Consolidating those areas can help security teams evaluate related controls together rather than treating each service as an isolated environment.

Microsoft 365 deployments often span identity, email, collaboration, data protection, threat detection, compliance, and application permissions. Weakness in one area can affect another, particularly when users or applications possess broad permissions across multiple services.

A consolidated baseline can therefore help organizations identify relationships between controls that might be missed during product-by-product review.

---

Application Management and Severity Scoring

CISA has also expanded application-management policies within ScubaGear and added a severity-scoring capability designed to help security teams identify risky applications.

Application permissions have become a major cloud-security concern because third-party and internally developed applications can receive broad access to organizational data.

Depending on granted permissions, an application may be able to read mailboxes, access files, modify directory information, interact with Teams, retrieve SharePoint data, or perform administrative functions.

The new severity scoring feature is intended to help defenders prioritize applications presenting greater risk rather than treating every connected application equally.

Organizations should use that visibility to evaluate whether applications actually require the permissions they have been granted and whether unused applications should retain access at all.

---

Configuration User Interface Improvements

ScubaGear v2.0 also introduces updates to its Configuration User Interface.

CISA says the updated interface improves policy migration, adds a built-in policy viewer, and makes complex baseline documentation easier to navigate.

These improvements address an important security challenge: configuration guidance is only effective when administrators can understand and implement it consistently.

Complex cloud environments can contain hundreds of settings, permissions, policies, and exceptions. Security baselines that are difficult to interpret can produce inconsistent deployment even when organizations intend to follow them.

Improved interface design can therefore have a direct security benefit by reducing configuration errors and helping teams maintain consistent policy implementation.

---

BOD 25-01 and Federal Cloud Security

The updated tools provide federal agencies with capabilities supporting compliance with Binding Operational Directive 25-01, which establishes secure practices for cloud services.

CISA’s SCuBA project provides federal agencies with standardized security baselines for evaluating cloud configurations rather than requiring each agency to independently determine appropriate settings across Microsoft 365 and Google Workspace.

The updated tools support federal implementation by providing repeatable assessment methods and clearer visibility into whether cloud environments align with established baselines.

Organizations outside the federal government are not bound by BOD 25-01, but the same tools can be used voluntarily to improve Microsoft 365 and Google Workspace security.

That makes the SCuBA framework relevant well beyond federal systems.

---

Operational Impact

The most important operational value of ScubaGear and ScubaGoggles is their ability to identify configuration weaknesses that traditional vulnerability management may not detect.

A vulnerability scanner may identify missing software patches, outdated packages, or known CVEs. It may not identify that an application has excessive Microsoft 365 permissions, that a Google Workspace policy is weaker than intended, or that an AI feature has been enabled without adequate controls.

Cloud-security assessment therefore requires visibility into configuration and identity as well as software vulnerabilities.

The updated SCuBA tools address several major operational areas:

• Configuration drift from approved baselines.
• Excessive application permissions.
• Weak or inconsistent cloud policies.
• Limited visibility into current settings.
• Misconfigured collaboration services.
• AI-related cloud controls.
• Application-management risks.
• Inconsistent security settings across multiple cloud products.
• Difficulty prioritizing risky applications.
• Gaps between intended and actual cloud configuration.

Organizations should treat findings from these tools as part of a broader cloud-security program rather than as a replacement for monitoring, threat detection, incident response, identity protection, or vulnerability management.

---

Defensive Guidance

Organizations using Microsoft 365 or Google Workspace should evaluate the updated SCuBA tools and determine how the revised baselines can be incorporated into existing cloud-security programs.

Priority actions should include:

• Download and evaluate ScubaGear v2.0 for Microsoft 365 environments.
• Deploy ScubaGoggles v1.1.0 for Google Workspace assessments.
• Compare current cloud configurations against CISA Secure Configuration Baselines.
• Review applications with elevated permissions.
• Prioritize high-risk applications identified through severity scoring.
• Review Gemini-related settings in Google Workspace.
• Evaluate Microsoft Defender, Purview, Exchange Online, Teams, and Power BI configurations.
• Identify configuration drift from approved organizational policy.
• Restrict permissions that exceed operational requirements.
• Review administrative access to cloud configuration tools.
• Repeat assessments after major configuration or application changes.
• Integrate SCuBA findings into vulnerability-management and incident-response workflows.

Organizations should preserve assessment results so that configuration changes can be compared over time. A security baseline is most useful when administrators can determine whether cloud posture is improving, remaining stable, or drifting away from approved policy.

---

Cloud Configuration Assessment

Organizations adopting the updated tools should review more than whether individual controls pass or fail.

Assessment should also consider:

• Why a particular configuration exists.
• Whether exceptions remain operationally necessary.
• Which administrators can change high-risk settings.
• Which applications possess broad permissions.
• Whether unused applications retain access.
• Whether AI features can access sensitive organizational information.
• Whether cloud policies are applied consistently across users.
• Whether configuration changes are logged and reviewed.
• Whether findings are remediated and subsequently validated.
• Whether third-party administrators or managed providers can alter critical settings.

Cloud security depends on maintaining configuration discipline over time. A secure baseline implemented once can lose value if policies change, applications accumulate privileges, administrators create undocumented exceptions, or new services are introduced without security review.

Regular reassessment is therefore necessary.

---

30-Day Outlook

The next 30 days should focus on adoption, assessment, baseline comparison, and remediation as organizations evaluate the updated ScubaGear and ScubaGoggles releases.

Key areas to watch include:

• Federal agency adoption of the revised tools.
• Increased use of ScubaGear v2.0 for BOD 25-01 implementation.
• Broader Google Workspace assessment through ScubaGoggles v1.1.0.
• Greater visibility into application permissions across Microsoft 365.
• Increased attention to Google Gemini security configuration.
• Expanded use of severity scoring to prioritize risky cloud applications.
• Identification of configuration drift across Microsoft 365 and Google Workspace.
• Additional feedback from state, local, tribal, territorial, and private-sector users.
• Continued refinement of SCuBA baselines as cloud services evolve.

Organizations should expect cloud-security baselines to require continuing updates because Microsoft 365, Google Workspace, AI capabilities, APIs, and application ecosystems continue to change.

A cloud configuration that meets security requirements today should not be assumed to remain appropriate indefinitely.

---

TRJ Verdict

CISA’s October 27 release of ScubaGear v2.0 and ScubaGoggles v1.1.0 represents a significant expansion of the agency’s effort to standardize cloud-security assessment across Microsoft 365 and Google Workspace.

The value of these tools comes from addressing a part of cybersecurity that can be overlooked when organizations focus primarily on malware and software vulnerabilities. Cloud environments can be compromised through excessive permissions, insecure application access, configuration drift, weak policies, compromised identities, or poorly controlled administrative settings without requiring exploitation of a traditional vulnerability.

ScubaGoggles v1.1.0 expands Google Workspace visibility through Policy API integration, a new graphical interface, an Assured Controls baseline, and additional Gemini-focused security controls. ScubaGear v2.0 restructures Microsoft 365 assessment through direct REST API calls, automated Power BI coverage, a consolidated Security Suite baseline, expanded application policies, severity scoring, and improvements to configuration management.

The inclusion of generative AI controls is particularly important because cloud productivity platforms are evolving beyond email, documents, and collaboration. AI systems are becoming another layer capable of interacting with organizational data, which means AI permissions and configuration must be incorporated into the same security framework governing identity, applications, files, communications, and administrative access.

CISA’s updated SCuBA tools give organizations a stronger method for measuring that security posture, but the tools cannot protect an environment by themselves. Their value depends on whether organizations act on the findings, remove unnecessary permissions, correct weak configurations, maintain accurate cloud inventories, and continue reassessing their environments as services and threats change.

Cloud security is no longer limited to protecting the infrastructure underneath an application. It now requires continuous control over the identities, applications, permissions, policies, APIs, collaboration platforms, and AI capabilities operating above it.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---