HockeyGear - Canada's Answer to CISA's ScubaGear

-

 Hey there fellow Canadian! Do you happen to run a tenant? Perhaps you've heard of or even used ScubaGear before? Maybe you've wondered if there was a way to test your tenant against Government of Canada guidelines? Well, so did I. If Cybersecurity and Infrastructure Security Agency could have a dedicated application for testing Microsoft 365 tenants against governement security standards, then why shouldn't Canada? Hence, I introduce to you the Canuck equivalent: HockeyGear.

What Exactly Is HockeyGear?

HockeyGear is a Microsoft 365 tenant protection toolkit built specifically with Canadian public‑sector realities in mind. It audits, hardens, and reports against the same standards federal departments are expected to follow: ITSG‑33, the GC Cloud Guardrails, and CCCS Microsoft 365 guidance. In other words, it gives Canadian administrators a way to validate their cloud posture against the rules that actually apply to them, not just generic best practices.

If you’ve ever tried to map CISA’s ScubaGear output to Canadian requirements, you already know the pain: different terminology, different controls, different expectations. HockeyGear closes that gap by providing a purpose‑built assessment aligned to Canadian cybersecurity doctrine.

Why I Built It

I’ve spent years managing tenants, supporting cloud migrations, and helping teams interpret government security requirements. One pattern kept repeating: Admins weren’t lacking effort; they were lacking tools.

ScubaGear proved that automated tenant assessments could be both accessible and powerful. But Canada needed its own version; one that speaks our language, reflects our standards, and supports our institutions. HockeyGear is my attempt to give Canadian admins something that feels familiar, practical, and proudly homegrown.

What You Can Do With HockeyGear

  • Run automated audits against Canadian government cloud security expectations
  • Generate reports that map findings directly to ITSG‑33 and GC Guardrails
  • Identify misconfigurations before they become incidents
  • Harden your tenant using actionable, Canada‑specific recommendations
  • Support compliance teams with evidence‑based output they can actually use

Whether you’re in federal, provincial, municipal, education, healthcare, or simply a Canadian organization that wants to follow strong national guidance, HockeyGear gives you a structured way to validate your Microsoft 365 environment.

How It Works

HockeyGear follows a simple idea: make Canadian‑aligned tenant assessments easy, repeatable, and trustworthy. Under the hood, it uses a structured workflow that mirrors how security teams already think about cloud posture.

1. Connect to Your Tenant Securely

HockeyGear uses Microsoft’s official Graph API endpoints to gather configuration data from your Microsoft 365 tenant. No hacks, no workarounds just clean, supported API calls that respect least‑privilege principles.

2. Collect the Right Signals

Instead of pulling everything under the sun, HockeyGear focuses on the controls that matter for Canadian organizations. It gathers configuration details across:

  • Identity & access management
  • Conditional access
  • Exchange Online
  • SharePoint & OneDrive
  • Teams
  • Security defaults
  • Logging & monitoring
  • Compliance settings

This keeps the assessment focused, fast, and aligned with Canadian guidance.

3. Map Findings to Canadian Standards

This is where HockeyGear separates itself from generic tools. Every finding is mapped directly to:

  • ITSG‑33 controls
  • GC Cloud Guardrails
  • CCCS Microsoft 365 guidance

The output doesn’t just tell you what is misconfigured it tells you why it matters in a Canadian context.

4. Generate a Clear, Actionable Report

The toolkit produces a structured report that highlights:

  • Passed controls
  • Failed controls
  • Items requiring review
  • Recommended remediation steps
  • Relevant Canadian policy references

This makes it easy for admins, auditors, and security teams to understand the current posture and plan next steps.

5. Improve, Iterate, Repeat

Because HockeyGear is open source, organizations can:

  • Extend the assessment
  • Add custom controls
  • Integrate it into CI/CD pipelines
  • Automate recurring posture checks

It’s built to grow with your environment and with the Canadian cloud community.

Article content
Article content

Open Source, Transparent, and Built for the Community

HockeyGear is fully open source and available on GitHub. That means you can inspect the code, contribute improvements, fork it for your own environment, or simply use it as‑is. My goal is to build a community around Canadian cloud security- a place where admins can share ideas, raise issues, and help shape the future of the toolkit.

If ScubaGear can support an entire nation’s cloud posture, there’s no reason HockeyGear can’t do the same here.

A Call to Canadian Admins

If you manage a tenant in Canada, I’d love for you to try HockeyGear, break it, improve it, and help it grow. The more eyes and hands on it, the stronger it becomes, and the more secure our collective cloud footprint will be.

Canada deserves tools built for Canadians. HockeyGear is my contribution to that mission. Let me know your thoughts Communications Security Establishment Canada | Centre de la sécurité des télécommunications Canada and same with you!

Until next time, admins!

Comments

Post a Comment

Popular posts from this blog

Using Power Automate to Update Contact Information

-
 We've all been there- you have a large organization who has out-of-date contact information. What do you do? You could go around to each department and ask them nicely to update their information, or send out an org-wide email prompting people to do so. However, this is tedious and oftentimes a pointless task. By the time you update one department, you're running to fix another. What if you could put the power back in the department's hands to do so? This is a struggle I faced recently as I was trying to find was I could conjure up some updated contact information for each department. As I did my research, I found that I was not alone in this endeavour as it seems that many IT professionals would love to make this process a little bit less painful. With this in mind, I introduce to you my latest flow! This flow will allow you to encourage users to update their contact information, without the overhead that comes with manual effort. In addition to this, this flow utilizes t...
Read more

Using Custom Connectors and Microsoft Graph API's to Manage Licenses in Power Automate - Part One

-
Happy June folks! I come to you with another post, but this time I wanted to change it up and show you something else I have just finished working on. As a SysAdmin, one of the most common issues we run into is managing licenses. Working at a post-secondary institution makes this an even greater challenge, as you have both students, staff and faculty constantly coming as well as going. Managing to keep up with this constant change can introduce great administrative overhead which takes away time from important upkeep of other systems and initiatives. You may also notice this same issue in large corporations or in other government organizations. To help combat this, I wanted to create a flow that can do the following: Get the user and their licenses Determine their last sign-in and the date Conditional to determine if the user is past the "cutoff" date Remove the user from a group where the license is assigned The only problem with doing this is that Power Automate does not ha...
Read more

Using Custom Connectors and Microsoft Graph API's to Manage Licenses in Power Automate - Part Two

-
Hello again! Didn't I promise you that I'd be back to wrap this up? Well, here I am to give you the second tidbit of information that you need to get this started. If you haven't already, take a look at my previous post where I go into depth about creating a custom connector in Power Automate to retrieve the latest sign-in and also gather the user's licenses. Now that we have the custom connector ready, we can now get into the meat n' potatoes of this series. In this post, I will show you the flow that makes this possible and how you can use the custom connector you have created to tie it all together! Hope you enjoy. Understanding the Logic Before we can begin creating the flow, we should first understand how the flow will work. I designed this to flow to be triggered manually, but you may want to schedule it or use another trigger. The trigger will depend on your organization's policies, so please adjust accordingly. Once triggered, the flow will use the Entra...
Read more