CISA’s ScubaGoggles exports Google Workspace settings through Google APIs, compares them with the SCuBA baselines using OPA Rego, and reports results as HTML and JSON. It needs a Super Admin user or a service account with delegated scopes, and its log-based checks cannot see settings that were never changed or changed more than six months ago.
\nCISA’s ScubaGoggles is an assessment tool that verifies whether a Google Workspace organization’s configuration conforms to the Secure Cloud Business Applications (SCuBA) secure configuration baselines. It exports settings and logs mainly through the Google Admin SDK API, compares them with the baselines using OPA Rego and packages the results as HTML and JSON, and its baseline list includes Gmail, Drive and Docs, Meet, Chat, Calendar, Groups for Business, Sites, Classroom, Gemini, Common Controls and Assured Controls.
\nIts prerequisites say the tool requires a user with the Super Admin role who consents to a list of OAuth scopes, mostly read-only, or domain-wide delegation of listed scopes when run with a service account, and that the Admin SDK, Groups Settings and Cloud Identity APIs must be enabled. Because the Groups Settings API has no read-only scope, the project uses the Groups Reader role with delegated admin service account authorization to achieve least privilege.
\nThe limitations page says some checks rely on admin log events rather than the Policy API, so ScubaGoggles cannot see a setting never changed from its default or changes older than the six months admin logs are kept, and it assumes custom organizational units without events inherit their parent’s setting. It says such results should be viewed with a healthy degree of skepticism, and that sub-OUs of a non-compliant OU should be assumed non-compliant unless set explicitly.
\nUse this for Google Workspace tenants, including education tenants that use Classroom. SCuBA baselines are CISA’s secure configuration recommendations, so decide which controls fit your organization and record the reasons for any you do not adopt.
\nDSE recommends running ScubaGoggles against Google Workspace at least quarterly with a tightly controlled assessment identity and reviewing every failed or undetermined control. Prefer a service account limited to the documented delegation scopes, keep reports as evidence, check log-based and undetermined results by hand in the Admin console, and track accepted exceptions with an owner.
\nCompare consecutive reports for new failures, confirm undetermined controls were checked manually, and review who can use the assessment credentials.
\nCISA ScubaGoggles (GitHub) — Google Workspace secure configuration assessment tool. ScubaGoggles — SCuBA Google Workspace baselines index. ScubaGoggles — Prerequisites. ScubaGoggles — Limitations. Reviewed October 19, 2026.
", "content_text": "CISA’s ScubaGoggles exports Google Workspace settings through Google APIs, compares them with the SCuBA baselines using OPA Rego, and reports results as HTML and JSON. It needs a Super Admin user or a service account with delegated scopes, and its log-based checks cannot see settings that were never changed or changed more than six months ago.\nSource facts\nCISA’s ScubaGoggles is an assessment tool that verifies whether a Google Workspace organization’s configuration conforms to the Secure Cloud Business Applications (SCuBA) secure configuration baselines. It exports settings and logs mainly through the Google Admin SDK API, compares them with the baselines using OPA Rego and packages the results as HTML and JSON, and its baseline list includes Gmail, Drive and Docs, Meet, Chat, Calendar, Groups for Business, Sites, Classroom, Gemini, Common Controls and Assured Controls.\nIts prerequisites say the tool requires a user with the Super Admin role who consents to a list of OAuth scopes, mostly read-only, or domain-wide delegation of listed scopes when run with a service account, and that the Admin SDK, Groups Settings and Cloud Identity APIs must be enabled. Because the Groups Settings API has no read-only scope, the project uses the Groups Reader role with delegated admin service account authorization to achieve least privilege.\nThe limitations page says some checks rely on admin log events rather than the Policy API, so ScubaGoggles cannot see a setting never changed from its default or changes older than the six months admin logs are kept, and it assumes custom organizational units without events inherit their parent’s setting. It says such results should be viewed with a healthy degree of skepticism, and that sub-OUs of a non-compliant OU should be assumed non-compliant unless set explicitly.\nApplicability\nUse this for Google Workspace tenants, including education tenants that use Classroom. SCuBA baselines are CISA’s secure configuration recommendations, so decide which controls fit your organization and record the reasons for any you do not adopt.\nDSE recommendation\nDSE recommends running ScubaGoggles against Google Workspace at least quarterly with a tightly controlled assessment identity and reviewing every failed or undetermined control. Prefer a service account limited to the documented delegation scopes, keep reports as evidence, check log-based and undetermined results by hand in the Admin console, and track accepted exceptions with an owner.\nVerification\nCompare consecutive reports for new failures, confirm undetermined controls were checked manually, and review who can use the assessment credentials.\nOfficial references\nCISA ScubaGoggles (GitHub) — Google Workspace secure configuration assessment tool. ScubaGoggles — SCuBA Google Workspace baselines index. ScubaGoggles — Prerequisites. ScubaGoggles — Limitations. Reviewed October 19, 2026.", "content_markdown": "CISA’s ScubaGoggles exports Google Workspace settings through Google APIs, compares them with the SCuBA baselines using OPA Rego, and reports results as HTML and JSON. It needs a Super Admin user or a service account with delegated scopes, and its log-based checks cannot see settings that were never changed or changed more than six months ago.\n\n## Source facts\n\nCISA’s [ScubaGoggles](https://github.com/cisagov/ScubaGoggles) is an assessment tool that verifies whether a Google Workspace organization’s configuration conforms to the Secure Cloud Business Applications (SCuBA) secure configuration baselines. It exports settings and logs mainly through the Google Admin SDK API, compares them with the baselines using OPA Rego and packages the results as HTML and JSON, and its [baseline list](https://github.com/cisagov/ScubaGoggles/blob/main/scubagoggles/baselines/README.md) includes Gmail, Drive and Docs, Meet, Chat, Calendar, Groups for Business, Sites, Classroom, Gemini, Common Controls and Assured Controls.\n\nIts [prerequisites](https://github.com/cisagov/ScubaGoggles/blob/main/docs/prerequisites/Prerequisites.md) say the tool requires a user with the Super Admin role who consents to a list of OAuth scopes, mostly read-only, or domain-wide delegation of listed scopes when run with a service account, and that the Admin SDK, Groups Settings and Cloud Identity APIs must be enabled. Because the Groups Settings API has no read-only scope, the project uses the Groups Reader role with delegated admin service account authorization to achieve least privilege.\n\nThe [limitations page](https://github.com/cisagov/ScubaGoggles/blob/main/docs/usage/Limitations.md) says some checks rely on admin log events rather than the Policy API, so ScubaGoggles cannot see a setting never changed from its default or changes older than the six months admin logs are kept, and it assumes custom organizational units without events inherit their parent’s setting. It says such results should be viewed with a healthy degree of skepticism, and that sub-OUs of a non-compliant OU should be assumed non-compliant unless set explicitly.\n\n## Applicability\n\nUse this for Google Workspace tenants, including education tenants that use Classroom. SCuBA baselines are CISA’s secure configuration recommendations, so decide which controls fit your organization and record the reasons for any you do not adopt.\n\n## DSE recommendation\n\nDSE recommends running ScubaGoggles against Google Workspace at least quarterly with a tightly controlled assessment identity and reviewing every failed or undetermined control. Prefer a service account limited to the documented delegation scopes, keep reports as evidence, check log-based and undetermined results by hand in the Admin console, and track accepted exceptions with an owner.\n\n## Verification\n\nCompare consecutive reports for new failures, confirm undetermined controls were checked manually, and review who can use the assessment credentials.\n\n## Official references\n\n[CISA ScubaGoggles (GitHub) — Google Workspace secure configuration assessment tool](https://github.com/cisagov/ScubaGoggles). [ScubaGoggles — SCuBA Google Workspace baselines index](https://github.com/cisagov/ScubaGoggles/blob/main/scubagoggles/baselines/README.md). [ScubaGoggles — Prerequisites](https://github.com/cisagov/ScubaGoggles/blob/main/docs/prerequisites/Prerequisites.md). [ScubaGoggles — Limitations](https://github.com/cisagov/ScubaGoggles/blob/main/docs/usage/Limitations.md). Reviewed October 19, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/cisa-scubagoggles-google-workspace-scuba-baselines-assessment-log-based-limits/", "url": "https://update.dsesecurity.com/updates/cisa-scubagoggles-google-workspace-scuba-baselines-assessment-log-based-limits/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-19" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/cisa-scubagoggles-google-workspace-scuba-baselines-assessment-log-based-limits/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check Google Workspace against CISA’s SCuBA baselines with ScubaGoggles, and read its log-based results with care", "item": "https://update.dsesecurity.com/updates/cisa-scubagoggles-google-workspace-scuba-baselines-assessment-log-based-limits/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/cisa-scubagoggles-google-workspace-scuba-baselines-assessment-log-based-limits/#article", "identifier": "https://update.dsesecurity.com/updates/cisa-scubagoggles-google-workspace-scuba-baselines-assessment-log-based-limits/", "url": "https://update.dsesecurity.com/updates/cisa-scubagoggles-google-workspace-scuba-baselines-assessment-log-based-limits/", "headline": "Check Google Workspace against CISA’s SCuBA baselines with ScubaGoggles, and read its log-based results with care", "description": "CISA’s ScubaGoggles exports Google Workspace settings through Google APIs, compares them with the SCuBA baselines using OPA Rego, and reports results…", "abstract": "CISA’s ScubaGoggles exports Google Workspace settings through Google APIs, compares them with the SCuBA baselines using OPA Rego, and reports results as HTML and JSON. It needs a Super Admin user or a service account with delegated scopes, and its log-based checks cannot see settings that were never changed or changed more than six months ago.", "articleBody": "CISA’s ScubaGoggles exports Google Workspace settings through Google APIs, compares them with the SCuBA baselines using OPA Rego, and reports results as HTML and JSON. It needs a Super Admin user or a service account with delegated scopes, and its log-based checks cannot see settings that were never changed or changed more than six months ago.\nSource facts\nCISA’s ScubaGoggles is an assessment tool that verifies whether a Google Workspace organization’s configuration conforms to the Secure Cloud Business Applications (SCuBA) secure configuration baselines. It exports settings and logs mainly through the Google Admin SDK API, compares them with the baselines using OPA Rego and packages the results as HTML and JSON, and its baseline list includes Gmail, Drive and Docs, Meet, Chat, Calendar, Groups for Business, Sites, Classroom, Gemini, Common Controls and Assured Controls.\nIts prerequisites say the tool requires a user with the Super Admin role who consents to a list of OAuth scopes, mostly read-only, or domain-wide delegation of listed scopes when run with a service account, and that the Admin SDK, Groups Settings and Cloud Identity APIs must be enabled. Because the Groups Settings API has no read-only scope, the project uses the Groups Reader role with delegated admin service account authorization to achieve least privilege.\nThe limitations page says some checks rely on admin log events rather than the Policy API, so ScubaGoggles cannot see a setting never changed from its default or changes older than the six months admin logs are kept, and it assumes custom organizational units without events inherit their parent’s setting. It says such results should be viewed with a healthy degree of skepticism, and that sub-OUs of a non-compliant OU should be assumed non-compliant unless set explicitly.\nApplicability\nUse this for Google Workspace tenants, including education tenants that use Classroom. SCuBA baselines are CISA’s secure configuration recommendations, so decide which controls fit your organization and record the reasons for any you do not adopt.\nDSE recommendation\nDSE recommends running ScubaGoggles against Google Workspace at least quarterly with a tightly controlled assessment identity and reviewing every failed or undetermined control. Prefer a service account limited to the documented delegation scopes, keep reports as evidence, check log-based and undetermined results by hand in the Admin console, and track accepted exceptions with an owner.\nVerification\nCompare consecutive reports for new failures, confirm undetermined controls were checked manually, and review who can use the assessment credentials.\nOfficial references\nCISA ScubaGoggles (GitHub) — Google Workspace secure configuration assessment tool. ScubaGoggles — SCuBA Google Workspace baselines index. ScubaGoggles — Prerequisites. ScubaGoggles — Limitations. Reviewed October 19, 2026.", "datePublished": "2026-10-19T00:28:08+00:00", "dateModified": "2026-10-19T01:55:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/cisa-scubagoggles-google-workspace-scuba-baselines-assessment-log-based-limits/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/cisa-scubagoggles-google-workspace-scuba-baselines-assessment-log-based-limits/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check Google Workspace against CISA’s SCuBA baselines with ScubaGoggles, and read its log-based results with care" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 429, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "CISA ScubaGoggles (GitHub) — Google Workspace secure configuration assessment tool", "url": "https://github.com/cisagov/ScubaGoggles" } } ] } }