Federal-grade baselines
Built by CISA from real incident data and attacker tradecraft — the same guidance given to U.S. federal agencies.
Benchmark · US Government
CISA SCuBA.
Automated. One report.
The Secure Cloud Business Applications (SCuBA) project from the Cybersecurity and Infrastructure Security Agency provides security configuration baselines for federal and commercial cloud services.
About the baseline
What is CISA SCuBA?
SCuBA is a CISA initiative that publishes security configuration baselines for cloud business applications, starting with Microsoft 365. The baselines were developed to help federal agencies — and any organization that wants to follow federal guidance — securely configure cloud services against known threats. SCuBA covers Entra ID, Exchange Online, Microsoft Teams, SharePoint Online, and Power Platform, and is released publicly as U.S. Government work.
- Maintainer
- Cybersecurity and Infrastructure Security Agency (CISA)
- Coverage
- 70+ recommended settings
- License
- Public domain (U.S. Government work)
- Source
- cisa.gov ↗
Capabilities
What CISA SCuBA covers
The baseline's scope — we run these checks against your tenant and report the results.
Public domain
Released as U.S. Government work, so the baseline is free to use, redistribute, and build tooling on top of.
Identity-first focus
SCuBA leads with identity hardening — MFA, legacy auth blocking, privileged roles, and Conditional Access — because identity is the primary attack surface.
Maps to federal mandates
Directly supports BOD 25-01 (cloud identity) and related federal directives for cloud security configuration.
Surface area
Where it looks
Entra IDExchange OnlineMicrosoft TeamsSharePointPower Platform
Use cases
When it earns its keep
Federal & regulated compliance
Organizations that must follow CISA guidance — or who want to demonstrate they take federal recommendations seriously — can audit directly against SCuBA.
Prioritized remediation
The SCuBA baseline is ordered by real-world impact, so it doubles as a remediation priority list when resources are limited.
Insurance & procurement
Cyber-insurance underwriters and government procurement increasingly reference SCuBA. A dated report is usable evidence in both.
Other benchmarks
Add another framework
CIS M365
CIS Microsoft 365 Foundations Benchmark v3.1.0 — 60+ tests across Entra ID, Exchange, Teams, and SharePoint.
EIDSCA
Entra ID Security Config Analyzer baseline — 60+ tests from the Microsoft Entra ID Attack and Defense Playbook.
ORCA
Office 365 Recommended Configuration Analyzer — comprehensive Exchange Online security configuration checks.
One credit. One tenant. One report.
Run CISA SCuBA against a Microsoft 365 tenant and get a severity-ranked PDF. Credits never expire.