Cloud Governance Checklist: 50 Controls for Audit-Ready Cloud Environments
Every control organized by governance pillar, mapped to compliance frameworks, and prioritized by impact. Print this page or bookmark it as your governance audit reference.
Identity and Access (10 Controls)
✓Enforce MFA for all IAM usersMust-have
Why: MFA blocks 99.9% of automated credential attacks
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Easy
Tooling: Native IAM
✓Implement least privilege access policiesMust-have
Why: Over-privileged accounts are the primary vector for lateral movement
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Medium
Tooling: CIEM, IAM Access Analyzer
✓Disable root/admin account for daily operationsMust-have
Why: Root accounts bypass all policies and cannot be scoped
Frameworks: SOC 2, ISO, PCI
Difficulty: Easy
Tooling: Native IAM
✓Implement service account rotation (90-day max)Must-have
Why: Static service account keys are the most common credential exposure
Frameworks: SOC 2, ISO, PCI
Difficulty: Medium
Tooling: Secrets manager, CIEM
✓Configure just-in-time access for productionShould-have
Why: Standing access to production is unnecessary 95% of the time
Frameworks: SOC 2, ISO, HIPAA
Difficulty: Hard
Tooling: CIEM, PAM platforms
✓Federate identity through SSO/SCIMShould-have
Why: Centralized identity reduces offboarding risk from hours to seconds
Frameworks: SOC 2, ISO, HIPAA
Difficulty: Medium
Tooling: Okta, Azure AD, Google Workspace
✓Conduct quarterly access reviewsMust-have
Why: Permission creep is inevitable without periodic review
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Medium
Tooling: CIEM, GRC platforms
✓Block cross-account role assumption without MFAShould-have
Why: Cross-account access without MFA is a privilege escalation path
Frameworks: SOC 2, ISO
Difficulty: Easy
Tooling: SCPs, Azure Policy
✓Monitor and alert on privilege escalationMust-have
Why: Privilege escalation is the first step in most attack chains
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Medium
Tooling: CSPM, SIEM
✓Maintain an identity inventory with ownershipShould-have
Why: You cannot secure identities you do not know about
Frameworks: SOC 2, ISO
Difficulty: Easy
Tooling: CIEM, asset inventory
Resource and Tagging (8 Controls)
✓Enforce mandatory tags on all resourcesMust-have
Why: Untagged resources cannot be allocated, scoped, or governed
Frameworks: SOC 2, ISO
Difficulty: Medium
Tooling: Tag policies, Azure Policy, Org Policy
✓Implement naming convention standardsShould-have
Why: Consistent naming enables automated operations and reduces human error
Frameworks: SOC 2
Difficulty: Easy
Tooling: Policy-as-code
✓Block resource creation without required tagsMust-have
Why: Retroactive tagging has under 60% compliance; preventive enforcement is the only reliable path
Frameworks: SOC 2
Difficulty: Medium
Tooling: SCPs, Azure Policy deny
✓Monitor tag compliance with weekly reportsShould-have
Why: Tag drift is continuous; monitoring catches automation gaps
Frameworks: SOC 2
Difficulty: Easy
Tooling: AWS Config, Azure Policy compliance
✓Detect and flag orphaned resourcesShould-have
Why: Orphaned resources waste money and expand attack surface
Frameworks: SOC 2
Difficulty: Medium
Tooling: CSPM, custom automation
✓Maintain a cloud asset inventoryMust-have
Why: Foundational for incident response, compliance scoping, and cost attribution
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Easy
Tooling: Cloud Asset Inventory, CSPM
✓Implement environment tags (prod/staging/dev)Must-have
Why: Environment classification drives security policy and compliance scope
Frameworks: SOC 2, ISO, PCI
Difficulty: Easy
Tooling: Tag policies
✓Assign cost center or team owner to every resourceShould-have
Why: Cost attribution requires owner metadata on every resource
Frameworks: SOC 2
Difficulty: Medium
Tooling: Tag policies, FinOps platforms
Security Posture (12 Controls)
✓Enable CSPM scanning across all accountsMust-have
Why: Misconfiguration is the leading cause of cloud breaches
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Easy
Tooling: Security Hub, Defender, SCC, Wiz, Orca
✓Enforce encryption at rest for all storageMust-have
Why: Unencrypted data at rest is a compliance failure and breach risk
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Easy
Tooling: SCPs, Azure Policy, CSPM
✓Enforce encryption in transit (TLS 1.2+)Must-have
Why: Unencrypted network traffic exposes data to interception
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Easy
Tooling: SCPs, Azure Policy
✓Block public access to storage buckets/accountsMust-have
Why: Public storage is the most common source of large-scale data exposure
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Easy
Tooling: S3 Block Public Access, Azure storage firewall
✓Enable VPC flow logs / NSG flow logsShould-have
Why: Network traffic visibility is essential for incident investigation
Frameworks: SOC 2, ISO, PCI
Difficulty: Easy
Tooling: Native networking
✓Implement network segmentationShould-have
Why: Flat networks allow lateral movement from any compromised resource
Frameworks: ISO, PCI
Difficulty: Hard
Tooling: VPC, NSG, VPC Service Controls
✓Run vulnerability scanning on all computeMust-have
Why: Known vulnerabilities are the easiest attack vector to exploit
Frameworks: SOC 2, ISO, PCI
Difficulty: Medium
Tooling: CSPM, Inspector, Defender
✓Configure drift detection for infrastructureShould-have
Why: Manual changes to IaC-managed resources create security gaps
Frameworks: SOC 2, ISO
Difficulty: Medium
Tooling: Terraform state drift, CSPM
✓Implement IaC scanning in CI/CDShould-have
Why: Catch misconfigurations before deployment, not after
Frameworks: SOC 2, ISO
Difficulty: Medium
Tooling: Checkov, Terrascan, tfsec
✓Set SLAs for critical finding remediationMust-have
Why: Without SLAs, findings accumulate and lose urgency
Frameworks: SOC 2, ISO, PCI
Difficulty: Easy
Tooling: CSPM, ticketing integration
✓Block deployment of non-compliant imagesShould-have
Why: Container images with known CVEs should never reach production
Frameworks: SOC 2, ISO
Difficulty: Hard
Tooling: Container scanning, admission controllers
✓Enable threat detection (GuardDuty, Defender, SCC)Must-have
Why: Threat detection catches active exploitation that CSPM misses
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Easy
Tooling: GuardDuty, Defender, SCC
Cost Governance (8 Controls)
✓Set budget alerts on all accountsMust-have
Why: Budget alerts catch cost anomalies and prevent bill shock
Frameworks: SOC 2
Difficulty: Easy
Tooling: AWS Budgets, Azure Cost Alerts
✓Implement right-sizing recommendationsShould-have
Why: Oversized instances are the single largest source of cloud waste
Frameworks: SOC 2
Difficulty: Medium
Tooling: Cost Explorer, Azure Advisor, Spot.io
✓Manage reserved instances and savings plansShould-have
Why: On-demand pricing is 40-60% more expensive than committed
Frameworks: SOC 2
Difficulty: Medium
Tooling: RI management tools, FinOps platforms
✓Detect and terminate idle resourcesShould-have
Why: Idle resources (dev instances on weekends, unused load balancers) waste 10-15% of spend
Frameworks: SOC 2
Difficulty: Medium
Tooling: Custom automation, Spot.io
✓Implement showback/chargeback by teamShould-have
Why: Teams that see their cloud costs make better resource decisions
Frameworks: SOC 2
Difficulty: Medium
Tooling: FinOps platforms, custom dashboards
✓Configure cost anomaly detectionMust-have
Why: Automated anomaly detection catches crypto mining and misconfigurations faster than humans
Frameworks: SOC 2
Difficulty: Easy
Tooling: AWS Cost Anomaly, Azure alerts
✓Block expensive instance types without approvalNice-to-have
Why: Guardrails prevent accidental expensive deployments
Frameworks: SOC 2
Difficulty: Medium
Tooling: SCPs, Azure Policy
✓Review and clean up unused commitments quarterlyShould-have
Why: Unused reservations are pure waste
Frameworks: SOC 2
Difficulty: Easy
Tooling: RI utilization reports
Compliance and Audit (12 Controls)
✓Enable audit logging across all accountsMust-have
Why: Audit logs are the foundation of every compliance framework
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Easy
Tooling: CloudTrail, Activity Log, Audit Log
✓Centralize log storage with immutabilityMust-have
Why: Logs must be tamper-proof for audit evidence
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Medium
Tooling: S3 Object Lock, immutable storage
✓Set log retention to meet compliance requirementsMust-have
Why: SOC 2 requires 1 year, PCI requires 1 year, HIPAA requires 6 years
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Easy
Tooling: Native log lifecycle
✓Deploy compliance automation platformShould-have
Why: Manual evidence collection costs $20k-$40k per audit cycle
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Medium
Tooling: Vanta, Drata, Tugboat Logic
✓Map controls to compliance frameworksMust-have
Why: A unified control map reduces duplicate effort across frameworks
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Medium
Tooling: GRC platforms, compliance automation
✓Implement continuous compliance monitoringShould-have
Why: Point-in-time audits miss drift between assessment periods
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Medium
Tooling: Compliance automation, CSPM
✓Automate vendor questionnaire responsesNice-to-have
Why: Enterprise customers send 20-50 questionnaires per year
Frameworks: SOC 2
Difficulty: Medium
Tooling: Vanta, Drata, SafeBase
✓Maintain policy documentation with version controlMust-have
Why: Auditors review policy history to verify governance over time
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Easy
Tooling: Git, GRC platforms
✓Track control exceptions with time-bound approvalsShould-have
Why: Exceptions without expiry become permanent security gaps
Frameworks: SOC 2, ISO
Difficulty: Medium
Tooling: GRC platforms, ticketing
✓Conduct annual risk assessmentMust-have
Why: Risk assessment is required by every major compliance framework
Frameworks: SOC 2, ISO, HIPAA, PCI
Difficulty: Medium
Tooling: GRC platforms, consulting
✓Implement data classification and handling policiesShould-have
Why: Data classification drives encryption, access, and retention requirements
Frameworks: ISO, HIPAA, PCI
Difficulty: Medium
Tooling: DLP tools, CSPM data scanning
✓Configure automated breach notification workflowsShould-have
Why: HIPAA and GDPR have specific notification timelines (72 hours)
Frameworks: HIPAA, PCI
Difficulty: Hard
Tooling: Incident response platforms
Continue Reading
Updated 11 April 2026