The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is offering two no-cost tools designed to help organizations identify security misconfigurations in Microsoft 365 and Google Workspace environments. Named ScubaGear and ScubaGoggles, these tools match cloud service settings against CISA’s recommendation baselines, delivering insight into security weaknesses in both government and industry cloud deployments.
The tools are part of CISA’s Secure Cloud Business Applications (SCuBA) initiative, launched in 2022 in response to visibility gaps and vulnerabilities within cloud systems. Although SCuBA’s primary mandate covers Federal Civilian Executive Branch agencies, its assessment guidance is broadly available. The framework aligns with established policy and attempts to protect data and communications within cloud tools, while still giving organizations flexibility around risk management, custom configurations, and business needs.
ScubaGear: Checking Microsoft 365
ScubaGear performs a full configuration audit of Microsoft 365, evaluating services such as Microsoft Entra ID, Exchange Online, Microsoft Teams, SharePoint, Power BI, and Power Platform. It assesses identity management, collaboration, and application security through a single scanning process.
The tool operates via PowerShell scripts that pull configuration data from Microsoft 365 APIs. Then, it employs the Open Policy Agent (OPA) framework and Rego-style policies to check for compliance with required security rules. After scanning, reports come in HTML, JSON, and CSV formats so administrators can review results, plan remediation, or document acceptable risks. Important: ScubaGear reports issues—it doesn’t make automated configuration changes. Setup involves installing from the PowerShell Gallery and granting needed permissions for it to access tenant settings.
ScubaGoggles: Evaluating Google Workspace
ScubaGoggles operates similarly for Google Workspace. It uses Google Admin SDK APIs alongside other Google APIs to pull relevant settings, logs, user privileges, and organization metadata. Then, policy rules (via Open Policy Agent) check alignment with CISA’s baselines. Output is delivered as HTML and JSON reports.
Because ScubaGoggles is still in an alpha phase and under active development, its findings may not always be accurate. CISA warns administrators not to treat its output as a full audit—manual inspection and validation remain required to confirm critical gaps or misconfigurations.
Use beyond Federal Agencies & Best Practices
Though SCuBA’s regulatory force focuses on federal civilian agencies, private-sector firms and non-federal orgs can use the baseline guidance and toolset to improve their cloud posture. The assessment tools align with broader CISA mandates that require cloud configuration hardening and visibility.
When using these tools, security teams are advised to establish repeatable review processes: run scans regularly, document exemptions and risks, and use assessments after any infrastructure changes. These tools help highlight where configurations drift from best practices but are not a substitute for continuous monitoring or threat detection.
In larger context, misconfigurations continue to be among the top root causes of cloud-based breaches. Tools like ScubaGear and ScubaGoggles are part of a growing industry trend: offering free, open-source or government-backed baseline assessors to improve security hygiene across all sectors.
For organizations looking to adopt these tools, compatibility and deployment matter. ScubaGear requires specific permissions via PowerShell and integration with Microsoft cloud services. ScubaGoggles, still in alpha, may not cover all typical deployment types or edge cases yet, so results should be accepted with caution.
What this signals moving forward is significant. With tools like these, CISA is pushing not just for regulation but for pragmatic security practices—empowering organizations to discover risks they might not see and take ownership. As cloud reliance deepens and attack vectors grow, having free, accessible assessments could alter how defenders improve security posture—turning hidden misconfigurations from silent liabilities into manageable tasks.
