DHS SCubA Projects

DHS CISA SCuBA (Secure Cloud Business Applications)

DHS CISA SCuBA (Secure Cloud Business Applications) is a security assessment framework and toolset developed by Cybersecurity and Infrastructure Security Agency to evaluate the security posture of cloud-based SaaS environments, primarily Microsoft 365 and similar platforms.

At a technical level, SCuBA provides:

• Baseline security configuration checks aligned to federal guidance (e.g., logging, identity controls, sharing settings)

• Automated assessment scripts/tools that interrogate tenant configurations

• Policy validation against known best practices and mandates (including Zero Trust principles)

• Reporting outputs that highlight misconfigurations, gaps, and risk areas

SCuBA is commonly used by federal agencies and contractors to:

• Validate compliance with CISA Secure Cloud guidance

• Identify SaaS misconfigurations that could enable data exfiltration or unauthorized access

• Standardize cloud security assessments across environments

In short, SCuBA operationalizes secure configuration auditing for SaaS platforms, turning high-level guidance into actionable, repeatable technical checks.

DHS CISA SCuBA Projects

The Cybersecurity and Infrastructure Security Agency Secure Cloud Business Applications (SCuBA) initiative consists of several complementary tools designed to assess and enforce secure configurations across cloud SaaS environments.

ScubaGear

ScubaGear is an automated assessment tool for Microsoft 365 environments. It evaluates a tenant’s configuration against SCuBA Secure Configuration Baselines, identifying misconfigurations and gaps relative to CISA-recommended security policies. GitHub - cisagov/ScubaGear: Automation to assess the state of your M365 tenant against CISA's baselines · GitHub

ScubaGoggles

ScubaGoggles performs the same function for Google Workspace environments, validating organizational configurations against SCuBA baselines to ensure alignment with established security standards. GitHub - cisagov/ScubaConnect: Native cloud infrastructure for automatically running ScubaGear/ScubaGoggles · GitHub

ScubaConnect

ScubaConnect provides centralized, cloud-native orchestration for running ScubaGear and ScubaGoggles at scale. It enables administrators to execute assessments across multiple tenants from a single control point, improving consistency, visibility, and operational efficiency. GitHub - cisagov/ScubaConnect: Native cloud infrastructure for automatically running ScubaGear/ScubaGoggles · GitHub

Summary

Together, these tools operationalize SCuBA guidance by delivering automated, repeatable assessments that help organizations standardize SaaS security configurations and continuously monitor compliance with CISA best practices.