Question 1

Which cloud platforms do you audit?

Accepted Answer

We audit AWS, Azure, and GCP environments. The accounts, subscriptions, regions, services, and control areas included in the engagement are agreed during scoping.

Question 2

Which benchmarks and standards do you use?

Accepted Answer

Most audits use the relevant CIS Benchmark, supplemented by AWS, Azure, or GCP security guidance and any control requirements relevant to the engagement. The benchmark and version are confirmed during scoping.

Question 3

How is the audit performed?

Accepted Answer

We review the cloud configuration and security controls included in the agreed scope, identify affected resources, assess the findings in context, and document the changes that should be prioritized.

Question 4

What access do you need?

Accepted Answer

We typically require a restricted security-audit or read-only role with the permissions needed to inspect the services in scope. We provide the required permissions and access instructions before the audit begins.

Question 5

What does the final report contain?

Accepted Answer

The report includes the audit scope, detailed findings, affected resources, supporting evidence, security context, remediation priorities, and a practical plan for addressing the identified gaps.

Question 6

Can you help remediate the findings?

Accepted Answer

Yes. Cloud hardening and implementation can be scoped separately, including IAM changes, logging and alerting, provider security services, WAF configuration, and other control improvements. Selected controls can also be reassessed after remediation.