What happened
On 27 October 2026 CISA released major updates to its Secure Cloud Business Applications (SCuBA) assessment tools and secure configuration baselines: ScubaGear v2.0 (Microsoft 365) and ScubaGoggles v1.1.0 (Google Workspace). ScubaGoggles v1.1.0 introduces a new assured controls baseline, a GUI, Policy API integration, and 'enhanced Gemini-focused controls' that expand coverage to ensure Google Gemini — framed by CISA as generative Super Intelligence (SI) now being integrated into daily workflows — is safely configured in Google Workspace. ScubaGear v2.0 is the largest update since inception (direct REST API coverage, consolidated Security Suite baseline, new severity scoring).
Why it matters
The SCuBA baselines are authoritative CISA secure-configuration references used by federal agencies for Binding Operational Directive 25-01 compliance and widely adopted by SLTT, public, and private organizations. Explicitly extending them to generative AI (Gemini/SI) supplies a first-party, defensible baseline for securely configuring AI assistants in enterprise cloud — a control gap in most existing cloud security guidance. It gives defenders a concrete mapping for securing generative-AI workloads rather than relying on vendor defaults.
Action needed
Map existing Microsoft 365 / Google Workspace configurations against the updated SCuBA baselines; apply the new Gemini-focused controls to any Gemini-powered deployments. Federal agencies should reconcile with BOD 25-01.