Cloud Security Posture Review

Run a structured review of your cloud environment against CIS benchmarks and generate a findings report.

Integrations: AWS MCP, Google Sheets MCP

When to Use

• The user needs to prepare for a compliance audit (SOC2, ISO 27001, HIPAA) and wants CIS alignment
• The user mentions "cloud security posture", "CIS benchmark", "security review", or "compliance check"
• After a significant infrastructure change, to validate security configuration
• When leadership requests a scored security posture report with prioritized findings

Steps

Step 1: Select Benchmark and Scope

Choose the appropriate CIS benchmark and scope:

Cloud Provider	Benchmark	Scope Options
AWS	CIS AWS Foundations Benchmark v3.x	Single account, OU, or Organization
GCP	CIS Google Cloud Computing Platform	Project, folder, or org
Azure	CIS Microsoft Azure Foundations	Subscription or management group

Confirm with the user: account IDs, regions to include, and any exclusions (e.g., sandbox accounts).

Step 2: Identity & Access Review

Review IAM and identity configurations:

Control Area	Checks
Root account	MFA enabled, no access keys, unused
IAM users	MFA, password policy, unused credentials
IAM policies	Least privilege, no inline policies where avoidable
Service accounts	Scoped permissions, no long-lived keys where possible
Federated access	SAML/SCIM, conditional access, session duration

Document pass/fail for each applicable CIS control. Use AWS MCP to query IAM configuration.

Step 3: Network Review

Review VPC and network security:

Control Area	Checks
VPC design	Subnet segmentation, NACLs, flow logs
Security groups	Minimal ingress, no 0.0.0.0/0 on sensitive ports
Network access	VPC endpoints for AWS services, private subnets for data
Perimeter	WAF, DDoS protection, exposed management interfaces

Map findings to CIS networking controls.

Step 4: Logging, Encryption & Compute Review

Review remaining control areas:

Control Area	Checks
Logging	CloudTrail enabled, multi-region, S3 access logs, VPC flow logs
Encryption	S3 default encryption, EBS encryption, RDS encryption, KMS usage
Compute	EC2/VM hardened images, patch status, instance metadata service (IMDSv2)
Secrets	Secrets Manager/Parameter Store, no secrets in code or config

Record pass/fail and evidence (e.g., control IDs, resource ARNs).

Step 5: Generate Findings Report

Create a Google Sheet with:

• Tab 1: Summary — Overall score, pass/fail counts by category, trend vs. prior review
• Tab 2: Findings — Control ID, title, status (Pass/Fail/N/A), description, evidence
• Tab 3: Remediation — Per finding: owner, priority, steps, target date
• Tab 4: Raw Data — Exported checks for audit trail

Use Google Sheets MCP to create and populate the spreadsheet. Format with conditional formatting (e.g., red for fail, green for pass).

Output

Deliver:

• CIS benchmark scores by category with pass/fail/N/A counts
• Findings report with control ID, status, and evidence
• Prioritized remediation plan with owners and target dates
• Google Sheet with all findings and remediation tracking