The CISA ScubaGear update moves Microsoft 365 checks to direct API calls, and ScubaGoggles adds an assured controls baseline.