Misconfigured cloud resources are the leading cause of data breaches — and a direct blocker for ISO 27001, HIPAA, and NIST CSF certification. We scan every cloud resource, map findings to your compliance controls, and give you the evidence your auditor needs.
These six finding categories appear in over 90% of cloud environments we assess.
Exposed object storage containing PHI, PII, or source code.
Wildcard permissions and unused admin accounts violating least-privilege.
RDS, Cosmos DB, or GCP Cloud SQL without encryption at rest.
Ports 22, 3389, 0.0.0.0/0 exposed to the internet.
CloudTrail, Azure Monitor, or GCP Audit Logs disabled — a direct HIPAA violation.
Resources without data classification tags required by ISO 27001 A.5.12.
Every finding we report is tagged to the specific control reference your auditor will look for.
A.5.23Information security for use of cloud services
A.8.23Web filtering and cloud access controls
A.8.9Configuration management
§164.312(a)(1)Access control — cloud workloads and data stores
§164.312(b)Audit controls — cloud activity logs
§164.312(e)(2)(ii)Encryption in transit across cloud services
ID.AM-3Organisational communication and data flows mapped
PR.DS-1Data-at-rest protected in cloud environments
DE.CM-1Networks and cloud resources monitored
Audit-Ready Evidence
Accepted by ISO 27001 certification bodies
Every finding is formatted to satisfy the documentary evidence requirements of your certification body — not just a list of IPs and CVEs.
After remediation, we issue a signed re-scan attestation letter. Most ISO auditors accept this as evidence of control effectiveness.
CSPM focuses on configuration misconfigurations — wrong settings that create risk — without active exploitation. A cloud pentest actively exploits those misconfigurations to demonstrate real attack paths. Both are typically required for ISO 27001 and NIST CSF compliance.
AWS, Microsoft Azure, and Google Cloud Platform. Multi-cloud engagements covering two or more providers are scoped together.
Yes. ISO 27001:2022 Annex A 5.23 explicitly requires controls for information security when using cloud services. Our CSPM engagement maps every finding to the specific control and provides the documented evidence your auditor needs.
A typical single-cloud CSPM review takes 3–5 business days. Multi-cloud environments or those with hundreds of accounts may take 7–10 days. We provide a timeline estimate after the scoping call.
Yes. After you remediate findings, we re-scan the same scope at no additional cost and issue a re-scan attestation letter accepted by ISO certification bodies.
A single misconfigured S3 bucket has cost companies millions. Know your posture before your auditor — or an attacker — does.
Get a Free Cloud Security Assessment