If you sell to, or work in, the public sector — or you just want to be measured against the strictest available Microsoft 365 baseline — you have run into CISA SCUBA. It is the US Cybersecurity and Infrastructure Security Agency's project for securing cloud business applications, and for Microsoft 365 it defines what "securely configured" actually means.
This post explains what SCUBA is, what it covers, how to run an assessment against it, and the operational reality of keeping up with it.
What CISA SCUBA is
SCUBA stands for Secure Cloud Business Applications. It is a CISA project that publishes secure configuration baselines for common cloud services — including Microsoft 365 — plus tooling to assess whether a tenant meets them.
It matters because CISA is not a vendor. The baseline is written by a government security agency, mapped to real threats, and — for federal agencies — backed by a binding directive. Binding Operational Directive 25-01 directs agencies to implement the SCUBA baselines for their cloud services and to monitor them continuously. That "continuously" is doing a lot of work, and it is exactly where manual reviews fall down.
What SCUBA covers for Microsoft 365
The SCUBA Microsoft 365 baselines span the major workloads:
- Entra ID — Conditional Access, MFA, privileged access, guest access, consent
- Exchange Online — mail-flow and anti-phishing configuration
- Teams — external access, meeting and messaging policies
- SharePoint and OneDrive — external sharing and link defaults
- Power Platform — environment and connector governance
Each policy has an identifier (the MS.AAD.*, MS.EXO.* family), so a finding can be cited precisely in an audit file.
How to run a SCUBA assessment
CISA publishes assessment tooling alongside the baselines. In practice, running SCUBA by hand means:
- Granting read-only access to the tenant.
- Running the assessment tooling (typically PowerShell-based) across each workload.
- Reading the output and mapping failures back to the policy IDs.
- Repeating on a cadence, because the baseline is a moving target.
That last point is the hard part. The SCUBA baselines get updated; tenants drift; policies change. A one-time SCUBA review is a snapshot of a process that is supposed to be continuous.
The operational reality
SCUBA is thorough, which is both its strength and its cost. If you are an MSP or a lean IT team, the friction is real:
- Setup effort. Permissions, tooling, and PowerShell comfort are prerequisites.
- Point-in-time. The report is only true the day you run it.
- Fragmented output. You get policy results, not a client-ready deliverable.
- Maintenance. When CISA updates a baseline, your process has to catch up.
None of that means SCUBA is not worth it. It means SCUBA is a standard, and standards need a process to satisfy them — ideally one that runs on a schedule and produces evidence each time.
Where a hosted audit fits
A hosted audit runs the SCUBA baseline as one of several frameworks in a single pass — CIS, CISA SCUBA, EIDSCA, ORCA, and community best practices — across Entra ID, Exchange, Teams, SharePoint, and Defender. Findings are mapped to their control IDs and delivered as a dated, severity-ranked report you can drop straight into a compliance evidence package.
That turns "we ran SCUBA once" into "here is our recurring SCUBA evidence," which is what BOD 25-01-style continuous-monitoring expectations actually require. You can explore the CISA SCUBA benchmark detail on our CISA SCUBA page, or see the report format in the sample report.
The short version
CISA SCUBA is the most rigorous public Microsoft 365 baseline available, and if you are in or near the public sector it is effectively table stakes. Treat it as a standard to meet on an ongoing basis, not a box to tick once. A scheduled audit gives you the SCUBA evidence without the manual grind.
Run an audit to assess your tenant against SCUBA and the other benchmarks in minutes.