Cloud
Secure by architecture. Provable by audit.
Security added after a migration is a list of exceptions. Designed in, it is a set of defaults — boundaries, identity, keys and evidence collection that hold as the estate grows, and that an auditor can verify without anyone running a project to prepare for them.
- Identity & access
- Network boundaries
- Key management & HSM
- WAF & DDoS
- Encryption at rest and in transit
- Posture management
- Audit evidence
- ISO 27001
What we hear
Where cloud security usually goes wrong.
Every team secures their own account their own way. There is no single policy.
Head of Security
We pass the pen test and fail the audit, because we cannot show the evidence.
Risk & Compliance Lead
Half the exceptions on the register were granted during the migration and never closed.
CISO
Six layers
Secured as one system, not six products.
Most estates are secured in silos, which is how a gap opens between two tools that each believe the other has it covered. These are the layers, and the point is that one policy spans them.
Physical and platform
What the provider is responsible for and what remains yours, with their independent audit reports held on file — plus data residency decided deliberately rather than by default region.
Workload hardening
Intrusion prevention, host firewalls, anti-malware, file integrity monitoring and log shipping, applied from a baseline image rather than configured per machine.
Boundaries and traffic
One policy across on-premises, hybrid and multi-cloud: segmentation, VPC design, access control lists, VPN and dedicated connectivity, with east-west traffic treated as seriously as north-south.
What faces the internet
Web application firewall, DDoS protection, certificate lifecycle, dynamic application security testing, and the dependency scanning that catches what your own code did not introduce.
Who can do what
Federated identity, least-privilege roles, MFA everywhere including break-glass, key management with an HSM where it is warranted, and an admin trail nobody can quietly edit.
Noticing, and then acting
Posture management and alerting wired to runbooks a human can follow at three in the morning — because an alert with no decision attached is noise with a timestamp.
Evidence
What an auditor actually asks for.
Passing an audit is rarely about whether the control exists. It is about whether you can show it has been operating for the whole period. We design for that from the start.
- Access reviewsWho had which privileges, when it was granted, who approved it and when it was last reviewed — produced from the identity provider rather than reconstructed in a spreadsheet.
- Change controlEvery infrastructure change traceable to a merged pull request with a reviewer, which is what makes infrastructure as code an audit asset rather than just an engineering preference.
- Encryption proofNot a policy saying data is encrypted, but configuration showing it is — per store, per transit path, with key rotation evidenced.
- Vulnerability cadenceScan results over time with remediation dates against severity, so the record shows a process operating rather than a snapshot taken last week.
- Incident recordsWhat happened, when it was detected, who was told, what was done, and what changed afterwards.
- The exception registerEvery deviation written down with an owner and an expiry date. Exceptions without expiry dates are how estates drift.
Frameworks clients most often need to satisfy: ISO 27001, SOC 2, GDPR, HIPAA, PCI DSS and India’s DPDP Act. [Confirm which of these you support directly and which you support alongside a specialist assessor.]
Selected work
What changed, in the client’s terms.
Three recent engagements from this practice.
A two-week paid pilot
Fixed price, on a real piece of your backlog. You keep the output whether or not you continue.