# CISA Updates Cloud Security Assessment Tools

On October 27, 2026, CISA released ScubaGear v2.0 for Microsoft 365 and ScubaGoggles v1.1.0 for Google Workspace, updating cloud security baselines and assessment capabilities, including expanded controls, API-based visibility, and application-risk prioritization. Federal agencies can use the free tools to support implementation of Binding Operational Directive 25-01; state, local, tribal, territorial, and private-sector organizations may also use them to assess cloud configurations. The announcements identify no solicitation, award, or dedicated funding.

- Agencies and contractors supporting them can use the tools to identify configuration gaps and document remediation or accepted risk.
- Contractors may find demand for cloud configuration assessment, compliance support, and remediation services, but the releases themselves do not create a defined procurement opportunity.
- One signal describes ScubaGoggles as alpha; organizations should validate its findings before relying on them as definitive.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Cloud Services, Regulatory Compliance
**Published:** October 30, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)
- Federal Civilian Executive Branch (FCEB)
- Department of Homeland Security (DHS)

### Sources
- [CISA Offers Two Free Tools to Detect Security Misconfigurations in Microsoft 365 and Google Workspace](https://cybersecuritynews.com/cisa-free-tools-to-detect-misconfigurations) - CyberSecurityNews
- [CISA Publishes Significant Updates to ScubaGear and ScubaGoggles | CISA](https://www.cisa.gov/news-events/news/cisa-publishes-significant-updates-scubagear-and-scubagoggles) - CISA
- [CISA Updates ScubaGear and ScubaGoggles Tools](https://www.executivegov.com/articles/cisa-updates-scubagear-scubagoggles-cloud-security-tools) - ExecutiveGov