Check Google Workspace against CISA’s SCuBA baselines with ScubaGoggles, and read its log-based results with care

CISA’s ScubaGoggles exports Google Workspace settings through Google APIs, compares them with the SCuBA baselines using OPA Rego, and reports results as HTML and JSON. It needs a Super Admin user or a service account with delegated scopes, and its log-based checks cannot see settings that were never changed or changed more than six months ago.

Source facts

CISA’s ScubaGoggles is an assessment tool that verifies whether a Google Workspace organization’s configuration conforms to the Secure Cloud Business Applications (SCuBA) secure configuration baselines. It exports settings and logs mainly through the Google Admin SDK API, compares them with the baselines using OPA Rego and packages the results as HTML and JSON, and its baseline list includes Gmail, Drive and Docs, Meet, Chat, Calendar, Groups for Business, Sites, Classroom, Gemini, Common Controls and Assured Controls.

Its prerequisites say the tool requires a user with the Super Admin role who consents to a list of OAuth scopes, mostly read-only, or domain-wide delegation of listed scopes when run with a service account, and that the Admin SDK, Groups Settings and Cloud Identity APIs must be enabled. Because the Groups Settings API has no read-only scope, the project uses the Groups Reader role with delegated admin service account authorization to achieve least privilege.

The limitations page says some checks rely on admin log events rather than the Policy API, so ScubaGoggles cannot see a setting never changed from its default or changes older than the six months admin logs are kept, and it assumes custom organizational units without events inherit their parent’s setting. It says such results should be viewed with a healthy degree of skepticism, and that sub-OUs of a non-compliant OU should be assumed non-compliant unless set explicitly.

Applicability

Use this for Google Workspace tenants, including education tenants that use Classroom. SCuBA baselines are CISA’s secure configuration recommendations, so decide which controls fit your organization and record the reasons for any you do not adopt.

DSE recommendation

DSE recommends running ScubaGoggles against Google Workspace at least quarterly with a tightly controlled assessment identity and reviewing every failed or undetermined control. Prefer a service account limited to the documented delegation scopes, keep reports as evidence, check log-based and undetermined results by hand in the Admin console, and track accepted exceptions with an owner.

Verification

Compare consecutive reports for new failures, confirm undetermined controls were checked manually, and review who can use the assessment credentials.

Official references

CISA ScubaGoggles (GitHub) — Google Workspace secure configuration assessment tool. ScubaGoggles — SCuBA Google Workspace baselines index. ScubaGoggles — Prerequisites. ScubaGoggles — Limitations. Reviewed October 19, 2026.