Cloud Security Assessment

A review of identity, configuration, logging, and recovery controls in AWS and Azure, mapped to the shared responsibility model.

Our work is advisory. We don't perform financial statement audits or provide attest services.

Know which side of the cloud is yours, and whether it's covered.

The challenge

Your cloud provider se­cures part of the stack and you se­cure the rest, and the di­vid­ing line moves from one ser­vice to the next. Most cloud in­ci­dents don't start with a so­phis­ti­cat­ed at­tack. They start with a stor­age buck­et left open, an ac­cess key that never ex­pired, or log­ging that was switched off to save money.

How we help

We re­view your AWS and Azure en­vi­ron­ments the way a con­trol as­ses­sor would. Is each risk ad­dressed, and can you show the con­trol op­er­ates? We look at iden­ti­ty and ac­cess, in­clud­ing ad­min­is­tra­tor ac­counts, roles, and keys. We also re­view se­cure con­fig­u­ra­tion of stor­age, net­work­ing, and com­pute, log­ging and mon­i­tor­ing, en­cryp­tion and key man­age­ment, and back­up and re­cov­ery.

We map each find­ing to the shared re­spon­si­bil­i­ty model, so you can see which gaps are yours to close and which de­pend on the provider's own con­trols and ev­i­dence. Findings are ranked by busi­ness im­pact, with fixes your cloud team can apply and a short sum­ma­ry for lead­er­ship.

What you get

  • Cloud identity and access review: roles, privileged accounts, keys, and federation
  • Secure configuration review for storage, network, and compute services
  • Logging, monitoring, and alerting coverage
  • Encryption and key management review
  • Cloud backup, recovery, and resilience review
  • Findings mapped to the shared responsibility model and ranked by impact

Standards we work with: The CSA Cloud Controls Matrix, CIS Benchmarks for AWS and Azure, NIST CSF 2.0, and ISO/IEC 27017.

This is a con­trol as­sess­ment, not a pen­e­tra­tion test. We re­view con­fig­u­ra­tions and ev­i­dence. We don't at­tack your en­vi­ron­ment.

Good fit if crit­i­cal work­loads have moved to the cloud and no­body is sure who con­trols what, or a cus­tomer has asked how your cloud en­vi­ron­ment is se­cured.

Questions clients ask

Do you need administrator access to our cloud accounts?

No. We agree the access method during scoping. Read-only access, configuration exports, and walkthroughs with your cloud team are usually enough.

How is this different from a cloud risk assessment?

A cloud risk assessment, part of our Governance, Risk & Compliance work, identifies and rates the risks in how you use the cloud. This assessment tests whether the security controls in your environment are configured and operating.

More in IT & Cybersecurity Audit Advisory

Risk-Based and Co-Sourced IT Audit

IT audit planned around your critical systems and obligations, delivered as a full outsourced function or as added capacity inside your own team.

  • A risk-based IT audit plan tied to critical systems and obligations
  • Co-sourced or outsourced delivery within your methodology
  • Workpapers built to stand up to review by your external auditors
Learn more about Risk-Based and Co-Sourced IT Audit

ITGC Testing

Design and operating effectiveness testing of IT general controls over logical access, change management, IT operations, and backup and recovery.

  • Logical and privileged access testing
  • Change management and segregation of duties
  • IT operations, job scheduling, and backup and recovery
Explore about ITGC Testing

Application Control and Key Report Testing

Testing of the automated controls inside your applications, the interfaces between them, and the system reports (IPE) people use as evidence.

  • Automated calculations, edit checks, and configurations
  • Interface completeness and accuracy
  • Key report (IPE) completeness and accuracy testing
Learn more about Application Control and Key Report Testing

SOX IT Controls Support

Support for management and internal audit across SOX IT scoping, control design, walkthroughs, testing, and remediation.

  • IT scoping and risk and control matrix design
  • Walkthroughs and control testing
  • Deficiency remediation support
Learn more about SOX IT Controls Support

Cybersecurity Program Assessment

An assessment of your security program against NIST CSF 2.0, ISO/IEC 27001, or CIS Controls, with findings ranked by business impact.

  • Control and maturity assessment against your chosen framework
  • Vulnerability, patch, and configuration management review
  • A prioritized roadmap with a summary for the CIO, CISO, and board
Learn more about Cybersecurity Program Assessment

Identity and Access Management Review

An enterprise-wide review of how identities are created, reviewed, and removed, with a focus on privileged accounts and joiner, mover, and leaver controls.

  • Joiner, mover, and leaver process review
  • Privileged access management review
  • User access review quality and coverage
Learn more about Identity and Access Management Review

Ransomware Readiness Assessment

A review of whether you could detect, contain, and recover from ransomware, starting with backups you have actually restored.

  • Backup isolation and restore testing review
  • Incident response plan and tabletop readiness
  • Recovery priorities for critical systems
Learn more about Ransomware Readiness Assessment

View All Services

Ways to work with us

Project engagements

A defined scope, timeline, and deliverable, such as an IT review, an AI governance build, or a remediation plan.

Advisory support

Ongoing access to senior guidance as your program, systems, and regulators change.

Audit capacity support

Added hands and specialist skill for your internal audit or risk team, working under your direction.

Training programs

Workshops and cohorts for your team, delivered on a schedule that suits you.

How we engage

  1. Discovery

    A short call to understand your situation.

  2. Scoping

    A written scope with deliverables, timing, and fees.

  3. Delivery

    Regular check-ins and findings you can read in one sitting.

  4. Follow-up

    A review of progress, plus support for what comes next.

Common questions

Are you a CPA firm?

No. We're a risk and tech­nol­o­gy ad­vi­so­ry firm. We don't per­form fi­nan­cial state­ment au­dits or issue audit opin­ions.

Can you help us prepare for SOC 2 or a similar report?

Yes, on the readi­ness side: gap as­sess­ment, con­trol de­sign, and ev­i­dence prepa­ra­tion. The re­port it­self must come from a li­censed CPA firm.

Do you work with our internal and external auditors?

Yes. We co­or­di­nate with in­ter­nal audit, your ex­ter­nal au­di­tors, and your com­pli­ance team so work isn't du­pli­cat­ed.

How long does an engagement take?

It de­pends on scope. After a scop­ing call, you'll get a time­line in writ­ing.

What size organizations do you work with?

Mid-mar­ket and en­ter­prise or­ga­ni­za­tions across in­dus­tries.

Will you keep our information confidential?

Yes. We'll sign an NDA be­fore you share sen­si­tive de­tails.

Can you assess an AI program you helped design?

No. We don't audit or as­sess an AI pro­gram, sys­tem, or use case we de­signed for the same client. If an en­gage­ment would cross that line, we'll tell you dur­ing scop­ing.

Is this legal advice?

No. We sup­port reg­u­la­to­ry align­ment from a risk and con­trols per­spec­tive. For legal ques­tions, work with coun­sel.

Not sure which service fits?

Describe the problem. We'll tell you where to start.

Talk to an Advisor