Cloud Compliance Checklist: Verify Controls That Actually Work

Understanding the Shared Responsibility Trap

Compliance in the cloud is rarely about the infrastructure itself. The provider secures the hardware, the hypervisor, and the physical data centre. You secure everything above that line. This division creates a blind spot. Many teams assume that because the provider is compliant, their workload is automatically compliant. This assumption is incorrect.

The provider’s compliance covers the platform. Your compliance covers the configuration, the data, and the access controls. If you leave a storage bucket open to the internet, the provider’s security certification does not protect you. You must map your obligations to specific technical controls.

This checklist targets the controls that most often fail during audits. It focuses on identity, data, and visibility. Use it to verify that your environment matches your security policy, not just your provider’s default settings.

Identity and Access Boundaries

Identity is the perimeter in cloud environments. Traditional firewalls are less effective because workloads move dynamically. You must treat every service account and application identity with the same scrutiny as a human user.

• Enforce multi-factor authentication for all administrative access: Prevents credential theft from granting immediate full control.
• Implement role-based access control with least privilege: Limits the blast radius if an identity is compromised.
• Review and remove unused service accounts: Reduces the attack surface by eliminating dormant entry points.
• Require just-in-time access for privileged operations: Ensures high-level access is only available when actively needed.
• Audit cross-account permissions regularly: Prevents lateral movement between isolated environments.

See the guide on identity as the new perimeter for deeper strategies on managing federated identities.

Data Protection and Key Management

Encryption is mandatory, but it is not sufficient. You must control who holds the keys. If the cloud provider manages the keys by default, they can access your data. This may violate specific regulatory requirements or internal governance policies.

• Encrypt all data at rest using customer-managed keys: Ensures you retain control over decryption capabilities.
• Encrypt all data in transit using modern protocols: Prevents eavesdropping on data moving between services.
• Disable default encryption keys for new resources: Forces explicit key selection and prevents lazy configuration.
• Implement key rotation policies automatically: Limits the exposure window if a key is compromised.
• Restrict key usage to specific resources only: Prevents a compromised key from decrypting unrelated data.

Refer to cloud key management services for details on isolating cryptographic operations.

Visibility and Audit Integrity

You cannot comply with what you cannot see. Cloud environments generate massive amounts of log data. However, raw logs are useless if they can be tampered with or if they miss critical events. Your logging strategy must ensure integrity and completeness.

• Centralize logs to an immutable storage destination: Prevents attackers from deleting evidence of their activity.
• Enable logging for all API calls and management actions: Creates a complete trail of configuration changes.
• Monitor for anomalous login locations and times: Detects compromised credentials before they cause damage.
• Verify log delivery completeness regularly: Ensures no data is silently dropped due to pipeline failures.
• Alert on permission changes to logging configurations: Detects attempts to blind your monitoring systems.

Check cloud logging gaps to identify common blind spots in your telemetry.

Configuration and Infrastructure Security

Misconfiguration is the leading cause of cloud breaches. Compliance requires proving that your infrastructure matches your intended state. Drift occurs when manual changes or automated processes alter settings over time.

• Implement infrastructure as code for all resources: Ensures configurations are version-controlled and reproducible.
• Scan for public-facing endpoints automatically: Identifies accidental exposure of databases or management consoles.
• Enforce network segmentation between tiers: Limits lateral movement within the environment.
• Use cloud landing zones to enforce baseline security: Provides a secure foundation for new workloads.
• Validate configurations against compliance benchmarks regularly: Catches drift before it becomes a violation.

See cloud landing zones for architectural patterns that enforce security at scale.

See also: Identity as the New Perimeter: Why Firewalls No Longer Define Security · Cloud Shared Responsibility Model: Who Fixes What

Application and API Security

Modern applications rely on APIs. Insecure APIs are a major vector for data breaches. Your compliance posture must include verification that your application interfaces are secure and monitored.

• Authenticate all API endpoints consistently: Prevents unauthorised access to application data.
• Rate-limit public-facing APIs: Mitigates denial-of-service attacks and brute-force attempts.
• Validate input on all API parameters: Prevents injection attacks and malformed data processing.
• Monitor API usage patterns for anomalies: Detects automated scraping or abuse.
• Document and version all API changes: Ensures clients adapt to security updates.

Read about insecure cloud APIs to understand common implementation flaws.

Continuous Verification and Remediation

Compliance is not a one-time event. It is a continuous process. Environments change, new threats emerge, and regulations evolve. Your checklist must be part of an automated workflow.

• Automate compliance checks in the CI/CD pipeline: Prevents non-compliant code from reaching production.
• Define remediation playbooks for common violations: Speeds up response to configuration drift.
• Review compliance reports with stakeholders monthly: Keeps security aligned with business objectives.
• Test incident response procedures regularly: Ensures you can act quickly during a breach.
• Update controls based on new threat intelligence: Adapts your defence to evolving attack methods.

Consider SaaS security posture management for visibility into third-party applications.

Key takeaways

• Identity controls must enforce least privilege across all service accounts, not just human users.
• Encryption keys should be managed outside the cloud provider’s default scope to maintain true data sovereignty.
• Logging pipelines require integrity checks to ensure audit trails cannot be silently altered by attackers.

Frequently asked questions

How often should I run this checklist?

Automate the checks to run continuously. Manual reviews should happen monthly to assess trends and policy alignment.

Does this apply to hybrid cloud environments?

Yes. The principles of identity, data protection, and logging apply regardless of where the workload resides.

What if I am using a managed service?

You are still responsible for access controls and data configuration. The provider handles the underlying infrastructure security.

How do I handle legacy applications?

Isolate them in separate network segments and enforce strict API gateways until they can be refactored.

How this guide was produced: written by the Malware Brief editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.