Cloud security baseline checklist

Identity

• Phishing-resistant MFA (FIDO2/passkey, Windows Hello for Business or certificate-based) on all privileged roles.
• No standing privileged access; elevation is just-in-time.
• Break-glass accounts documented, monitored and unused routinely.
• No long-lived keys in pipelines; workload identity federation in use.
• Conditional Access exclusions inventoried and justified.

Network and data

• Public endpoints inventoried with a business justification each.
• Private connectivity used for data services.
• Egress controlled for workloads handling sensitive data.
• Encryption keys managed with rotation and access logging.
• Storage exposure scanned continuously.

Detection

• Control-plane audit logs shipped to the SIEM.
• Identity sign-in and privilege change logs ingested.
• Retention exceeds realistic detection lag.
• Detections mapped to the current MITRE ATT&CK Cloud matrix, including the Stealth and Defense Impairment tactics that replaced the former Defense Evasion category.
• Every alert has an owner and a runbook.

Posture

• Policy-as-code guardrails prevent the top misconfigurations.
• Non-production environments are held to production standards where connected.
• Posture findings routed to owning teams.
• Dismissed findings carry recorded justification.
• Hardening baselines checked against the current CIS Foundations Benchmark version for each platform, not an archived copy.