1
Scope and access
We agree which tenants and subscriptions are in scope and receive time-boxed read-only access.
Cloud & devices
Cloud configuration review
A configuration-led review of your cloud tenants — identity, exposure, data and logging — that finds the privilege escalation paths and quiet public exposures a checklist tool reports as green.
8
areas covered
5
stages, scoping to retest
In-house
testers, never subcontracted
portal.cyberlysecure.com/acme-health/coverage
Acme Health — Test coverage4 practices · 16 services · one team
In-houseWeb app
API
SaaS
Mobile
Client-side
External
Internal
Segment test
Wireless
Vuln. assessment
Cloud config
Hardware & IoT
AI & LLM
Social eng.
Physical
Red team
ApplicationsNetworkCloud & devicesPeople & premises
6 in scope · one team · one report
In-house testers 0 subcontracted
Every surface one team
What this is
What the test covers.
Cloud breaches are rarely exploits. They are permissions: a role that can assume another role, a key with no expiry, a storage bucket that was public for one migration and never changed back.
We review your configuration with read access, map how identity actually flows, and show which chains would let a low-privilege principal end up owning the tenant.
CIS Benchmarks Cloud provider security best-practice guidance NIST SP 800-53 control families
What we test
- Identity and access: roles, policies, trust relationships and privilege escalation paths
- Over-permissive service accounts, long-lived keys and unused credentials
- Public and over-shared storage, databases, snapshots and images
- Network exposure: security groups, firewall rules and public endpoints
- Key and secret management, encryption at rest and in transit
- Logging, monitoring and detection coverage — whether an incident would be reconstructable
- Backup, recovery and deletion protection
- Microsoft 365 and Entra ID: conditional access, legacy authentication, guest access and sharing
How it runs
From scoping call to retest, here’s what happens.
Typically one to two weeks, depending on the number of accounts and services.
2
Collect the configuration
We gather identity, network, data and logging configuration across the estate.
3
Map the paths
We work out which principals can become which other principals, and where that ends.
4
Prove what matters
Where you authorize it, we validate the highest-impact paths rather than only describing them.
5
Report, readout and retest
Findings are ranked by what they would let an attacker do, with a readout and a retest after remediation.
What it surfaces
The kind of thing this test tends to find.
Real examples of what this engagement uncovers — anonymized, and never every time. What matters is that you find out before somebody else does.
A path from a low-privilege role to tenant-wide administration
Access keys years old, still valid, belonging to people who have left
Storage or snapshots readable by anyone who knows the address
Conditional access policies with exclusions that swallow the rule
Logging switched off, short-retention or never delivered anywhere anyone looks
Frameworks this test supports
Testing that counts toward your framework.
These programs call for this test, or their assessors and your customers expect it. If one of them is on your desk, readiness and testing come from the same team.
SOC 2
Most SOC 2 systems run in a public cloud; a configuration review shows the access, logging and encryption controls in your description are actually set the way you say.
SOC 2 readinessISO 27001
The 2022 control on information security for use of cloud services expects deliberate management of cloud security; a configuration review shows where your setup departs from your own policy.
ISO 27001 readinessHITRUST
Shows the controls you claim in cloud environments, including the ones you inherit, are configured as described.
HITRUST readinessSOC 1
For platforms hosted in a public cloud, it shows the access and change controls over the in-scope environment are configured as described.
SOC 1 readinessISO 42001
Training data, model artifacts and inference infrastructure usually live in cloud services; a configuration review checks that access to them matches your data-for-AI controls.
ISO 42001 readinessCSA STAR
The CCM’s infrastructure, identity, encryption and logging domains map closely to the configuration of the cloud accounts your service runs in.
CSA STAR readinessCMMC
Government cloud tenants are where CUI often lives. A configuration review checks them against the requirements you claim and the responsibilities you inherit from the provider.
CMMC readinessNIST SP 800-171
When CUI lives in a cloud tenant, the provider’s authorization covers its side only. A configuration review checks the settings you control against the requirements you claim.
NIST SP 800-171 readinessFedRAMP
Most FedRAMP services run on an authorized IaaS. A configuration review checks the settings you own against the baseline controls you claim to meet.
FedRAMP readinessGovRAMP & TX-RAMP
Most state cloud services run on a public cloud platform, and a configuration review checks the settings you own against the controls you claim.
GovRAMP & TX-RAMP readinessHIPAA
Where ePHI lives in AWS, Azure or Google Cloud, misconfigured storage, identity and logging are among the most common causes of exposure.
HIPAA readinessNIST CSF
Measures platform and data security outcomes in the cloud services that now carry most workloads.
NIST CSF readinessPrivacy: GDPR, CCPA & state laws
Misconfigured cloud storage and identity are among the most common causes of personal data breaches.
Privacy: GDPR, CCPA & state laws readinessDORA
Data location, segregation, backup and recovery commitments in a DORA contract depend on how your cloud estate is actually configured.
DORA readinessCyber Essentials
Cloud services are in scope, and multi-factor authentication, administrator separation and secure configuration there are frequent reasons for failure.
Cyber Essentials readinessIRAP
IRAP assessments of cloud services examine how your tenancy is configured, including identity, network controls, encryption and logging, so a configuration review shows where the ISM will not be met.
IRAP readinessRisk assessment
Examines the cloud accounts where much of your sensitive data now lives, so misconfiguration risk is measured rather than guessed.
Risk assessment readinessBusiness continuity & DR
A cloud configuration review checks backup vaults, immutability and object-lock settings, cross-account isolation and the permissions that could let an attacker delete your recovery copies.
Business continuity & DR readinessZero Trust
Checks identity policies, network controls and workload trust in your cloud accounts against the least-privilege model Zero Trust depends on.
Zero Trust readinessM&A due diligence
A cloud configuration review at or after closing shows how the target’s cloud accounts are really set up — identity, logging, exposure and backups — before you connect them to yours.
M&A due diligence readiness Getting started
What you get, and what we need from you.
What you get
- Technical report — Every finding, the evidence behind it and clear guidance your engineers can act on.
- Executive summary — Your risk explained in plain language for leadership and the board.
- Attestation letter — Signed confirmation of testing to hand your auditors.
- Readout call — A walkthrough with the people who tested your systems.
- Retest — Confirmation your fixes worked, documented for whoever needs to see it.
What we need from you
- Read-only access to each tenant, subscription or project in scope
- A list of the accounts and environments you consider production
- Any compliance framework you are being measured against
- One named contact for the duration of the review
Missing something on this list? Bring it to the call — we scope around what you have.