Service 02 · Cloud assessment
Is our cloud set up right?
A cloud security assessment reads the configuration of an AWS, Azure or Google Cloud estate against a published control framework and returns a scorecard, the findings with their evidence, and a plan that fits a quarter. This page says what is true outside, what the question means inside, and how the work is put in order.
Start with a measurement Read the sample cloud security assessment
01 / The world outside
The world outside: the part of the cloud that is yours
The cloud providers secure the cloud; the customer secures what is in it. That sentence, the shared responsibility model, is in every provider’s contract, and it means the identities, the logging, the network rules and the data settings of an estate are the organization’s own to get right. Most cloud incidents are not breaches of the provider; they are configurations the customer made or did not make: a storage account reachable from every network, an administrator without multi-factor authentication, logs kept for thirty days with nothing watching them.
The Cloud Security Alliance’s Cloud Controls Matrix, version 4, and the CIS Benchmarks for each provider give the customer-side controls a name and a test. In one assessment on this site, forty-seven checks across identity, logging, data protection and infrastructure produced eighteen findings in an estate of twenty-four subscriptions: the control-plane activity log was not exported to the people watching for attacks, paid threat detection covered four subscriptions of twenty-four, and sixty-four storage accounts answered from any network. None of it was exotic. All of it was visible in an afternoon with read-only access.
02 / The world inside
The world inside: what "set up right" means to the people who set it up
A cloud estate is usually the work of several years and several teams, each of which set things up right for the moment it was in. The executive who asks whether it is set up right now is asking a question nobody inside can answer without discomfort, because the answer is a list of other people’s decisions. The assessment takes the question out of the room: a framework the whole industry agreed on, read against configuration exported from the portal, with the export attached, so a finding is a fact about a setting and not a judgement of a team.
There is also the matter of what the board hears. "We are in the cloud" was once reassurance in itself. The questions now are sharper: who can reach customer data, from where, and would we know. An assessment gives the executive a page that answers those three questions with a score, and a second page that says what the score will be once the first month of the roadmap is done. That is a story a board can follow, and re-measure next year with the same instrument.
03 / Putting it in order
Putting it in order: how the work is done
The assessment begins with read-only roles: a reader on every subscription or account and on the directory, granted for the engagement and removed after it. Configuration is exported through the portal and the command line, never changed. Each check is mapped to the control it evidences and rated pass, fail or partial with the export that proves it; severity is rated by exposure and blast radius, not by a tool’s score, so a detection gap sits below an open door of the same reach and the same blind spot is not counted twice.
What comes back is an executive summary with the posture by domain, a control treemap of every assessed control by score, the scorecard check by check, the findings with the resources concerned, the remediation and the effort, evidence pages with redacted captures and validation steps, and a 30/60/90-day roadmap with the Critical and High items in the first month. The same checks run again at the end of the quarter give the before-and-after the board asked for. A tenant of this size is read in two weeks.
What comes back
- Read-only access defined and removed with the engagement; nothing changed
- An executive summary with the posture by domain and a CSA CCM control treemap
- The scorecard: every check rated pass, fail or partial, with the export that proves it
- Findings with severity, resources, the control, the remediation and the effort
- Evidence pages with redacted captures and the validation steps
- A 30/60/90-day roadmap, and the same checks re-run at the end of the quarter
The work, as delivered
Pages and screens from the samples on this site. Read the sample cloud security assessment.
The executive summary: the posture in one page
The CSA CCM control treemap
A finding: exposure, control, remediation, effort
The 30/60/90-day roadmap
The first step
Tell us which cloud and roughly how many subscriptions or accounts. We answer within one business day with the access we would need and the time it takes.