CISA Refreshes ScubaGear and ScubaGoggles Checks for Microsoft 365, Google Workspace

Key points

• CISA issued refreshed ScubaGear and ScubaGoggles assessment utilities.
• The update includes an updated benchmark and tighter Gemini safeguards.
• Cloud configuration checks can now be completed more quickly.
• K-12 IT teams should review tenant alignment and AI service controls.

CISA has issued refreshed versions of its cloud configuration assessment utilities. ScubaGear examines Microsoft 365 tenants, while ScubaGoggles performs comparable checks for Google Workspace. The update introduces an updated benchmark and tighter safeguards for Gemini. CISA's work on this tooling stretches across 2022 and 2023, and no CVE is tied to the changes.

For New Brunswick K-12 technology teams, the practical effect is quicker assessments of cloud productivity environments. Districts running either suite can use the utilities to compare tenant settings against a current baseline instead of manually sampling controls. That matters in school systems where small IT teams support many accounts, shared devices, and changing classroom workflows.

The refreshed baseline gives administrators a clearer reference for policy alignment. Stronger Gemini controls are especially relevant as generative AI features move into staff and student-adjacent services. Misconfigured sharing, weak logging, and unclear AI data handling can persist quietly; repeatable checks make drift easier to spot.

These tools are voluntary aids, not a substitute for local risk decisions. They complement vendor security portals and district policy. Teams should treat results as evidence for prioritization, not as a compliance stamp.

Watch for future baseline revisions and release notes. Test new versions before broad use, schedule recurring scans, and track exceptions with owners and expiration dates. The next step is to confirm which tenants and AI services are in scope.

What to do now

1. Inventory which Microsoft 365, Google Workspace, and Gemini services are active across district tenants, and assign an owner for each environment.
2. Download the latest ScubaGear and ScubaGoggles releases, then review release notes and baseline differences before running them.
3. Run initial assessments in a nonproduction or report-only mode to capture current configuration results without disrupting users.
4. Compare findings against district policy and the refreshed CISA baseline, prioritizing identity, logging, external sharing, and AI data controls.
5. Remediate high-impact misconfigurations first, and document any accepted exceptions with an owner and expiration date.
6. Schedule recurring scans and monitor CISA updates so future baseline changes are adopted promptly.
7. Brief leadership and staff on Gemini-related controls and safe use expectations for generative AI in school workflows.

Original source

Help Net Security