Free resource
The cloud security checklist we use for every 72-hour audit
A seven-part framework for auditing AWS, Azure, GCP, and multi-cloud environments against SOC 2, ISO 27001, HIPAA, and PCI-DSS. Run it yourself, take the free 5-minute cloud security diagnostic.
Which cloud are you auditing?
Pick a provider and we'll tailor the checklist — highlighting the items and services that matter most for AWS, Azure, or GCP.
1. Identity and access management
Most cloud breaches start with an over-privileged identity. Lock down who and what can reach production before anything else.
- Enforce MFA on every human user, including break-glass and root accounts.
- Replace long-lived access keys with short-lived, role-based credentials (AWS IAM Roles, Azure Managed Identities, GCP Service Accounts with Workload Identity).
- Grant least-privilege permissions and review IAM Access Analyzer / Entra ID access reviews at least quarterly.
- Federate human logins to a single SSO / IdP with SCIM deprovisioning tied to your HRIS.
- Detect and remove unused users, roles, and service principals older than 90 days.
2. Network and perimeter
Assume the perimeter is porous. Segment blast radius and make every network path explicit.
- Block public inbound access on databases, storage buckets, and internal services by default.
- Segment workloads into VPCs / VNets by environment (prod, staging, dev) and by trust boundary.
- Terminate TLS 1.2+ at a managed load balancer or WAF; disable weak ciphers and old protocols.
- Enable flow logs (VPC Flow Logs, NSG flow logs, GCP VPC Flow Logs) and route them to a SIEM.
- Restrict egress with explicit allowlists; alert on unexpected outbound destinations.
3. Data protection and encryption
Encrypt everything by default and prove that the keys, backups, and access trails all line up.
- Encrypt data at rest with customer-managed keys (AWS KMS, Azure Key Vault, GCP KMS) — not just the provider default.
- Enforce TLS in transit for every service and every internal microservice hop.
- Classify sensitive data (PII, PHI, PCI, secrets) and enable DLP scanning on object storage.
- Turn on versioning, object lock, and cross-region backups for critical buckets and databases.
- Test backup restoration at least twice a year — a backup you have never restored is not a backup.
4. Logging, monitoring, and detection
You cannot investigate what you did not log. Centralize signal and alert on the things that matter.
- Enable CloudTrail / Azure Activity Log / GCP Audit Logs across every account and region.
- Ship logs to an immutable, separate security account with 12+ months of retention.
- Turn on GuardDuty / Microsoft Defender for Cloud / Security Command Center and route findings to on-call.
- Alert on IAM changes, security-group changes, root logins, and disabled MFA.
- Run tabletop exercises against your top 3 detections at least once a year.
5. Workload and container security
Harden the things running in your cloud, not just the account around them.
- Patch AMIs, container base images, and managed service versions on a defined SLA (30 days for high, 7 for critical).
- Scan images in CI (Trivy, Snyk, Inspector, Defender) and block deploys on critical vulnerabilities.
- Sign and verify container images before they run in production.
- Run workloads as non-root, with read-only filesystems, and drop unused Linux capabilities.
- Restrict pod-to-pod traffic in Kubernetes with NetworkPolicies or a service mesh.
6. Compliance and governance
SOC 2, ISO 27001, HIPAA, and PCI-DSS auditors will ask for evidence — automate it before they do.
- Map each control (CC6.1, A.9, §164.312, PCI 8.x) to the cloud configuration that satisfies it.
- Use policy-as-code (AWS Config, Azure Policy, GCP Organization Policy, OPA) to enforce baselines.
- Track drift against CIS Benchmarks for AWS, Azure, and GCP.
- Maintain a shared-responsibility matrix by provider — auditors will ask.
- Automate evidence collection with a GRC platform (Vanta, Drata, Secureframe) or scheduled scripts.
7. Incident response readiness
The response plan you write today decides how bad next quarter's incident is.
- Document an incident response runbook per severity tier and store it outside the affected cloud.
- Pre-stage break-glass credentials in a separate account, rotated on a schedule.
- Define RTO and RPO per critical service and validate them against your backup strategy.
- Retain forensic evidence (EBS snapshots, disk images, logs) for at least 90 days after an incident.
- Run a full incident simulation once a year with engineering, legal, and communications in the room.
AWS vs Azure vs GCP: security control comparison
The same control lives under a different name on every cloud. Use this table to translate each checklist item into the native service on AWS, Azure, and GCP before you start your audit.
| Control area | AWS | Azure | GCP |
|---|---|---|---|
| Identity & access | IAM, IAM Identity Center, IAM Access Analyzer | Entra ID, Managed Identities, Access Reviews | Cloud IAM, Workload Identity, Policy Analyzer |
| Network segmentation | VPC, Security Groups, Network Firewall | VNet, NSGs, Azure Firewall | VPC, Firewall Rules, Cloud Armor |
| Encryption & key management | KMS, CloudHSM, Macie (DLP) | Key Vault, Managed HSM, Purview | Cloud KMS, Cloud HSM, DLP API |
| Audit logging | CloudTrail, VPC Flow Logs, CloudWatch Logs | Activity Log, NSG Flow Logs, Monitor | Cloud Audit Logs, VPC Flow Logs, Cloud Logging |
| Threat detection | GuardDuty, Security Hub, Detective | Defender for Cloud, Sentinel | Security Command Center, Chronicle |
| Workload & container security | Inspector, ECR image scanning, Signer | Defender for Containers, ACR scanning | Artifact Registry scanning, Binary Authorization |
| Policy as code | AWS Config, Service Control Policies | Azure Policy, Management Groups | Organization Policy, Config Validator |
| Backup & recovery | AWS Backup, S3 Versioning + Object Lock | Azure Backup, Immutable Blob Storage | Backup and DR Service, Bucket Lock |
| Compliance benchmarks | CIS AWS Benchmark, AWS Audit Manager | CIS Azure Benchmark, Compliance Manager | CIS GCP Benchmark, Assured Workloads |
Service names accurate as of 2026. Feature parity varies — always confirm regional availability and pricing tiers before committing to a provider-specific control.
Frequently asked questions
Common questions about the checklist, its scope, and how it maps to compliance frameworks.
- Who is this cloud security checklist for?
- Engineering leaders, security teams, and founders responsible for AWS, Azure, GCP, or multi-cloud environments — especially teams preparing for SOC 2, ISO 27001, HIPAA, or PCI-DSS audits.
- Does the checklist cover AWS, Azure, and GCP?
- Yes. Every one of the 40+ controls maps to the equivalent service on AWS, Azure, and GCP (for example IAM Roles, Managed Identities, and Workload Identity for short-lived credentials).
- How long does it take to work through the checklist?
- A focused engineer can review all seven sections in about a day. A full remediation pass typically runs two to four weeks depending on cloud footprint and existing controls.
- Is the checklist aligned with SOC 2 and ISO 27001?
- Yes. Each section maps to SOC 2 Common Criteria (CC6, CC7), ISO 27001 Annex A controls, HIPAA §164.312, and PCI-DSS requirements 7, 8, and 10 so you can reuse it as audit evidence.
- Can RAZR run this checklist against our environment?
- Yes. RAZR's certified auditors execute the full framework across AWS, Azure, and GCP and deliver a prioritized findings report in 72 hours. Book a free scoping call from the pricing page.
Want this checklist run against your cloud?
RAZR's certified auditors execute every item above across AWS, Azure, and GCP and deliver a prioritized findings report in 72 hours — with remediation guidance mapped to SOC 2, ISO 27001, HIPAA, and PCI-DSS.