builtin-pester/cisa/frameworks/cisa-scuba.json
|
{ "Framework": "cisa-scuba", "Name": "CISA SCuBA Secure Configuration Baselines for Microsoft 365", "Version": "ScubaGear main, 2026-10-11", "Url": "https://github.com/cisagov/ScubaGear", "License": "CC0-1.0", "Note": "Upstream.Status records where each policy stands in ScubaGear: Current (same ID), Moved (now under another ID), Removed (withdrawn by CISA) or NotFound.", "Requirements": [ { "Id": "MS.AAD.1.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.1.1v1" }, "Related": ["nist-800-53-r5:CM-7"] }, { "Id": "MS.AAD.2.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.2.1v1" }, "Related": ["nist-800-53-r5:AC-2(12)", "nist-800-53-r5:AC-2(13)"] }, { "Id": "MS.AAD.2.2", "Criticality": "SHOULD", "Upstream": { "Status": "Current", "Id": "MS.AAD.2.2v1" }, "Related": ["nist-800-53-r5:AC-2(12)"] }, { "Id": "MS.AAD.2.3", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.2.3v1" }, "Related": ["nist-800-53-r5:AC-2(12)", "nist-800-53-r5:AC-2(13)"] }, { "Id": "MS.AAD.3.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.3.1v1" }, "Related": ["nist-800-53-r5:IA-2(1)", "nist-800-53-r5:IA-2(2)", "nist-800-53-r5:IA-5c", "nist-800-53-r5:IA-5g", "nist-800-53-r5:IA-2(8)"] }, { "Id": "MS.AAD.3.2", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.3.2v2" }, "Related": ["nist-800-53-r5:IA-2(1)", "nist-800-53-r5:IA-2(2)"] }, { "Id": "MS.AAD.3.3", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.3.3v2" }, "Related": ["nist-800-53-r5:IA-2(1)", "nist-800-53-r5:IA-2(2)", "nist-800-53-r5:IA-5c", "nist-800-53-r5:IA-5g", "nist-800-53-r5:IA-2(8)", "nist-800-53-r5:IA-2(13)"] }, { "Id": "MS.AAD.3.4", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.3.4v1" }, "Related": ["nist-800-53-r5:CM-7"] }, { "Id": "MS.AAD.3.5", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.3.5v2" }, "Related": ["nist-800-53-r5:CM-7b", "nist-800-53-r5:IA-5c"] }, { "Id": "MS.AAD.3.6", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.3.6v1" }, "Related": ["nist-800-53-r5:IA-2(1)", "nist-800-53-r5:IA-5c", "nist-800-53-r5:IA-5g", "nist-800-53-r5:IA-2(8)"] }, { "Id": "MS.AAD.3.7", "Criticality": "SHOULD", "Upstream": { "Status": "Current", "Id": "MS.AAD.3.7v1" }, "Related": ["nist-800-53-r5:AC-20b", "nist-800-53-r5:IA-3"] }, { "Id": "MS.AAD.3.8", "Criticality": "SHOULD", "Upstream": { "Status": "Current", "Id": "MS.AAD.3.8v1" }, "Related": ["nist-800-53-r5:AC-20b", "nist-800-53-r5:IA-3"] }, { "Id": "MS.AAD.4.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.4.1v1" }, "Related": ["nist-800-53-r5:AU-4"] }, { "Id": "MS.AAD.5.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.5.1v1" }, "Related": ["nist-800-53-r5:AC-6(10)", "nist-800-53-r5:CM-5"] }, { "Id": "MS.AAD.5.2", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.5.2v1" }, "Related": ["nist-800-53-r5:AC-6(10)", "nist-800-53-r5:CM-5"] }, { "Id": "MS.AAD.5.3", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.5.3v1" }, "Related": ["nist-800-53-r5:CM-4"] }, { "Id": "MS.AAD.5.4", "Criticality": "SHALL", "Upstream": { "Status": "NotFound" }, "Related": [] }, { "Id": "MS.AAD.6.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.6.1v1" }, "Related": ["nist-800-53-r5:IA-5(1)"] }, { "Id": "MS.AAD.7.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.7.1v1" }, "Related": ["nist-800-53-r5:AC-6(5)"] }, { "Id": "MS.AAD.7.2", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.7.2v1" }, "Related": ["nist-800-53-r5:AC-5"] }, { "Id": "MS.AAD.7.3", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.7.3v1" }, "Related": ["nist-800-53-r5:AC-6(5)"] }, { "Id": "MS.AAD.7.4", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.7.4v1" }, "Related": ["nist-800-53-r5:AC-2"] }, { "Id": "MS.AAD.7.5", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.7.5v1" }, "Related": ["nist-800-53-r5:AC-2"] }, { "Id": "MS.AAD.7.6", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.7.6v1" }, "Related": ["nist-800-53-r5:AC-6(1)"] }, { "Id": "MS.AAD.7.7", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.7.7v1" }, "Related": ["nist-800-53-r5:AC-2(1)"] }, { "Id": "MS.AAD.7.8", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.AAD.7.8v1" }, "Related": ["nist-800-53-r5:AC-6(9)"] }, { "Id": "MS.AAD.7.9", "Criticality": "SHOULD", "Upstream": { "Status": "Current", "Id": "MS.AAD.7.9v1" }, "Related": ["nist-800-53-r5:AC-6(9)"] }, { "Id": "MS.AAD.8.1", "Criticality": "SHOULD", "Upstream": { "Status": "Current", "Id": "MS.AAD.8.1v1" }, "Related": ["nist-800-53-r5:AC-6"] }, { "Id": "MS.AAD.8.2", "Criticality": "SHOULD", "Upstream": { "Status": "Current", "Id": "MS.AAD.8.2v1" }, "Related": ["nist-800-53-r5:AC-6(10)"] }, { "Id": "MS.AAD.8.3", "Criticality": "SHOULD", "Upstream": { "Status": "Current", "Id": "MS.AAD.8.3v1" }, "Related": ["nist-800-53-r5:AC-3"] }, { "Id": "MS.EXO.1.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.EXO.1.1v2" }, "Related": ["nist-800-53-r5:AC-4"] }, { "Id": "MS.EXO.2.1", "Criticality": "SHALL", "Upstream": { "Status": "NotFound" }, "Related": [] }, { "Id": "MS.EXO.2.2", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.EXO.2.2v3" }, "Related": ["nist-800-53-r5:AC-2d"] }, { "Id": "MS.EXO.3.1", "Criticality": "SHOULD", "Upstream": { "Status": "Current", "Id": "MS.EXO.3.1v1" }, "Related": ["nist-800-53-r5:SC-8"] }, { "Id": "MS.EXO.4.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.EXO.4.1v1" }, "Related": ["nist-800-53-r5:SI-8"] }, { "Id": "MS.EXO.4.2", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.EXO.4.2v1" }, "Related": ["nist-800-53-r5:SI-8"] }, { "Id": "MS.EXO.4.3", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.EXO.4.3v1" }, "Related": ["nist-800-53-r5:SI-4(5)"] }, { "Id": "MS.EXO.5.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.EXO.5.1v1" }, "Related": ["nist-800-53-r5:CM-7"] }, { "Id": "MS.EXO.6.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.EXO.6.1v1" }, "Related": ["nist-800-53-r5:AC-3", "nist-800-53-r5:SC-7(10)(a)"] }, { "Id": "MS.EXO.6.2", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.EXO.6.2v1" }, "Related": ["nist-800-53-r5:AC-3", "nist-800-53-r5:SC-7(10)(a)"] }, { "Id": "MS.EXO.7.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.EXO.7.1v1" }, "Related": ["nist-800-53-r5:SI-8"] }, { "Id": "MS.EXO.8.1", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.3.1v1", "From": "MS.EXO.8.1v2" }, "Related": ["nist-800-53-r5:SC-7(10)"] }, { "Id": "MS.EXO.8.2", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.3.1v1", "From": "MS.EXO.8.2v2" }, "Related": ["nist-800-53-r5:SC-7(10)"] }, { "Id": "MS.EXO.8.3", "Criticality": "SHOULD", "Upstream": { "Status": "Removed", "From": "MS.EXO.8.3v1", "Reason": "Removed \"comparable to solution offered by Microsoft policies\"" }, "Related": [] }, { "Id": "MS.EXO.8.4", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.3.1v1", "From": "MS.EXO.8.4v1" }, "Related": ["nist-800-53-r5:SC-7(10)"] }, { "Id": "MS.EXO.9.1", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.1.1v1", "From": "MS.EXO.9.1v2" }, "Related": ["nist-800-53-r5:SI-3"] }, { "Id": "MS.EXO.9.2", "Criticality": "SHOULD", "Upstream": { "Status": "Removed", "From": "MS.EXO.9.2v1", "Reason": "Removed the policy because it could not be configured via Defender and assessed by ScubaGear." }, "Related": [] }, { "Id": "MS.EXO.9.3", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.1.1v1", "From": "MS.EXO.9.3v1" }, "Related": ["nist-800-53-r5:SI-3"] }, { "Id": "MS.EXO.9.4", "Criticality": "SHOULD", "Upstream": { "Status": "Removed", "From": "MS.EXO.9.4v1", "Reason": "Removed \"comparable to solution offered by Microsoft policies\"" }, "Related": [] }, { "Id": "MS.EXO.9.5", "Criticality": "SHOULD", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.1.1v1", "From": "MS.EXO.9.5v1" }, "Related": ["nist-800-53-r5:SI-3"] }, { "Id": "MS.EXO.10.1", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.1.3v1", "From": "MS.EXO.10.1v1" }, "Related": ["nist-800-53-r5:SI-3"] }, { "Id": "MS.EXO.10.2", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.1.3v1", "From": "MS.EXO.10.2v1" }, "Related": ["nist-800-53-r5:SI-3"] }, { "Id": "MS.EXO.10.3", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.1.2v1", "From": "MS.EXO.10.3v1" }, "Related": ["nist-800-53-r5:SI-3"] }, { "Id": "MS.EXO.11.1", "Criticality": "SHOULD", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.2.1v1", "From": "MS.EXO.11.1v1" }, "Related": ["nist-800-53-r5:SI-8"] }, { "Id": "MS.EXO.11.2", "Criticality": "SHOULD", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.2.4v1", "From": "MS.EXO.11.2v1" }, "Related": ["nist-800-53-r5:AT-2b", "nist-800-53-r5:SI-8"] }, { "Id": "MS.EXO.11.3", "Criticality": "SHOULD", "Upstream": { "Status": "Removed", "From": "MS.EXO.11.3v1", "Reason": "Removed \"comparable to solution offered by Microsoft policies\"" }, "Related": [] }, { "Id": "MS.EXO.12.1", "Criticality": "SHOULD", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.8.1v1", "From": "MS.EXO.12.1v1" }, "Related": ["nist-800-53-r5:AC-4"] }, { "Id": "MS.EXO.12.2", "Criticality": "SHOULD", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.8.2v1", "From": "MS.EXO.12.2v1" }, "Related": ["nist-800-53-r5:AC-4"] }, { "Id": "MS.EXO.13.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.EXO.13.1v1" }, "Related": ["nist-800-53-r5:AU-12c"] }, { "Id": "MS.EXO.14.1", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.6.1v1", "From": "MS.EXO.14.1v2" }, "Related": ["nist-800-53-r5:SI-8"] }, { "Id": "MS.EXO.14.2", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.6.1v1", "From": "MS.EXO.14.2v1" }, "Related": ["nist-800-53-r5:SI-8"] }, { "Id": "MS.EXO.14.3", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.6.2v1", "From": "MS.EXO.14.3v2" }, "Related": ["nist-800-53-r5:SI-8"] }, { "Id": "MS.EXO.14.4", "Criticality": "SHOULD", "Upstream": { "Status": "NotFound" }, "Related": [] }, { "Id": "MS.EXO.15.1", "Criticality": "SHOULD", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.7.1v1", "From": "MS.EXO.15.1v1" }, "Related": ["nist-800-53-r5:SI-3"] }, { "Id": "MS.EXO.15.2", "Criticality": "SHOULD", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.7.2v1", "From": "MS.EXO.15.2v1" }, "Related": ["nist-800-53-r5:SI-3"] }, { "Id": "MS.EXO.15.3", "Criticality": "SHOULD", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.7.3v1", "From": "MS.EXO.15.3v1" }, "Related": ["nist-800-53-r5:SI-3", "nist-800-53-r5:AU-12c"] }, { "Id": "MS.EXO.16.1", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.4.1v1", "From": "MS.EXO.16.1v1" }, "Related": ["nist-800-53-r5:SI-4(5)"] }, { "Id": "MS.EXO.16.2", "Criticality": "SHOULD", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.4.2v1", "From": "MS.EXO.16.2v1" }, "Related": ["nist-800-53-r5:SI-4(5)"] }, { "Id": "MS.EXO.17.1", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.5.1v1", "From": "MS.EXO.17.1v1" }, "Related": ["nist-800-53-r5:AU-12"] }, { "Id": "MS.EXO.17.2", "Criticality": "SHALL", "Upstream": { "Status": "NotFound" }, "Related": [] }, { "Id": "MS.EXO.17.3", "Criticality": "SHALL", "Upstream": { "Status": "Moved", "Id": "MS.SECURITYSUITE.5.2v1", "From": "MS.EXO.17.3v1" }, "Related": ["nist-800-53-r5:AU-11"] }, { "Id": "MS.SHAREPOINT.1.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.SHAREPOINT.1.1v1" }, "Related": ["nist-800-53-r5:AC-2", "nist-800-53-r5:AC-3", "nist-800-53-r5:IA-8"] }, { "Id": "MS.SHAREPOINT.1.2", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.SHAREPOINT.1.2v1" }, "Related": ["nist-800-53-r5:AC-2", "nist-800-53-r5:AC-3", "nist-800-53-r5:IA-8"] }, { "Id": "MS.SHAREPOINT.1.3", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.SHAREPOINT.1.3v1" }, "Related": ["nist-800-53-r5:AC-3", "nist-800-53-r5:AC-6(10)"] }, { "Id": "MS.SHAREPOINT.2.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.SHAREPOINT.2.1v1" }, "Related": ["nist-800-53-r5:AC-6"] }, { "Id": "MS.SHAREPOINT.2.2", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.SHAREPOINT.2.2v1" }, "Related": ["nist-800-53-r5:AC-6"] }, { "Id": "MS.SHAREPOINT.3.1", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.SHAREPOINT.3.1v1" }, "Related": ["nist-800-53-r5:AC-3", "nist-800-53-r5:AC-21b"] }, { "Id": "MS.SHAREPOINT.3.2", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.SHAREPOINT.3.2v1" }, "Related": ["nist-800-53-r5:AC-6"] }, { "Id": "MS.SHAREPOINT.3.3", "Criticality": "SHALL", "Upstream": { "Status": "Current", "Id": "MS.SHAREPOINT.3.3v2" }, "Related": ["nist-800-53-r5:IA-11"] } ] } |