CISA Updates Free Microsoft 365 and Google Workspace Security Assessment Tools

On October 27, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) announced updates to two tools under its Secure Cloud Business Applications project, known as SCuBA: ScubaGear v2.0 for Microsoft 365 and ScubaGoggles v1.1.0 for Google Workspace. The tools compare cloud configurations with CISA security baselines and help organizations identify settings that may require review. CISA describes them as free resources available to government agencies and private businesses. The updates are releases of existing assessment tools—not the launch of a new procurement program or a funded service requirement.

SCuBA was established in 2022 to address security and visibility gaps associated with cloud services, and CISA introduced its assessment tools in 2023. The project primarily supports the Federal Civilian Executive Branch (FCEB), while its guidance is available more broadly. Its baselines are intended to help protect information created, accessed, shared, or stored in cloud applications, while allowing organizations to account for their business needs and risk levels. Agencies can use the updated tools in support of BOD 25-01 implementation; contractors supporting those agencies may use assessment results to identify configuration gaps and document remediation or accepted risk.

ScubaGear assesses a Microsoft 365 tenant across Microsoft Entra ID, Exchange Online, Teams, SharePoint, Power BI, and Power Platform. The source description says it uses PowerShell to query Microsoft 365 APIs for configuration data, then applies Open Policy Agent rules written in the Rego policy language. Results are available in HTML, JSON, and CSV formats. ScubaGear identifies findings rather than automatically changing tenant settings, so administrators remain responsible for evaluating results, making configuration changes, or recording accepted risk. The source also notes that users should review required permissions and dependencies before installation through PowerShell Gallery.

ScubaGoggles performs a corresponding assessment for Google Workspace, primarily using the Google Admin SDK API, as well as other Google APIs to collect settings, logs, organization information, and user privileges. Open Policy Agent compares the collected data with baseline requirements, and the tool produces HTML and JSON reports. One source flags an important maturity consideration: CISA’s repository labels ScubaGoggles as an alpha tool. Users should therefore validate its findings and account for that status when incorporating results into security documentation or operational decisions. For contractors, the releases may inform cloud-security assessment and remediation work on federal programs, but the announcement establishes neither a new compliance obligation nor a procurement vehicle or source of funding.

• Release date: CISA announced the updates on October 27, 2026; ScubaGear is at v2.0 and ScubaGoggles at v1.1.0.
• No new procurement: The releases announce free assessment tools, not a solicitation, contract award, funding opportunity, or new procurement requirement.
• Federal application: FCEB agencies can use the tools to support implementation of BOD 25-01 and review cloud settings against CISA baselines.
• Contractor relevance: Federal contractors can use assessment results to identify configuration gaps and document remediation actions or accepted risk when supporting agency cloud environments.
• Microsoft 365 coverage: ScubaGear checks Entra ID, Exchange Online, Teams, SharePoint, Power BI, and Power Platform.
• ScubaGear outputs and process: It evaluates tenant data with Open Policy Agent and Rego rules and generates HTML, JSON, and CSV reports; it does not automatically remediate settings.
• Google Workspace assessment: ScubaGoggles collects configuration and related data through Google APIs and produces HTML and JSON reports.
• Validation caveat: The source identifies ScubaGoggles as an alpha tool, so agencies and contractors should validate findings before relying on them for consequential decisions.
• Policy and tool questions: CISA identifies the SCuBA Team contact as scuba@cisa.dhs.gov.