cisagov/ScubaGear

Health v2 · maintenance only

Adoption not part of the score

2650 stars · 379 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

ScubaGear is a PowerShell-based assessment tool that checks whether a Microsoft 365 tenant's configuration conforms to CISA's Secure Configuration Baselines. It queries M365 APIs, evaluates settings with Open Policy Agent Rego policies, and generates HTML, JSON, and CSV reports.

Use cases

• assess my M365 tenant against CISA secure configuration baselines
• audit Exchange Online and Teams security settings
• check Entra ID identity and access configuration compliance
• generate compliance reports for Microsoft 365 security posture
• verify SharePoint and Power Platform security settings
• map M365 controls to NIST 800-53 and MITRE ATT&CK

When to choose

• you administer a Microsoft 365 tenant and want automated baseline compliance checks
• you need CISA SCuBA baseline assessments with visual HTML reports
• you want policy-as-code security evaluation using OPA and Rego
• you need controls mapped to NIST SP 800-53 or MITRE ATT&CK

When to avoid

• you need to assess Google Workspace tenants (use ScubaGoggles instead)
• you need continuous real-time monitoring rather than point-in-time assessment
• your environment is not Microsoft 365
• you need an agent-based or always-on security tool

Facets

cli-tool · maturity active

security monitoring cli security developer-tools cloud-computing windows cross-platform cli m365 cisa open-policy-agent rego security-baselines tenant-assessment powershell compliance scuba reporting automation

Member repositories

For agents

markdown · JSON · MCP: product_card(name="cisagov/ScubaGear")