Understand shared responsibility
Cloud providers secure underlying services, while customers retain responsibilities that vary by service model. Identify ownership for identities, data, configuration, and logging rather than assuming the provider handles all security.
Protect identities and data
Use federation and strong authentication, avoid long-lived access keys, and separate production from development. Encrypt sensitive data, review public exposure, and test backup restoration. A backup that has never been restored remains an assumption.
Build guardrails
Define approved infrastructure patterns and review changes as code. Enable audit logging with protected retention and alerts for high-impact changes. Regularly evaluate drift and prioritize findings using actual exposure and data sensitivity.
Review a workload end to end
Take one workload and identify its data stores, network exposure, deployment identity, administrator roles, and recovery dependencies. Confirm that management access does not depend on a shared account. Check whether logging survives accidental workload deletion and whether a compromised workload can modify its own audit evidence.
Test restoration into an isolated environment with a realistic recovery objective. Review both technical controls and ownership: someone must respond to failed backups, revoked keys, or unexpected public exposure. Keep evidence of the review in a maintained record and revisit it after significant architecture changes. Configuration benchmarks are useful starting points, but their findings need workload context; a long checklist without prioritization rarely tells a team what to fix first.