CISA SCuBA — Microsoft 365
134 source review items; explicit supporting and external test coverage
All available frameworksWhat the app checks
Technical checks run for the selected scope, available connectors and credentials. Results provide evidence for review; missing data is not a pass.
No explicit technical test mapping is listed for this framework in the checked C32 mapping files. Use its evidence workpapers and manual review workflow; do not assume a scanner result covers these requirements.
Framework-specific tools and manual work
Inspect external evidence imports ScubaGear 1.8.0 ScubaResults JSON offline. Enter the expected tenant ID independently. Product, tool and policy-version IDs are checked; missing policies remain missing and overridden results need review. This importer does not connect to Microsoft 365.
Review imported or exported evidence before attaching it to the assessment. Local inspection does not automatically change server records or assessor decisions.
What requires manual review
Confirm scope and applicability, review the requirement guidance, collect policies and records, conduct interviews or observations where needed, and assess evidence relevance and freshness. Record owners, rationale, workpaper conclusions and remediation. An assessor makes the final decision; a technical pass does not approve the whole framework.
Import the supported ScubaResults JSON for the selected tenant. Native ITAF host scans do not substitute for SCuBA checks. External tools, cloud subscription capabilities and permissions are required. Unknown policy versions, absent results and manual checks require review. CISA ScubaGear 1.8.0 release; repository CC0. Microsoft-derived baseline passages retain CC BY 4.0 attribution and linked sources. ITAF reformats policies and adds review guidance. No CISA, Microsoft or Google endorsement.
Where it is available
This preparation framework is listed in the C32 Professional/MSP application catalog. Free retains its ISO assessment limits. Availability of a framework is separate from the extent of automated scanning.
Coverage shown here comes from the application’s C32 requirement and mapping catalogs.