Table of Contents
What Is a Cloud Security Review?
A cloud security review is a structured assessment of an organization’s cloud infrastructure – including configuration, identity and access management, data protection, logging, network controls, and governance – against an established security baseline. The goal is to identify misconfigurations, control gaps, and compliance exposures before they are exploited or flagged in an audit. A cloud security review is not a penetration test (which actively exploits vulnerabilities) and is not a compliance audit (which checks paper policies). It is a technical assessment of how cloud environments are actually configured compared to how they should be.
In practice, most cloud security reviews examine one or more of the major cloud providers – AWS, Azure, and GCP – against standards such as the CIS Benchmarks, the organization’s applicable regulatory framework (NIS2, DORA, ISO 27001, SOC 2), and internal security policy. The output is a findings report with severity ratings and a prioritized remediation plan.
The Shared Responsibility Model: Who Is Responsible for What
The single most important concept in cloud security is the shared responsibility model. Every major cloud provider publishes its own version, and they all say the same fundamental thing: the cloud provider is responsible for the security of the cloud (physical infrastructure, hypervisor, global network); the customer is responsible for the security in the cloud (configuration, data, identity, applications, access controls).
In practice, the line varies by service type – Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) each shifts the boundary differently. The table below shows how responsibility is divided across the three major providers for IaaS deployments:
| Security Domain | AWS (IaaS) | Azure (IaaS) | GCP (IaaS) |
|---|---|---|---|
| Physical infrastructure | AWS | Microsoft | |
| Hypervisor / compute isolation | AWS | Microsoft | |
| Network infrastructure (global) | AWS | Microsoft | |
| Operating system patching | Customer | Customer | Customer |
| Network controls (VPC/VNet config) | Customer | Customer | Customer |
| Identity & access management (IAM) | Customer | Customer | Customer |
| Data encryption at rest | Shared (customer manages keys) | Shared (customer manages keys) | Shared (customer manages keys) |
| Data encryption in transit | Customer must configure | Customer must configure | Customer must configure |
| Application security | Customer | Customer | Customer |
| Security monitoring & logging | Customer (CloudTrail/Config) | Customer (Defender/Monitor) | Customer (Cloud Audit Logs) |
| Incident response | Customer | Customer | Customer |
| Data classification & governance | Customer | Customer | Customer |
| Backup & recovery configuration | Customer | Customer | Customer |
| Compliance & regulatory obligations | Customer | Customer | Customer |
The practical implication: the cloud provider guarantees that the infrastructure it runs is secure. Everything your team configures on top of it is your responsibility. Every misconfigured S3 bucket, every overly permissive IAM role, every storage account with public blob access – these are customer failures, not provider failures. This is why Gartner’s analysis holds: 99% of cloud security failures are on the customer side.
The 5 Most Common Cloud Misconfigurations
IPV Security’s cloud security reviews consistently surface the same categories of misconfiguration across client environments. These are not edge cases – they appear in the majority of cloud environments that have not had a structured security review.
1. Publicly Exposed Storage
S3 buckets (AWS), Azure Blob Storage containers, and GCP Cloud Storage buckets set to public read access remain one of the most common causes of data breaches. The configuration takes seconds to set and is easy to do accidentally during development. Automated CSPM scanning consistently surfaces public storage exposure as the highest-frequency finding. Many organizations do not know they have public storage until a breach or a researcher notifies them.
2. Overprivileged IAM Roles and Policies
The principle of least privilege is well understood in theory and routinely violated in practice. Cloud IAM roles accumulate permissions over time – developers add permissions to resolve blockers, automated tools require broad access to function, and no one removes permissions when they are no longer needed. The result is an environment where service accounts and user roles hold far more access than their function requires. A compromised service account with excessive permissions is the most common lateral movement path in cloud breaches.
3. Disabled or Incomplete Logging
AWS CloudTrail, Azure Monitor/Defender for Cloud, and GCP Cloud Audit Logs are the primary mechanisms for detecting unauthorized activity in cloud environments. They are also regularly found to be partially or completely disabled in environments that have not had a security review. The most common gap: logging enabled for production but disabled in development and staging environments, which attackers use as pivot points. Without comprehensive logging, breaches can persist for months before detection.
4. Unrestricted Network Access (Security Group / Firewall Rule Misconfiguration)
Security groups (AWS), Network Security Groups (Azure), and VPC firewall rules (GCP) that allow inbound traffic from 0.0.0.0/0 on sensitive ports – including SSH (22), RDP (3389), database ports (3306, 5432, 1433), and management interfaces – are consistently found in environments that evolved organically without structured network security governance. Once an inbound rule opens a port to the internet, any system behind it is directly exposed to automated scanning and brute force attacks.
5. Unencrypted Data and Unmanaged Encryption Keys
Cloud providers offer encryption at rest for most storage services, but it requires deliberate configuration. Default encryption using provider-managed keys offers some protection, but for sensitive data, particularly in regulated industries, customer-managed keys (CMK/BYOK) with proper key management procedures are required. Many environments also have data at rest in legacy storage configurations that predate the adoption of encryption defaults, and in-transit encryption missing on internal service-to-service communication that remains unencrypted because it “doesn’t leave the VPC.”
Six Cloud Governance Control Domains
A comprehensive cloud security review must cover six governance control domains, not just technical configuration. Organizations that address only technical misconfigurations without addressing governance will find new misconfigurations emerging faster than they remediate them.
1. Identity and Access Management (IAM) Who can access what, under what conditions, and with what authentication requirements. This includes MFA enforcement, role and permission design, service account management, just-in-time access, and access review cadence. IAM governance is the highest-impact control domain in cloud security – most successful cloud attacks involve compromised or excessive identity permissions.
2. Network Security and Segmentation How cloud network boundaries are designed, what traffic is permitted between segments, and how ingress and egress is controlled and monitored. This includes VPC/VNet design, security group rules, network firewall configuration, and private endpoint versus public endpoint policy for databases and management interfaces.
3. Data Protection Classification, encryption, retention, and access controls applied to data at rest and in transit. This domain includes encryption key management, database security configuration, data loss prevention controls, and the security of data shared with or transferred to third-party services.
4. Logging, Monitoring, and Detection Comprehensive audit logging of cloud control plane and data plane activity; SIEM integration; alerting on high-risk events (privilege escalation, public access changes, credential compromise indicators); and coverage across all environments (production, staging, development, sandbox).
5. Vulnerability and Configuration Management Regular scanning of cloud resources against security baselines (CIS Benchmarks, provider security standards); remediation processes for identified misconfigurations; patch management for operating systems and applications deployed on cloud compute; and image security for containerized workloads.
6. Third-Party and Supply Chain Risk Security assessment of SaaS applications, third-party integrations, and supply chain dependencies that have access to cloud environments or cloud-hosted data. This includes OAuth application access reviews, API key management, and vendor security assessment for services that process or store organization data in cloud environments.
CSPM Tools: What They Do and Their Limits
Cloud Security Posture Management (CSPM) tools – including AWS Security Hub, Microsoft Defender for Cloud, GCP Security Command Center, and third-party platforms like Wiz, Orca Security, and Lacework – provide automated, continuous scanning of cloud environments against security baselines. They are a valuable layer of the cloud security stack.
What CSPM tools do well: continuous automated scanning for known misconfigurations; baseline comparison against CIS Benchmarks and provider security standards; compliance reporting for frameworks like ISO 27001, SOC 2, and HIPAA; and alert generation when configurations drift from baseline.
What CSPM tools do not do: they do not assess governance, policy, and process controls. They cannot evaluate whether your access review process is functioning, whether your third-party vendor agreements include appropriate security obligations, whether your incident response procedure covers cloud-specific scenarios, or whether your encryption key management practices are appropriate. A clean CSPM dashboard does not mean a secure cloud environment – it means the technical configurations the tool can scan are compliant. A structured cloud security review covers both.
For continuous monitoring between formal reviews, IPV Security’s clients use CISOteria to track cloud security control status, CSPM finding trends, and remediation progress in a single dashboard – giving CISOs and leadership visibility into cloud posture without requiring manual report aggregation.
CIS Benchmarks: The Baseline That Matters
The Center for Internet Security (CIS) publishes detailed security configuration benchmarks for AWS, Azure, and GCP. These benchmarks are the most widely adopted technical baseline for cloud security configuration assessment. CIS Benchmarks define specific configuration requirements – with rationale, remediation procedures, and impact assessment – across identity, logging, networking, storage, monitoring, and compute.
Level 1 controls are recommended for all environments: they address the most critical misconfigurations with minimal operational impact. Level 2 controls are intended for environments with higher security requirements and may have some operational trade-offs.
A cloud security review against CIS Benchmarks gives organizations a documented, defensible assessment baseline. It is the standard reference for cyber insurance questionnaires, ISO 27001 audits, and NIS2 compliance assessments when they address cloud configuration.
NIS2 and DORA Cloud Requirements
Both NIS2 (the EU Network and Information Security Directive 2, applicable to organizations operating essential or important services in the EU) and DORA (the Digital Operational Resilience Act, applicable to EU financial sector entities and their ICT third-party providers) impose specific requirements that apply directly to cloud environments.
NIS2 cloud requirements include: risk management measures applied to cloud service provider dependencies; supply chain security assessment for cloud providers classified as ICT third-party service providers; incident reporting obligations that include cloud-hosted services; and resilience testing requirements that must cover cloud-hosted systems and services.
DORA cloud requirements go further for financial sector organizations: documented ICT third-party risk management that must include cloud provider contractual provisions (exit strategies, audit rights, data location, security standards); operational resilience testing including cloud-hosted systems; concentration risk assessment when critical functions depend on a single cloud provider; and mandatory incident classification and reporting for cloud-related ICT incidents.
For organizations subject to NIS2 or DORA, a cloud security review is not an optional best practice – it is a documented component of mandatory risk management obligations. The absence of a structured cloud security review, and absence of documented remediation of identified findings, is an audit finding in its own right.
How IPV Security Approaches Cloud Security Reviews
IPV Security’s cloud security reviews assess client cloud environments against CIS Benchmarks (Level 1 and Level 2 where applicable), applicable regulatory requirements (NIS2, DORA, ISO 27001, SOC 2), and IPV Security’s own cloud governance framework covering the six control domains described above.
The assessment covers all three major cloud providers in multi-cloud environments and includes both automated configuration scanning and manual review of IAM policies, network architecture, logging coverage, and governance processes. Findings are rated by severity and mapped to the relevant compliance framework obligations, so the report serves both the technical remediation roadmap and the regulatory evidence file.
For organizations undergoing NIS2 or DORA compliance programs, the cloud review integrates directly with the broader compliance assessment to eliminate duplication of effort and provide a unified gap-and-remediation view.
CISOteria provides continuous tracking of cloud security posture between formal reviews – cloud control status, CSPM findings, and remediation milestones are all visible in the CISOteria dashboard, updated in real time. This means leadership always has a current view of cloud security posture, not just a snapshot from the last review.
Explore IPV Security’s Cloud Security services
What Is a Cyber Risk Assessment? The 18-Domain Guide →
Compliance Guide: ISO 27001, NIS2, and DORA →
About the Author
Ido Ganor is the Founder and CEO of IPV Security, an Israeli enterprise cybersecurity advisory firm serving mid-market and enterprise clients across Israel and the EU. With 21+ years of experience as an enterprise CISO and security advisor, Ido has led security programs for organizations including Leumi Bank, the State Comptroller of Israel, and Tel Aviv Municipality. He is the creator of CISOteria Cyber OS™ – the world’s only client-facing CISO management platform – and leads IPV Security’s cloud security practice, delivering cloud security reviews and cloud governance frameworks across AWS, Azure, and GCP environments.
Related Articles
- What Is a Cyber Risk Assessment? The 18-Domain Guide →
- Compliance Guide: ISO 27001, NIS2, and DORA →
- AI Architecture Security: Complete Guide for CTOs in 2026 →
Ready to assess your cloud security posture? Cloud misconfigurations are the leading cause of enterprise data breaches. IPV Security’s cloud security review gives you a complete, baseline-driven assessment of your AWS, Azure, or GCP environment – with a prioritized remediation roadmap and continuous tracking through CISOteria.
Frequently Asked Questions
What is a cloud security review and what does it cover?
A cloud security review is a structured assessment of an organization’s cloud infrastructure and governance against an established security baseline. It covers technical configuration (IAM, network controls, storage settings, encryption, logging), governance processes (access management, vendor risk, incident response), and compliance alignment (NIS2, DORA, ISO 27001, SOC 2, CIS Benchmarks). It is distinct from a penetration test, which actively exploits vulnerabilities, and from a compliance audit, which assesses policy documentation. A cloud security review gives organizations a current, evidence-based view of their actual cloud security posture – where the risks are, how severe they are, and what to fix in what order.
What are the most common cloud security misconfigurations?
The five most common cloud misconfigurations IPV Security identifies in client environments are: publicly exposed storage (S3 buckets, Azure Blob containers, GCP Cloud Storage accessible without authentication); overprivileged IAM roles and service accounts with permissions far exceeding operational requirements; disabled or incomplete logging (CloudTrail, Azure Monitor, GCP Audit Logs) that prevents detection of unauthorized activity; unrestricted inbound network access on sensitive ports from 0.0.0.0/0; and unencrypted data at rest or in transit due to missing encryption configuration or lack of customer-managed key usage. These findings appear in the majority of cloud environments that have not had a structured security review – and Gartner’s data confirms that 99% of cloud breaches are caused by customer-side misconfigurations, not provider failures.
How does the shared responsibility model affect our security obligations?
The shared responsibility model divides security obligations between the cloud provider and the customer. The provider is responsible for the security of the cloud: physical data centers, hypervisor infrastructure, and the global network. The customer is responsible for the security in the cloud: every configuration decision, every IAM policy, every storage setting, every encryption key, and every application deployed on top of that infrastructure. In practice, this means the overwhelming majority of cloud security decisions – and therefore cloud security failures – are the customer’s responsibility. Understanding this boundary is essential for correctly scoping security assessments, assigning remediation ownership, and structuring your cloud governance program.
What CSPM tools should we use?
The most appropriate CSPM tooling depends on your cloud environment and budget. For AWS-primary environments, AWS Security Hub (which aggregates findings from GuardDuty, Inspector, Macie, and Config) provides strong native coverage. For Azure-primary environments, Microsoft Defender for Cloud is the natural choice. For multi-cloud environments, third-party CSPM platforms – Wiz, Orca Security, and Lacework are the strongest current options in the mid-market — provide unified coverage across providers with more sophisticated context-aware risk analysis than native tools. The important caveat: any CSPM tool only covers technical configuration. Governance, process, and regulatory compliance controls require structured human assessment. CSPM is a monitoring layer, not a substitute for a cloud security review.
Does NIS2 require a cloud security review?
NIS2 does not prescribe specific assessment tools, but it requires that essential and important entities implement “appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems.” For organizations that run material workloads in cloud environments, demonstrating compliance with this obligation requires documented evidence of cloud security assessment and remediation. NIS2 also requires supply chain security measures covering ICT third-party service providers – which includes cloud providers – meaning that cloud provider risk assessment is explicitly within scope of NIS2 compliance. Organizations under NIS2 that have not conducted a cloud security review are operating with an undocumented gap in their compliance evidence.
How often should a cloud security review be conducted?
For most mid-market organizations, a comprehensive cloud security review should be conducted annually. Trigger-based reviews should be conducted when: a significant new cloud deployment or migration is completed; a new cloud provider or major service is adopted; the organization undergoes a compliance certification requiring cloud evidence (ISO 27001, SOC 2); following a security incident or near-miss involving cloud infrastructure; or before a significant business event such as an M&A transaction, IPO, or major enterprise customer security evaluation. Between formal reviews, continuous CSPM monitoring and CISOteria tracking of cloud control status provide the real-time visibility needed to detect configuration drift and new exposures as they emerge.