Azure and Google Cloud foundation security checklist.

What's inside

Seven areas, 34 yes-or-no checks.

Every box you cannot tick is a question to answer before an auditor, an attacker or your first AI agent finds it. The last page scores your foundation and shows what to fix first.

1. Landing zone and structureProduction separation, inherited policies, tagging enforced by policy.
2. Identity and accessPhishing-resistant MFA, no standing admin, workload identities, break-glass accounts.
3. Network and segmentationCentral inspection, no open management ports, private endpoints, private Kubernetes APIs.
4. Posture and detectionDefender for Cloud or Security Command Center everywhere, logs in Sentinel or Google SecOps.
5. Automation maturityTerraform through reviewed pipelines, drift detection, secrets out of code, policy as code.
6. AI readinessWhat Copilot or Gemini can reach, sensitivity labels, governed agent access, AI logging.
7. Cost controlBudgets, idle resources, owner tags and cost reviewed alongside security.

How to use it

Print it or share it with your cloud and security leads. Go through one area at a time and tick only the boxes you can prove, for example with a policy, a log or a screenshot. A box you believe is true but cannot show counts as open.

Start with identity and network. Those two areas cause most cloud breaches, and they are often the quickest to fix.

Who it is for

CISOs, cloud architects and IT leaders at companies on Microsoft Azure or Google Cloud, or both. It is most useful before an audit, before an AI rollout, or after a period of fast growth.

Want us to run the checks for you? The Secure Cloud Foundation Assessment covers all seven areas in two to three weeks, for a fixed fee.