Secure Cloud Business Applications (SCuBA)

Baseline Documents

Light mode

Google Calendar Baseline Report

Customer Name	Customer Domain	Customer ID	Report Date	Baseline Version	Tool Version
Cool Example Org	example.org	ABCDEFG	07/20/2026 12:43:08 PDT	1	v1.0.0

Policy Indicators:

Automated CheckAutomatically verified by ScubaGoggles
BOD 25-01 RequirementRequired by CISA BOD 25-01
ManualRequires manual verification

CALENDAR-1 External Sharing Options

Control ID	Requirement	Result	Criticality	Details
GWS.CALENDAR.1.1v1	External sharing options for primary calendars SHALL be configured to "Only free/busy information (hide event details)." BOD 25-01 Requirement Automated Check	Pass	Shall	Requirement met.
GWS.CALENDAR.1.2v1	External sharing options for secondary calendars SHALL be configured to "Only free/busy information (hide event details)." BOD 25-01 Requirement Automated Check	Pass	Shall	Requirement met.

CALENDAR-2 External Invitations Warnings

Control ID	Requirement	Result	Criticality	Details
GWS.CALENDAR.2.1v1	External invitations warnings SHALL be enabled to prompt users before sending invitations. BOD 25-01 Requirement Automated Check	Fail	Shall	The following OUs are non-compliant: Cool Example Org (group chanclayton@example.com): External Sharing Guest Prompt is disabled

CALENDAR-3 Calendar Interop Management

Control ID	Requirement	Result	Criticality	Details
GWS.CALENDAR.3.1v1	Calendar Interop SHOULD be disabled. Automated Check	Pass	Should	Requirement met.
GWS.CALENDAR.3.2v1	Microsoft 365 (Graph API) SHALL be used instead of basic authentication to establish connectivity between tenants or organizations in cases where Calendar Interop is deemed necessary for agency mission fulfillment. Manual	N/A	Shall/Not-Implemented	Currently not able to be tested automatically; please manually check.

CALENDAR-4 Paid Appointments

Control ID	Requirement	Result	Criticality	Details
GWS.CALENDAR.4.1v1	"Appointment Schedule with Payments" SHOULD be disabled. Automated Check	Pass	Should	Requirement met.