Cybersecurity and Infrastructure Security Agency Logo

Secure Cloud Business Applications (SCuBA)

Baseline Documents

Light mode

Details

Security Suite Baseline Report


Tenant Display NameTenant Domain NameReport DateBaseline VersionModule Version
tqhjytqhjy.onmicrosoft.com10/15/2026 21:46:53 Coordinated Universal Time12.0.0
Policy Indicators:
BOD 25-01 Requirement Required by CISA BOD 25-01
Automated Check Automatically verified by ScubaGear
Manual Requires manual verification
Requires Configuration Config file required for check

SECURITYSUITE-1 Malware Protection

Control IDRequirementResultCriticalityDetails
MS.SECURITYSUITE.1.1v1Emails with click-to-run file attachments SHALL be blocked including, at a minimum, .exe, .cmd, and .vbe files.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met. The highest priority anti-malware policy that applies to all users is: Standard Preset.
MS.SECURITYSUITE.1.2v1Email scanning SHALL be capable of reviewing emails after delivery.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met. The highest priority anti-malware policy that applies to all users is: Standard Preset.
MS.SECURITYSUITE.1.3v1Emails identified as containing malware SHALL be quarantined or dropped.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met. The highest priority safe attachments policy that applies to all users is: Standard Preset.
MS.SECURITYSUITE.1.4v1SharePoint, OneDrive, and Teams message attachments SHOULD be scanned for malware.
Automated Check
WarningShouldRequirement not met

SECURITYSUITE-2 Impersonation Protection

Control IDRequirementResultCriticalityDetails
MS.SECURITYSUITE.2.1v1User impersonation protection SHOULD be enabled for sensitive accounts.
Automated CheckRequires Configuration
WarningShouldNo users defined as sensitive users in the ScubaGear config file.
View all anti-phish policies
MS.SECURITYSUITE.2.2v1Domain impersonation protection SHOULD be enabled for domains owned by the agency.
Automated Check
PassShouldRequirement met
MS.SECURITYSUITE.2.3v1Domain impersonation protection SHOULD be added for key suppliers and partners.
Automated CheckRequires Configuration
WarningShouldNo partner domains defined in the ScubaGear config file.
View all anti-phish policies
MS.SECURITYSUITE.2.4v1User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.
Automated Check
PassShouldRequirement met

SECURITYSUITE-3 Data Loss Prevention

Control IDRequirementResultCriticalityDetails
MS.SECURITYSUITE.3.1v1A DLP policy SHALL be configured to protect PII and sensitive information, as defined by the agency, blocking at a minimum: credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN).
BOD 25-01 RequirementAutomated Check
PassShallRequirement met
MS.SECURITYSUITE.3.2v1The DLP policy SHOULD be applied to Exchange, OneDrive, SharePoint, Teams chat, and Devices.
Automated Check
WarningShouldDLP custom policy applied to the following locations: Devices. Custom policy protecting sensitive info types NOT applied to: Exchange, OneDrive, SharePoint, Teams. Teams location requires DLP for Teams included in E5/G5 licenses. For full policy details, see the ActualValue field in the results file: ./RegoOutput.json
MS.SECURITYSUITE.3.3v1The action for the DLP policy SHOULD be set to block sharing sensitive information with everyone.
Automated Check
PassShouldRequirement met
MS.SECURITYSUITE.3.4v1Notifications to inform users and help educate them on the proper use of sensitive information SHOULD be enabled in the DLP policy.
Automated Check
PassShouldRequirement met
MS.SECURITYSUITE.3.5v1The DLP policy SHOULD include an action to block access to sensitive information by restricted applications and unwanted Bluetooth applications.
Manual
N/AShould/Not-ImplementedThis product does not currently have the capability to check compliance for this policy. See Secure Configuration Baseline policy for instructions on manual check

SECURITYSUITE-4 Alerts

Control IDRequirementResultCriticalityDetails
MS.SECURITYSUITE.4.1v1At a minimum, the following alerts SHALL be enabled: a. Suspicious email sending patterns detected. b. Suspicious Connector Activity. c. Suspicious Email Forwarding Activity. d. Messages have been delayed. e. Tenant restricted from sending unprovisioned email. f. Tenant restricted from sending email. g. A potentially malicious URL click was detected. PassShallRequirement met
MS.SECURITYSUITE.4.2v1The alerts SHOULD be sent to a monitored address or incorporated into a Security Information and Event Management (SIEM).
Manual
N/AShould/Not-ImplementedThis product does not currently have the capability to check compliance for this policy. See Secure Configuration Baseline policy for instructions on manual check

SECURITYSUITE-5 Audit Logging

Control IDRequirementResultCriticalityDetails
MS.SECURITYSUITE.5.1v1Unified audit logging SHALL be enabled.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met
MS.SECURITYSUITE.5.2v1Audit logs SHALL be retained and searchable for a minimum of 3 months and retrievable for a minimum of 12 months.
Manual
N/AShall/Not-ImplementedThis product does not currently have the capability to check compliance for this policy. See Secure Configuration Baseline policy for instructions on manual check

SECURITYSUITE-6 Inbound Anti-Spam Protections

Control IDRequirementResultCriticalityDetails
MS.SECURITYSUITE.6.1v1Emails detected as spam and phishing SHALL NOT be delivered to the user's inbox.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met. Standard preset is active and compliant (Strict not active or non-compliant). Custom and Default policies not evaluated
MS.SECURITYSUITE.6.2v1Allowed domains SHALL NOT be added to inbound anti-spam protection policies.
BOD 25-01 RequirementAutomated Check
PassShallRequirement met. Standard preset is active and compliant (Strict not active or non-compliant). Custom and Default policies not evaluated

SECURITYSUITE-7 Link Protection

Control IDRequirementResultCriticalityDetails
MS.SECURITYSUITE.7.1v1URL comparison with a block-list SHOULD be enabled for URLs in emails, Teams messages, and Office documents.
Automated Check
PassShouldURL comparison with a block-list is enabled via the standard or strict preset security policies.
MS.SECURITYSUITE.7.2v1Direct download links SHOULD be scanned for malware.
Automated Check
PassShouldDirect download links are scanned for malware via the standard or strict preset security policies.
MS.SECURITYSUITE.7.3v1User click tracking SHOULD be enabled.
Automated Check
PassShouldUser click tracking is enabled via the standard or strict preset security policies.

SECURITYSUITE-8 IP Allow Lists

Control IDRequirementResultCriticalityDetails
MS.SECURITYSUITE.8.1v1IP allow lists SHOULD NOT be created.
Automated Check
PassShouldRequirement met
MS.SECURITYSUITE.8.2v1Safe lists SHOULD NOT be enabled.
Automated Check
PassShouldRequirement met