Cloud Security Checklist: 25 Essential Controls for Your Organization
Use this comprehensive checklist to audit and improve your cloud security posture. Each control addresses a critical aspect of cloud security.
Identity and Access Management (1-5)
1. Enable Multi-Factor Authentication
MFA should be enabled for all user accounts, especially those with administrative privileges. Use hardware tokens or authenticator apps rather than SMS when possible.
Check: All console users have MFA enabled
2. Implement Least Privilege Access
Users and services should have only the permissions necessary for their functions. Review and revoke unnecessary permissions regularly.
Check: No users have admin/root access by default
3. Use Groups for Permission Management
Assign permissions to groups based on job functions, then add users to groups. This simplifies management and reduces errors.
Check: Permissions are managed through groups, not individual users
4. Secure Root/Admin Accounts
Root accounts should never be used for daily operations. Store credentials securely and enable all available protections.
Check: Root account has MFA, no access keys, and is rarely used
5. Implement Password Policies
Enforce strong passwords with minimum length, complexity requirements, and rotation schedules.
Check: Password policy requires 14+ characters, complexity, and regular rotation
Network Security (6-10)
6. Restrict Default Security Groups
Default security groups should not allow inbound traffic. Create specific groups with minimal required access.
Check: Default security groups have no inbound rules
7. Disable Unnecessary Ports
Only open ports that are required for your applications. Close common attack vectors like RDP (3389) and SSH (22) from the internet.
Check: No unrestricted access to management ports from 0.0.0.0/0
8. Use Private Subnets
Place resources that don't need direct internet access in private subnets. Use NAT gateways for outbound-only access.
Check: Databases and backend services are in private subnets
9. Enable VPC Flow Logs
Flow logs capture network traffic metadata for security analysis and troubleshooting.
Check: VPC flow logs are enabled and stored for at least 90 days
10. Implement Network Segmentation
Separate workloads into different VPCs or subnets based on sensitivity and function.
Check: Production, development, and sensitive workloads are isolated
Data Protection (11-15)
11. Enable Encryption at Rest
All storage services should encrypt data at rest using strong encryption algorithms.
Check: All storage buckets, databases, and volumes are encrypted
12. Enforce Encryption in Transit
Use TLS 1.2 or higher for all data transmission. Disable older protocols.
Check: All endpoints require HTTPS; HTTP is redirected or blocked
13. Implement Key Management
Use managed key services with proper access controls. Enable key rotation.
Check: Customer-managed keys are used for sensitive data with rotation enabled
14. Block Public Access to Storage
Storage buckets should not be publicly accessible unless explicitly required.
Check: Public access is blocked at the account level
15. Enable Versioning and Backups
Protect against accidental deletion and ransomware with versioning and regular backups.
Check: Critical data has versioning enabled and regular backups
Logging and Monitoring (16-20)
16. Enable Cloud Trail/Activity Logging
Log all API calls and management events across all regions.
Check: Audit logging is enabled in all regions
17. Centralize Log Storage
Collect all logs in a central, secure location for analysis and retention.
Check: Logs are stored in a protected, centralized location
18. Configure Security Alerts
Set up alerts for security-relevant events like root login, permission changes, and resource creation.
Check: Alerts exist for critical security events
19. Enable Threat Detection Services
Use cloud-native threat detection services to identify suspicious activities.
Check: GuardDuty, Security Center, or equivalent is enabled
20. Implement Security Dashboards
Create dashboards for security visibility and regular review.
Check: Security metrics are visible and reviewed regularly
Compliance and Governance (21-25)
21. Enable Configuration Compliance
Use tools to continuously monitor resource configurations against security standards.
Check: AWS Config, Azure Policy, or equivalent monitors all resources
22. Tag All Resources
Implement a tagging strategy for ownership, environment, and data classification.
Check: All resources have required tags
23. Implement Service Control Policies
Use organizational policies to restrict what services and regions can be used.
Check: SCPs or equivalent prevent use of unnecessary services
24. Document Security Procedures
Maintain documentation for security configurations, incident response, and operational procedures.
Check: Security documentation is current and accessible
25. Conduct Regular Security Reviews
Schedule regular reviews of security configurations, access, and incidents.
Check: Security reviews occur at least quarterly
Using This Checklist
Review each item quarterly at minimum. Prioritize items based on your risk assessment. Document exceptions and compensating controls where full compliance isn't possible.