CISA Unveils Federal Cloud Security Assessment Tools 'ScubaGear 2.0' and 'ScubaGoggles 1.1'… Establishes Policy to Block Risky AI Agents

WASHINGTON, United States

The Cybersecurity and Infrastructure Security Agency (CISA) announced major updates to ScubaGear and ScubaGoggles, free tools that assess cloud workspace security configurations for federal agencies as well as public and private organizations. On October 27 (local time), CISA announced on its official blog the release of ScubaGear 2.0, an assessment tool for Microsoft 365 (M365), and ScubaGoggles 1.1.0, an assessment tool for Google Workspace (GWS), under the Secure Cloud Business Applications (SCuBA) project.

The blog post was published under the name of Chris Butera, Acting Senior Assistant Director for Cybersecurity at CISA. CISA described this update as "a major leap forward" for the SCuBA project.

"Capabilities for Federal Agencies to Comply with Binding Operational Directive 25-01"

According to CISA, updates to the assessment tools and secure configuration baselines (SCBs) for M365 and GWS provide federal agencies with the capability to comply with Binding Operational Directive (BOD) 25-01, while offering public and private organizations actionable measures to elevate their cloud security posture.

In its blog, CISA stated, "Whether defending a federal agency, managing IT for a state, local, tribal, or territorial (SLTT) government, or overseeing cloud strategy for a private enterprise, the challenge is the same: securing modern cloud environments against evolving threats." CISA announced that the updates are the direct result of rigorous testing, shared expertise, and continuous collaboration with federal partners, SLTT network defenders, and private-sector stakeholders.

On October 28, CISA also posted on its official X account: "Since the initial release of ScubaGear and ScubaGoggles, we have collaborated with government and industry partners to ensure our tools are able to meet evolving threats. See how these updates can help elevate your organization's cloud security posture."

ScubaGoggles 1.1.0: Eliminating Reliance on Admin Logs and Introducing a GUI

According to CISA, ScubaGoggles 1.1.0 provides GWS administrators and cybersecurity professionals with improved visibility into their GWS security posture. The new version eliminates reliance on admin log events, resolving long-standing visibility challenges such as short log retention periods and hidden default settings. It significantly lowers the barrier to entry by introducing a graphical user interface (GUI) with built-in validation and export capabilities, eliminating the need to create and manage YAML files with text editors.

The baselines have also become more precise and transparent. CISA newly included an "Assured controls" baseline to allow under-resourced teams to deploy a new set of high-confidence controls tailored to GWS environments. CISA stated that as organizations integrate generative Super Intelligence (SI) into daily workflows, security must keep pace, announcing expanded controls to help ensure Google Gemini is securely configured. Integration with Google's Policy API also provides near real-time visibility into security posture, enabling security leaders to make faster, data-driven decisions based on current configurations.

According to the ScubaGoggles 1.1.0 release notes posted on GitHub, this version includes no additions, deletions, or version changes to the mandatory BOD 25-01 configuration policies. The release notes listed the addition of a new Google Meet policy, GWS.MEET.6.3v1, along with assessment capabilities leveraging the Google Policy API, the generation of OSCAL catalog release artifacts for SCuBA baselines, and the transition of Gemini baselines from Alpha to Beta stage.

ScubaGear 2.0: "Most Comprehensive Update Since Inception"

CISA announced that ScubaGear 2.0 is the most comprehensive update to the tool since its inception. It completely restructured the baseline framework, giving enterprise and government stakeholders greater control over their M365 environments. According to CISA, ScubaGear now makes direct REST API calls across all supported M365 products for faster and more accurate assessments, and newly introduces fully automated assessments for Power BI.

CISA's Cyber account (@CISACyber) also posted on official X about the release of updated Microsoft 365 configuration baselines and ScubaGear v2.0.0, highlighting direct REST API calls, automated Power BI coverage, and a new Security Suite baseline as key changes.

The new "Security Suite" baseline consolidates controls from Defender, Purview, Exchange Online, and Teams into a single unified framework to maximize defense coverage. Application management policies have also been enhanced, and a new severity scoring feature was introduced to help security teams quickly identify and prioritize risky applications. The Configuration User Interface (Config UI) was improved to simplify policy migration and incorporates a built-in policy viewer to facilitate easy navigation of complex baseline documentation.

According to GitHub Release Notes: Blocking Risky AI Agents Made a Mandatory 'SHALL' Policy

According to the ScubaGear v2.0.0 release notes posted on GitHub, several policies affecting BOD 25-01 mandatory configurations were added. New policy MS.AAD.9.1v1 is a mandatory "SHALL" policy requiring the blocking of risky AI agents. The release notes specified that because AI agents can access tenant resources and act autonomously, blocking agents exhibiting risky behavior reduces the risk of unauthorized access and automated exploitation. This policy requires Microsoft Entra ID P2 licensing and Microsoft Agent 365 or Microsoft 365 E7, and does not apply to GCC High and Department of Defense (DoD) tenants.

According to the release notes, MS.AAD.3.5v2 requires disabling the weakest authentication methods: SMS, voice call, and email one-time password (OTP) authentication methods. SharePoint policies require restricting external sharing to approved external domains or approved security group users, setting the expiration date for "Anyone" links to 30 days or less, and configuring file and folder permissions for such links to view-only.

The new Security Suite policies require blocking emails with executable attachments (.exe, .cmd, .vbe, etc.), rescanning emails after delivery, quarantining and deleting malware emails, implementing data loss prevention (DLP) policies that minimally block credit card numbers and U.S. Individual Taxpayer Identification Numbers (ITIN) and Social Security Numbers (SSN), establishing minimum alert configurations, and enabling the unified audit log. The release notes noted that these policies replace existing Defender policies.

The release notes also included functional improvements. Features added include exporting risky application assessment results to a CSV file, the "Invoke-SCuBADiff" command to compare results between two assessments (ScubaResults.json), a privileged user table in reports, and tenant domain name display in product-specific reports. Exchange Online assessments were transitioned to REST calls, and Graph sessions were scoped to the process level to ensure no reusable tokens remain after disconnecting from a tenant.

BOD 25-01: Cloud Security Configurations Mandated for Federal Agencies

On December 17, 2024, CISA issued BOD 25-01, "Implementing Secure Practices for Cloud Services." According to CISA, a BOD is a compulsory direction issued under federal law (44 U.S.C. § 3552(b)(1)) that executive departments and agencies must follow to safeguard federal information and information systems.

According to the directive, it does not apply to statutory "national security systems" or certain systems operated by the Department of Defense and Intelligence Community; its scope covers "Federal Civilian Executive Branch (FCEB)" systems.

CISA noted the background of BOD 25-01, stating: "Malicious threat actors increasingly target cloud environments and have developed sophisticated techniques to gain initial access to them," and "In recent cybersecurity incidents, inadequate configuration of security controls in cloud environments has introduced substantial risk and led to actual compromises." The directive stated that to counter these threats, CISA initiated the SCuBA project, developing consistent and manageable cloud security configuration baselines and assessment tools.

The directive requires agencies to implement SCuBA security configuration baselines, deploy CISA-developed automated configuration assessment tools, integrate with CISA's continuous monitoring capabilities, and remediate settings that deviate from the baselines. Mandatory requirements apply only to policies designated as "shall" in baseline documents, while policies marked "should" are left to agency discretion. According to the directive, baselines not renewed within one year will automatically fall out of scope and be removed from the baseline list. The directive mandated that federal agencies inventory their applicable cloud tenants by February 21, 2025, deploy CISA assessment tools by April 25, 2025, and implement mandatory policies by June 20, 2025. The tenant inventory must be updated annually in the first quarter. Assessment results must be reported automatically through integration with CISA's continuous monitoring solutions, or reported directly each quarter using results from the latest version of the assessment tools in a CISA-approved machine-readable format.

According to CISA, the SCuBA project was launched in 2022 to address cybersecurity and visibility gaps revealed by software-as-a-service (SaaS) cyber intrusions and compromises. While its primary goal is protecting FCEB information in cloud environments, all organizations can leverage SCuBA to strengthen SaaS security. Both assessment tools compare an organization's current M365 and GWS tenant configurations against CISA baselines, presenting areas needing security improvements in visual reports. On its SCuBA webpage, CISA also finalized and published the "Hybrid Identity Solutions Guidance," addressing interoperability approaches and challenges between on-premises and cloud-based identity management. CISA provides these assessment tools free of charge on the SCuBA project webpage. CISA encouraged federal agency users, cloud security stakeholders, SLTT administrators, and the general public relying on secure digital infrastructure to download the updated assessment tools and implement the baselines. Inquiries as well as feedback to improve baseline implementation guidance or assessment tools are welcomed via email to the SCuBA team (scuba@cisa.dhs.gov).

Sources (KST)

• Cybersecurity and Infrastructure Security Agency (CISA) Blog, "CISA Publishes Significant Updates to ScubaGear and ScubaGoggles" (2026-10-27): https://www.cisa.gov/news-events/news/cisa-publishes-significant-updates-scubagear-and-scubagoggles
• Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive, "BOD 25-01: Implementing Secure Practices for Cloud Services" (2024-12-17): https://www.cisa.gov/news-events/directives/bod-25-01-implementing-secure-practices-cloud-services
• Cybersecurity and Infrastructure Security Agency (CISA), "Secure Cloud Business Applications (SCuBA) Project": https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project
• CISA GitHub Release Notes, "ScubaGear v2.0.0": https://github.com/cisagov/ScubaGear/releases/tag/v2.0.0
• CISA GitHub Release Notes, "ScubaGoggles v1.1.0": https://github.com/cisagov/ScubaGoggles/releases/tag/v1.1.0
• Cybersecurity and Infrastructure Security Agency (CISA) Official X Post (2026-10-28): https://x.com/CISAgov/status/2115414807931199727
• Cybersecurity and Infrastructure Security Agency (CISA) Cyber Official X Post: https://x.com/CISACyber/status/2115069767019077977