# Is our cloud set up right?

> Is our cloud set up right? AWS, Azure and Google Cloud reviewed for identity, posture and data exposure, against the CSA Cloud Controls Matrix, returned as a remediation plan.

Service: Cloud assessment. Human page: https://n30.ai/services/cloud-assessment/. This file: https://n30.ai/services/cloud-assessment/index.md.

A cloud security assessment reads the configuration of an AWS, Azure or Google Cloud estate against a published control framework and returns a scorecard, the findings with their evidence, and a plan that fits a quarter. This page says what is true outside, what the question means inside, and how the work is put in order.

## The world outside: the part of the cloud that is yours

*01 / The world outside*

The cloud providers secure the cloud; the customer secures what is in it. That sentence, the shared responsibility model, is in every provider’s contract, and it means the identities, the logging, the network rules and the data settings of an estate are the organization’s own to get right. Most cloud incidents are not breaches of the provider; they are configurations the customer made or did not make: a storage account reachable from every network, an administrator without multi-factor authentication, logs kept for thirty days with nothing watching them.

The Cloud Security Alliance’s Cloud Controls Matrix, version 4, and the CIS Benchmarks for each provider give the customer-side controls a name and a test. In one assessment on this site, forty-seven checks across identity, logging, data protection and infrastructure produced eighteen findings in an estate of twenty-four subscriptions: the control-plane activity log was not exported to the people watching for attacks, paid threat detection covered four subscriptions of twenty-four, and sixty-four storage accounts answered from any network. None of it was exotic. All of it was visible in an afternoon with read-only access.

## The world inside: what "set up right" means to the people who set it up

*02 / The world inside*

A cloud estate is usually the work of several years and several teams, each of which set things up right for the moment it was in. The executive who asks whether it is set up right now is asking a question nobody inside can answer without discomfort, because the answer is a list of other people’s decisions. The assessment takes the question out of the room: a framework the whole industry agreed on, read against configuration exported from the portal, with the export attached, so a finding is a fact about a setting and not a judgement of a team.

There is also the matter of what the board hears. "We are in the cloud" was once reassurance in itself. The questions now are sharper: who can reach customer data, from where, and would we know. An assessment gives the executive a page that answers those three questions with a score, and a second page that says what the score will be once the first month of the roadmap is done. That is a story a board can follow, and re-measure next year with the same instrument.

## Putting it in order: how the work is done

*03 / Putting it in order*

The assessment begins with read-only roles: a reader on every subscription or account and on the directory, granted for the engagement and removed after it. Configuration is exported through the portal and the command line, never changed. Each check is mapped to the control it evidences and rated pass, fail or partial with the export that proves it; severity is rated by exposure and blast radius, not by a tool’s score, so a detection gap sits below an open door of the same reach and the same blind spot is not counted twice.

What comes back is an executive summary with the posture by domain, a control treemap of every assessed control by score, the scorecard check by check, the findings with the resources concerned, the remediation and the effort, evidence pages with redacted captures and validation steps, and a 30/60/90-day roadmap with the Critical and High items in the first month. The same checks run again at the end of the quarter give the before-and-after the board asked for. A tenant of this size is read in two weeks.

## What comes back

1. Read-only access defined and removed with the engagement; nothing changed
2. An executive summary with the posture by domain and a CSA CCM control treemap
3. The scorecard: every check rated pass, fail or partial, with the export that proves it
4. Findings with severity, resources, the control, the remediation and the effort
5. Evidence pages with redacted captures and the validation steps
6. A 30/60/90-day roadmap, and the same checks re-run at the end of the quarter

## The standards

- CSA Cloud Controls Matrix v4: The customer-side controls: identity, logging, data security, infrastructure
- CIS Benchmarks: Per-provider configuration baselines for AWS, Azure and Google Cloud
- The shared responsibility model: What the provider secures and what the customer must; the assessment covers the latter

## The work, as delivered

- The executive summary: the posture in one page: https://n30.ai/reports/azure-baseline-cloud-security-assessment/p03.jpg
- The CSA CCM control treemap: https://n30.ai/reports/azure-baseline-cloud-security-assessment/p04.jpg
- A finding: exposure, control, remediation, effort: https://n30.ai/reports/azure-baseline-cloud-security-assessment/p10.jpg
- The 30/60/90-day roadmap: https://n30.ai/reports/azure-baseline-cloud-security-assessment/p42.jpg
Read the sample cloud security assessment: https://n30.ai/reports/azure-baseline-cloud-security-assessment/

## The first step

Tell us which cloud and roughly how many subscriptions or accounts. We answer within one business day with the access we would need and the time it takes. Start with a measurement: https://n30.ai/#contact