What's included
- Assurance frameworks: control libraries, assurance questions, an operating model and RACI tailored to your estate
- Gap analysis: checked against the full estate rather than a sample, with findings ranked by risk
- Landing zone and governance reviews: account and subscription structure, guardrails, logging, identity and key management
- Management reporting: clear updates for CISO and CIO stakeholders, with honest status and owners for each action
Our approach
- Scope. Agree which accounts, subscriptions and services are in scope, and the standard you're measuring against.
- Evidence. Gather configuration and process evidence across the estate.
- Assess. Mark each control present, absent or not determined, and explain why.
- Report. Deliver a prioritised gap analysis and a plan to close the gaps.
Relevant experience
Financial regulator
Designed and delivered a cloud security assurance framework of 113 controls across 14 domains and 206 assurance questions, followed by a detailed gap analysis across the AWS estate.
Frequently asked questions
What is cloud security assurance?
It's independent, evidence-based checking that your cloud environments meet the security standard you've set, whether that's an internal policy, a regulatory expectation or a framework like ISO 27001.
Do you cover both AWS and Azure?
Yes. We work across Amazon Web Services and Microsoft Azure, including landing zones and identity across both.
How long does a cloud assurance review take?
It depends on the size of the estate and the standard you're measuring against. We agree scope and timescales before starting.