The Cybersecurity and Infrastructure Security Agency issued a request for comment on its proposed configuration baselines for the Secure Cloud Business Applications, or SCuBA, Google Workspace, a.k.a. GWS, for federal agencies.

The secure configuration baselines were unveiled alongside an assessment tool called ScubaGoggles, which aims to help agencies procure GWS environments for IT defense upgrades, CISA said Tuesday.

The draft GWS baselines were developed from lessons learned from the SCuBA Microsoft 365 baselines. The new recommendations were designed in collaboration with Google in the hopes of strengthening sensitive data protection and reducing misconfigurations.

The baselines are customized for nine GWS services, such Google Chat, Calendar, Drive and Docs, Classroom, Meet, Gmail and Groups for Business. They are also applicable to Google sites and common controls.

The agency will wait for feedback until Jan. 12. At the same time, it is also inviting government departments to participate in the validation and enhancement of the recommended starting points.

The National Security Agency has released a new report outlining recommendations for mitigating security risks associated with software-defined networking controllers, also known as SDNCs.

NSA said Tuesday SDNCs work as a centralized network management server to control access to applications, making them a high-priority target for cyberthreat actors looking to gain control of an entire network environment.

“Although convenient for network administrators, they can become a single point of failure and a high priority target for malicious cyber actors if not secured properly,” said Ryan Larson, technical director for system threats and vulnerability analysis at NSA.

To reduce vulnerability to compromise, the agency recommended that organizations control access to the SDNC management interface, prevent viewing of sensitive information in network traffic, protect critical data at rest and only allow the authorized SDN controller to configure network devices.

Organizations must also restrict unauthorized or unauthenticated network devices from joining the SDN environment and control access to SDNC application programming interfaces.

The Department of Justice has issued guidelines detailing the process companies may use to ask DOJ to delay disclosures of material cybersecurity incidents required by the Securities and Exchange Commission.

DOJ said Tuesday a company may delay disclosing the cyber incident in Item 1.05 of Form 8-K if the U.S. Attorney General determines that such a move would pose a risk to public safety or national security.

In July, SEC implemented rules directing public companies to divulge material cybersecurity incidents and report annually material information on cybersecurity strategy, risk management and governance.

According to the DOJ guidelines, when a registrant thinks that a disclosure may pose a risk to national security or public safety, the organization should immediately contact the FBI in accordance with the bureau’s reporting instructions.

The document also outlines procedures for U.S. government agencies to follow when an exception to the general disclosure requirement might apply.