Cloud Security Configuration Assessment

Flow chart of the Cloud Security Configuration Assessment engagement, 6 phases in order, each one selectable. Phase 1, Scoping and Baseline Selection. We agree which accounts, subscriptions and projects are in scope, and pick the right CIS Foundations Benchmark version for each provider. We confirm read-only access and any regions or services to exclude. Activities: Inventory in-scope AWS accounts, Azure subscriptions and GCP projects; Select the matching CIS Foundations Benchmark version per provider; Provision read-only assessor roles and confirm access; Agree excluded regions, services and maintenance windows. Hands over Scope and Baseline Agreement with Read-Only Access Confirmed. Phase 2, Evidence and Config Collection. Using read-only roles we pull configuration across IAM, networking, storage, logging and compute. We snapshot the state so findings are reproducible and tied to evidence. Activities: Export IAM users, roles, policies and key age data; Capture security group, NACL and VPC peering configuration; Record storage bucket ACLs, encryption and public access settings; Snapshot CloudTrail, Azure Monitor and GCP audit log settings. Hands over Timestamped Configuration Evidence Set. Phase 3, Benchmark Comparison. We run automated checks with ScoutSuite, Prowler and provider-native tooling, then map results to CIS controls and your own policy where you have one. Activities: Run Prowler and ScoutSuite across every in-scope account; Pull findings from Security Hub and Defender for Cloud; Map each result to its CIS Foundations control number; Flag deviations from your own internal cloud policy. Hands over Draft CIS Benchmark Scorecard. Phase 4, Manual Review of Risky Settings. We manually verify the high-impact items: public exposure, over-broad IAM, missing encryption, and gaps in logging. This filters false positives and catches issues benchmarks miss. Activities: Confirm which buckets and endpoints are reachable from the internet; Trace wildcard IAM permissions and privilege escalation paths; Check encryption at rest and key rotation on data stores; Verify MFA and conditional access on privileged identities; Discard false positives with a documented reason. Hands over Validated Exposure List. Phase 5, Prioritised Findings. Each finding is rated by real exposure and blast radius, with the affected resources listed so your team can act without hunting. Activities: Rate each finding by exposure and blast radius; List affected resource ARNs and IDs per finding; Group findings by owning team and account; Walk the engineering team through the top items. Hands over Cloud Configuration Findings Report. Phase 6, Remediation and Re-Check. We hand over fix guidance mapped to each control, then re-run the checks after your changes to confirm the scorecard has moved. Activities: Write fix steps and Terraform snippets per control; Support your team through the change windows; Re-run Prowler and ScoutSuite after the fixes land; Reissue the scorecard showing the movement. Hands over Re-Check Report and Updated Scorecard. Each phase begins from the artefact the phase before it produced.