A reusable cloud security audit structure covering governance, identity, configuration, data, monitoring, resilience, suppliers and remediation.
Audit the things that actually cause incidents
Cloud security audit checklists routinely run to hundreds of items, which guarantees they are completed once and never again. In practice, a small number of misconfigurations account for the overwhelming majority of real cloud incidents.
Audit these first, and repeatedly.
The high-value checks
Identity and access
| Check | Why | How often |
|---|---|---|
| MFA on every account, especially root/global admin | Credential compromise is the leading initial access route | Monthly |
| Root/global admin account secured and unused for daily work | Highest-privilege account compromise is unrecoverable | Quarterly |
| No long-lived access keys where roles would work | Leaked keys are a persistent breach source | Monthly |
| Access keys rotated and unused ones removed | Old keys outlive the people who created them | Quarterly |
| Permissions reviewed against actual use | Permission creep is universal | Quarterly |
| Offboarding removes cloud access | Ex-staff access is common and preventable | Per departure |
Storage and data exposure
| Check | Why |
|---|---|
| No public object storage buckets unless deliberately intended | The single most common cause of public data exposure |
| Encryption at rest enabled | Baseline expectation and usually free |
| Encryption in transit enforced | Prevents interception |
| Public snapshots and images checked | An overlooked exposure route |
| Database instances not publicly reachable | Frequently exposed by default in quick setups |
Network
- Security groups without unrestricted inbound (0.0.0.0/0) on management ports — SSH and RDP especially
- Default VPC/VNet not used for production
- Administrative access via bastion, VPN or a zero-trust service rather than open ports
Logging and monitoring
- Audit logging enabled across all regions, not just the one you use
- Logs stored somewhere an attacker cannot delete them
- Alerting on: root account use, IAM policy changes, security group changes, failed authentication spikes
- Log retention meeting your regulatory requirement
Backup and recovery
- Backups exist for everything that matters
- Backups are isolated from production credentials — this is the ransomware control
- A restore has actually been tested. An untested backup is a belief, not a control
- Recovery time objective known and validated
Use the free tooling
Every major cloud provides a built-in posture assessment which is more current than any static checklist:
- AWS Security Hub with the CIS or AWS Foundational Security Best Practices standard
- Microsoft Defender for Cloud Secure Score
- Google Cloud Security Command Center
Run one, work the top findings by severity, and re-run monthly. This is a genuinely better use of time than manually working a spreadsheet, and it catches drift automatically.
A quarterly audit that takes half a day
- Run the native posture tool; export findings
- Review all high and critical items; fix or formally accept with a reason and date
- Review identity: admins, keys, unused accounts, offboarding gaps
- Check public exposure: buckets, databases, security groups
- Confirm logging is on everywhere and alerts are firing
- Test one restore
- Review cloud spend for anomalies — unexpected cost is sometimes the first sign of compromise
- Record what you did, what you found and what you accepted
That final step is what turns activity into evidence. When a customer or auditor asks, a dated record of decisions is the artefact that matters.
What growing businesses consistently miss
- Non-production environments. Dev and staging often hold real data with weaker controls, and are a common entry point.
- Regions you do not use. Attackers create resources in unmonitored regions. Enable logging everywhere.
- Third-party integrations. Tools granted cloud access, never reviewed.
- Infrastructure-as-code drift. What is deployed diverges from what is in the repository.
- Shared credentials in a spreadsheet or chat history.
Frequently asked questions
Do we need a third-party CSPM tool?
Not at first. Native tooling covers most of what matters. Third-party tools earn their cost with multi-cloud estates or when you need consolidated compliance reporting.
How does this relate to ISO 27001 or SOC 2?
These checks map to controls in both. Doing them properly, with records, makes certification substantially easier — the evidence is the same evidence.
What is the single highest-value item?
MFA everywhere, followed by verifying no storage is unintentionally public, followed by an actually-tested backup restore.