---
title: CISA ScubaGear 2.0 and ScubaGoggles 1.1.0: faster M365 baseline checks via direct REST/Graph calls, plus new Google Workspace Gemini controls | ctxsec
url: https://ctxsec.com/items/cisa-scubagear-2-0-scubagoggles-1-1
description: ""
status: "official (CISA ScubaGear v2.0.0 GitHub release Oct 22; ScubaGoggles v1.1.0 per CISA/Help Net Security coverage Oct 28)"
published: 2026-10-28
---

> 

[← Industry News](/industry) · [markdown](/items/cisa-scubagear-2-0-scubagoggles-1-1.md)

official (CISA ScubaGear v2.0.0 GitHub release Oct 22; ScubaGoggles v1.1.0 per CISA/Help Net Security coverage Oct 28)

2026-10-28

### CISA ScubaGear 2.0 and ScubaGoggles 1.1.0: faster M365 baseline checks via direct REST/Graph calls, plus new Google Workspace Gemini controls

CISA's Secure Cloud Business Applications (SCuBA) tools got a major bump. [ScubaGear v2.0.0](https://github.com/cisagov/ScubaGear/releases/tag/v2.0.0) (released Oct 22) moves supported Microsoft 365 product checks to **direct REST/Graph API** calls (continuing the Entra/SharePoint/Power Platform shift from 1.6/1.8), and adds baselines such as blocking high-risk Entra AI agents, risky-apps CSV/severity scoring, and broader Security Suite groups. ScubaGoggles **v1.1.0** adds Google Workspace baseline coverage including enhanced Gemini controls, per CISA's announcement coverage.

Federal civilian agencies already use these against CISA baselines; commercial tenants can run the same open-source assessments to find drift before an audit or incident.

Sources: [CISA ScubaGear v2.0.0 release (GitHub, Oct 22)](https://github.com/cisagov/ScubaGear/releases/tag/v2.0.0) · [Help Net Security: CISA updates ScubaGear and ScubaGoggles (Oct 28)](https://www.helpnetsecurity.com/2026/10/28/cisa-scubagear-scubagoggles-update/)