How to use this checklist
This checklist frames a point-in-time cloud review and a set of controls to monitor continuously. Map each item to a recognized baseline; the CIS Benchmarks (https://www.cisecurity.org/cis-benchmarks) publish provider-specific configuration standards for AWS, Azure, and GCP, and the CIS Controls provide an overarching set of safeguards.
The fastest path to consistent coverage is to run the CIS Benchmark for each provider and treat the deviations as your assessment backlog.
Identity and access management
IAM is the primary control plane in the cloud, so it is the first place to look. The goal is least privilege, strong authentication, and no long-lived static credentials where a managed identity or short-lived token would serve.
- Enforce multi-factor authentication on all human accounts, especially privileged and root or global-administrator accounts.
- Avoid using the root or global-administrator account for daily operations; secure and monitor it.
- Apply least-privilege policies; avoid wildcard permissions and unused broad roles.
- Prefer roles and short-lived credentials over long-lived access keys; rotate and remove unused keys.
Network and storage exposure
Network review confirms that only intended services are reachable and that internal traffic is segmented. Storage review confirms that object stores, disks, and databases are private by default and encrypted.
- Check security groups, firewall rules, and network ACLs for overly broad ingress such as 0.0.0.0/0 on management ports.
- Confirm object storage (S3 buckets, Azure Blob containers, GCS buckets) blocks public access unless explicitly required and justified.
- Verify encryption at rest and in transit for storage, databases, and backups.
- Restrict access to instance metadata services and enforce the hardened version where available.
Logging, monitoring, and detection
Without logging, an incident cannot be investigated. Confirm that provider-native audit logs are enabled across all accounts and regions, protected from tampering, and forwarded somewhere they can be analyzed and alerted on.
- Enable and retain audit logging (CloudTrail, Azure Monitor and Activity Logs, GCP Cloud Audit Logs) across all regions and accounts.
- Protect log integrity with restricted access and, where available, immutable or write-once storage.
- Alert on high-risk events such as IAM policy changes, disabled logging, and root or global-admin usage.
- Confirm logs feed a monitoring or detection capability rather than sitting unread.
Continuous posture management
A single assessment ages quickly in a cloud environment that changes daily. Cloud Security Posture Management (CSPM) tooling continuously evaluates configuration against benchmarks and flags drift, which turns the checklist from a one-time exercise into an ongoing control.
Combine CSPM with infrastructure-as-code scanning so that misconfigurations are caught before deployment, not only after resources are live.
Related
FAQ
What are the CIS Benchmarks?
The CIS Benchmarks are consensus-developed, provider-specific configuration standards published by the Center for Internet Security. They give prescriptive, testable settings for platforms including AWS, Azure, and GCP, and are widely used as the baseline for cloud security assessments.
What is CSPM and why does it matter?
Cloud Security Posture Management continuously evaluates cloud configuration against security baselines and flags drift and misconfiguration. It matters because cloud environments change constantly, so a point-in-time assessment goes stale quickly without continuous monitoring.
What is the single most important cloud control to check first?
Identity and access management. In the cloud, IAM is the primary control plane, so weak authentication, over-privileged roles, and long-lived static credentials tend to produce the highest-impact findings.