A cloud security configuration review programme is the process of continuously checking your AWS, Azure or GCP settings against a security baseline instead of relying on one-off audits. Build it around three fixed elements: a documented baseline (CIS Benchmarks, ISO 27001 Annex A, or your provider's own well-architected framework), a review cadence, and an evidence trail auditors can check without you scrambling. Skip the evidence trail and the programme still catches misconfigurations — it just fails your next ISO 27001 or SOC 2 audit.
Why this matters
Misconfigured storage buckets, open security groups and unrotated access keys account for most cloud breaches — not zero-day exploits. A review programme catches these before an auditor or an attacker does.
Without a programme, teams find drift the hard way: a failed Cyber Essentials assessment, a flagged nonconformity at an ISO 27001 surveillance audit, or a security questionnaire that stalls a deal. A structured cloud security configuration review closes that gap before it costs you a contract.
How do you build a cloud security configuration review programme?
Build it in five steps, in this order:
- Pick a baseline. CIS Benchmarks for AWS, Azure or GCP is the most widely adopted starting point in 2026 — it's specific enough to automate against.
- Inventory your cloud accounts and services. You can't review what you haven't listed. Include every account, region and service, not just production.
- Set a review cadence. Annual is the legal minimum for something like Cyber Essentials; monthly or continuous is standard for ISO 27001 and SOC 2 programmes.
- Automate the checks. Manual spreadsheet reviews don't scale past a handful of accounts — automate evidence collection for audits instead of chasing screenshots each quarter.
- Remediate and log. Every finding needs an owner, a fix date and a record. That log is what an auditor asks for first.
| Step | Owner | Typical cadence |
|---|---|---|
| Baseline selection | Security lead | One-time, reviewed yearly |
| Account inventory | IT/DevOps | Quarterly refresh |
| Configuration scan | Automated tooling | Continuous or monthly |
| Remediation | Engineering | Within SLA per finding severity |
| Evidence log | Compliance owner | Continuous |
A cyber security maturity assessment is a useful gate before step one — it tells you whether you're ready for continuous review or need a manual quarterly process first.
ISO 27001 Annex A: 93 controls to map against your cloud estate
ISO 27001:2022 Annex A contains 93 controls across four themes: organisational, people, physical, and technological. Not all 93 apply to cloud configuration directly, but the technological theme — access control, cryptography, network security — is where your review programme does most of its work.
Best for: businesses already pursuing or holding ISO 27001 certification who need the review programme to double as audit evidence.
- Pro: directly reusable as Statement of Applicability evidence.
- Con: 93 controls is a heavy baseline for a five-person startup with two AWS accounts.
CIS Controls v8: 18 controls, 3 implementation groups
CIS Controls v8 organises 18 controls into three implementation groups (IG1, IG2, IG3), scaled by organisation size and risk. IG1 is the entry point most SMEs use for a first cloud configuration baseline.
Best for: teams that want a security baseline without committing to full ISO 27001 scope yet.
- Pro: lighter to implement than Annex A, and IG1 maps cleanly onto cloud provider security dashboards.
- Con: doesn't produce certification on its own — it's a baseline, not a credential.
If you're also running CIS Controls v8 for a UK business more broadly, the cloud configuration review slots straight into that existing control mapping.
Cyber Essentials: renews every 12 months
Cyber Essentials certification renews every 12 months, which sets a hard floor on review cadence — you cannot let cloud configuration checks lapse past a year and still hold the certificate.
Best for: SMEs that need a recognised UK government-backed baseline with minimal overhead.
- Pro: the annual cycle forces discipline even without continuous monitoring.
- Con: annual is too infrequent for anyone handling customer data at scale — attackers don't wait 12 months.
Why review scope varies
How big your programme needs to be depends on a handful of factors, not on headcount alone:
- Number of cloud accounts and environments — ten AWS accounts need automated scanning; two don't.
- Frameworks you're certifying against — ISO 27001 and SOC 2 demand continuous evidence; Cyber Essentials doesn't.
- Data sensitivity — healthcare and financial data push cadence toward monthly or continuous, regardless of size.
- Existing automation maturity — teams already running CI/CD can bolt configuration checks into the pipeline; teams without it need a separate scanning tool.
- Audit history — a prior failed audit or breach usually forces a tighter review cycle going forward.
- Vendor and third-party exposure — if suppliers touch your cloud environment, your vendor risk management process needs to feed into the same review.
Automate your configuration review evidence
OneClickComply handles compliance evidence end-to-end so your team isn't chasing screenshots.
How often should you run a cloud security configuration review?
Run it continuously if you're pursuing ISO 27001 or SOC 2 in 2026 — both frameworks expect ongoing evidence, not a snapshot. For Cyber Essentials alone, annual is the legal minimum, but monthly checks catch drift long before your renewal date.
What's the difference between a configuration review and a penetration test?
A configuration review checks your settings against a baseline (open ports, IAM permissions, encryption status); a penetration test actively tries to exploit weaknesses. Run both — a clean configuration review doesn't rule out an exploitable application flaw, which is what penetration testing for cloud infrastructure and AWS environments is built to catch.
Do you need a cloud security configuration review for ISO 27001 certification?
Yes — ISO 27001:2022's technological controls under Annex A require evidence that cloud access, network and cryptographic configurations are actively managed, not just documented once at certification.
Frequently asked questions
One last thing
Most teams that fail their first ISO 27001 surveillance audit fail on evidence gaps, not missing controls — the configuration was fine, but nobody logged proof of the review. Build the logging step into the programme from day one, not after the first failed audit.