CISA updates open-source tools for Microsoft 365 and Google Workspace security

CISA has released substantial updates to two open-source tools that help administrators check Microsoft 365 and Google Workspace settings against security baselines. ScubaGear v2.0 now makes direct REST API calls across supported Microsoft 365 products, while ScubaGoggles v1.1.0 adds a new baseline and enhanced controls for Gemini.

Watch Desk analysis

What happened

The tools are part of CISA’s Secure Cloud Business Applications project, which develops configuration guidance for cloud services used by federal civilian agencies. Administrators run a tool against their organisation’s cloud environment, or tenant, and receive a report of settings that fall short of a baseline.

ScubaGear compares Microsoft 365 settings with policies written in Rego and produces HTML, JSON and CSV reports. CISA says the new direct API calls make assessments faster and more accurate. The tool’s baselines cover services including Entra ID, Exchange Online, SharePoint Online, Teams and OneDrive for Business.

ScubaGoggles checks Google Workspace through Google’s Admin SDK and other APIs. Its update adds an assured-controls baseline aimed at teams with limited resources, as well as enhanced controls for Google’s Gemini assistant. Help Net Security reports that CISA calls ScubaGear v2.0 its most comprehensive update since the tool launched in 2022.

Why it matters

These are practical security checks, not another dashboard looking pleased with itself. They can help administrators identify cloud settings that do not meet a chosen baseline, then use the reports to investigate and address gaps. The new Microsoft API approach and Google Workspace baseline could make that work more direct or accessible for some teams.

The Gemini controls also put an AI service inside the scope of cloud configuration checks. That gives administrators a more specific place to examine how the assistant is configured, although the supplied report does not detail the individual controls or establish how much risk they reduce.

Our read

This is a useful update for cloud administrators: the tools produce actionable reports, and the release adds changes to both Microsoft 365 and Google Workspace checks. CISA says the assessments should be faster and more accurate; teams using them should still review the findings against their own requirements rather than treating a baseline as a substitute for security judgement.

What to watch

• Whether administrators report that ScubaGear’s direct API calls improve assessment speed in practice.
• What the new assured-controls baseline and Gemini controls check in detail.
• Whether CISA publishes further guidance or updates for the tools’ baselines. Activity teaser: CISA’s updated open-source tools check Microsoft 365 and Google Workspace settings against security baselines. ScubaGear now makes direct API calls across supported Microsoft 365 products, while ScubaGoggles adds an assured-controls baseline and enhanced Gemini controls. CISA says the Microsoft checks should be faster and more accurate. The details matter: what should a security baseline require of AI assistants as well as the cloud services around them?

Discussion spark: What should a security baseline require of AI assistants such as Gemini, and how much should administrators rely on automated checks to show they meet it?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.