Microsoft 365 Security Assessment for US Companies: Cost, CISA SCuBA Baselines and Deliverables

The short version: For most US companies, the right buy is a fixed-price, read-only Microsoft 365 security assessment that checks your tenant against both the CIS Benchmark and CISA's SCuBA baselines. Ours costs US$450 for up to 10 users and up to US$2,900 for 150, with the report 5–7 business days after access. Running CISA's free tool first is the cheapest way to start.

A Microsoft 365 security assessment answers a simple question: is your tenant set up safely, and what should you fix first? For a US company the question usually arrives from outside. A cyber-insurance renewal asks about MFA and admin accounts. An enterprise customer sends a security questionnaire. A lender, a regulator or a board member wants something in writing.

This guide covers what a Microsoft 365 security assessment costs, what the CISA SCuBA baselines are and why a private company should care, what an assessment checks, and what you should receive at the end. Sources are listed at the end.

What does a Microsoft 365 security assessment cost for a US company?

The market runs from free self-service tools to consultancy projects billed by the day, which is why quotes vary so much. We sell one fixed-price product, priced only by the number of users. One-off fees, in US dollars, excluding tax:

• 1–10 users: US$450
• 11–25 users: US$990
• 26–75 users: US$1,800
• 76–150 users: US$2,900
• Above 150 users: a fixed fee quoted after a short scoping call

The scope is the same in every band, there is no hourly rate, and your location makes no difference to the price. The Microsoft 365 security assessment page always carries the current prices and any current offer. For a wider view of what different kinds of audit cost and why, read our breakdown of Microsoft 365 security audit cost.

How to spend less: do not buy monthly monitoring before you have a clean baseline. Fix what the one-off assessment finds, then decide whether you need continuous monitoring at all. For many small tenants, a re-assessment once a year may be all they need.

What are the CISA SCuBA baselines, and why do they matter outside government?

SCuBA stands for Secure Cloud Business Applications, a project of the US Cybersecurity and Infrastructure Security Agency (CISA). It publishes written security configuration baselines for Microsoft 365 services: Entra ID, Exchange Online, Defender, SharePoint and OneDrive, Teams, Power BI and Power Platform. Alongside them CISA publishes ScubaGear, a free, open-source PowerShell tool that reads a tenant and reports where it conforms to the baselines.

On December 17, 2024, CISA issued Binding Operational Directive 25-01. It requires federal civilian agencies to identify their cloud tenants, deploy SCuBA assessment tools and put the mandatory baseline policies in place, with deadlines through June 2025. At issuance, the only finalized baselines were the Microsoft 365 ones.

The directive does not bind private companies. It still matters to you for three practical reasons:

• It is a public, versioned standard. When a customer asks "against what did you assess?", "CISA's SCuBA baselines" is an answer they can look up.
• It is written for real tenants. The baselines were built for organizations that run Microsoft 365 every day, not for a theoretical lab.
• It is a useful second opinion. CISA's baselines and the CIS Microsoft 365 Foundations Benchmark overlap a lot but not completely. Where they disagree, you learn something about your setup.

That is why our report includes ScubaGear results per service next to the CIS Benchmark results. CIS is the record of the assessment; SCuBA is an independent cross-check; Microsoft Secure Score is kept as the trend line. Our comparison of Microsoft Secure Score vs the CIS Benchmark vs ScubaGear explains which one to use for which job.

What does the assessment check?

You may have heard this called an Office 365 security audit. Office 365 is the older name for the same email, file and collaboration services, so the work is the same. Every band checks three areas.

Identity in Entra ID

• MFA coverage for every user, including emergency ("break-glass") and service accounts
• Conditional Access policies and who is excluded from them
• Privileged roles, and phishing-resistant sign-in for administrators
• Legacy authentication and SMTP AUTH, which get around MFA
• Third-party apps that users have consented to, and the permissions they hold
• Guest accounts and their expiry

Email in Exchange Online and Defender for Office 365

• SPF, DKIM and DMARC on every domain, including parked ones
• Automatic forwarding to outside addresses and suspicious inbox rules
• Anti-phishing, anti-spam, Safe Links and Safe Attachments policies
• Mailbox auditing and audit log retention

Files and collaboration in SharePoint, OneDrive and Teams

• External sharing settings and anonymous "Anyone" links
• Sensitivity labels, retention and data loss prevention
• Teams external access and third-party apps
• Personal phones and laptops reaching company data without app protection

The assessment does not include fixing the problems, Microsoft 365 backup, penetration testing, phishing simulation, firewalls or on-premises equipment. It never opens mail or documents.

What do you receive at the end?

A report is only useful if someone outside IT can act on it. Ours contains:

• Written report: graded findings, the evidence for each, and the effort to fix it
• CIS results: the CIS Microsoft 365 Foundations Benchmark, Level 1 and Level 2, by section, including the manual controls that no script can check
• ScubaGear results: pass, fail and warning by service, against CISA's baselines
• Insurer evidence pack: MFA, privileged accounts, email authentication, endpoint protection and log retention, each tied to a dated export
• Fix plan: phased and prioritized, so the cheap, high-impact items come first
• Excel workbook: every control in one sheet, useful for your own tracking
• Debrief call: a walk-through of the findings and the order to fix them

You can read a complete sample assessment report before you buy. It uses a fictitious client.

How do US companies use the report?

Cyber-insurance applications

Insurers ask about MFA on email and remote access, privileged accounts, email security, endpoint protection and backups. The evidence pack gives each answer a dated export. Every insurer sets its own rules, so we cannot promise what a particular one accepts. Our guide to cyber insurance MFA requirements for Microsoft 365 explains what "MFA everywhere" tends to mean in practice.

Customer security questionnaires

When an enterprise customer asks how your tenant is configured, the findings register and the workbook are the supporting record. You answer from evidence rather than from memory.

Regulated businesses

Some US rules touch Microsoft 365 directly. The FTC Safeguards Rule, for example, applies to many non-bank financial businesses such as mortgage brokers and tax preparers. It requires multi-factor authentication for anyone accessing customer information, a written risk assessment, and either continuous monitoring or annual penetration testing with vulnerability assessments every six months. Firms holding information on fewer than 5,000 consumers are exempt from some of these duties, including the written risk assessment and the testing, but not from MFA. Healthcare organizations have the HIPAA Security Rule. A Microsoft 365 assessment gives you evidence for the cloud-configuration part of those obligations. It does not make you compliant on its own, and it is not legal advice.

Run ScubaGear yourself, or buy an assessment?

ScubaGear is free and good. If you have an engineer who is comfortable with PowerShell, running it is a sensible first step. The trade-off looks like this:

Self-run tool or fixed-price assessment

• Run ScubaGear yourself: no cash cost; needs an engineer's time; gives raw pass/fail output against one baseline; no manual controls; no judgment about what matters for your business.
• Fixed-price assessment: a known fee by headcount; CIS and SCuBA results side by side; manual controls checked by a person; findings graded and put in fix order; evidence packaged for insurers and customers.
• Day-rate consultancy: open-ended cost; best when you have several tenants, need interviews, or the assessment is part of a wider assurance project.

How to spend less: if you run ScubaGear first and fix the obvious failures, the paid assessment spends its time on the harder items, and your report shows fewer findings.

Access, timeline and contract

The assessment is fully remote, so it does not matter where in the US your offices are.

1. We confirm your band and the fixed fee, normally within one business day.
2. A Global Administrator approves our read-only audit application, which takes about 15 minutes. No account or password is created or shared.
3. Automated checks run in minutes; an engineer then works through the manual controls.
4. The written report arrives 5–7 business days after access is granted, followed by the debrief call.

The application uses read-only Microsoft Graph permissions and can be removed in Entra ID the day the work ends. The full list is in our article on what a read-only Microsoft 365 audit app asks for.

Contracts are usually signed by the Brocent entity in the client's country. Any of our 11 local legal entities can be the contracting party, and the proposal confirms which one. Brocent was founded in Beijing in 2007, is headquartered in Singapore and serves clients in 100+ countries and regions. For on-site and day-to-day support, see IT support in the United States.

Sources

• CISA, BOD 25-01: Implementing Secure Practices for Cloud Services: cisa.gov
• CISA, Secure Cloud Business Applications (SCuBA) project: cisa.gov
• CISA ScubaGear on GitHub: github.com/cisagov/ScubaGear
• FTC, Safeguards Rule: What Your Business Needs to Know: ftc.gov
• HHS, HIPAA Security Rule: hhs.gov
• CIS Microsoft 365 Foundations Benchmark: cisecurity.org

FAQ

How much does a Microsoft 365 security assessment cost?

A fixed one-off fee by headcount, in US dollars and excluding tax: US$450 for 1–10 users, US$990 for 11–25, US$1,800 for 26–75 and US$2,900 for 76–150. Above 150 users we quote a fixed fee. There is no hourly rate.

Is an Office 365 security audit the same thing?

Yes. Office 365 is the older name for the same services. The assessment covers Exchange Online, SharePoint, OneDrive and Teams as well as Entra ID and Defender.

Do we have to follow the CISA SCuBA baselines?

Only federal civilian agencies are bound by BOD 25-01. For a private company the baselines are a free, public reference. We report against them as a cross-check alongside the CIS Benchmark.

Is the assessment enough for our cyber-insurance application?

It gives you dated evidence for the questions insurers ask most often. Each insurer decides what it accepts, so treat the report as support for your answers, not a guarantee of cover.

Do you need admin credentials or access to our email?

No. A Global Administrator approves a read-only application once. The assessment reads configuration and metadata, never mail or documents, and you can remove the application when we finish.

How long does a Microsoft 365 security assessment take?

About 15 minutes to approve access, then 5–7 business days to the written report, followed by a debrief call. There is no site visit.

Do you fix the issues too?

If you want us to. We quote fixes as a fixed fee after the report, and one re-assessment is included when Brocent carries out the fixes.

Your next step: count your licensed users and request a fixed quote on the Microsoft 365 security assessment page. We confirm the band and the fee within one business day.