Cloud security checklists tend to be exhaustive and unordered, which makes them unusable — 400 items with no indication of which three would have prevented last year's breaches.
This checklist is ordered by exposure closed. The first twenty items across each provider address the misconfigurations that appear repeatedly in real incidents: public storage, over-permissive IAM, exposed management interfaces, unrotated keys and disabled logging.
Each item includes the console path, the CLI command to verify it, and the infrastructure-as-code snippet to enforce it — so verification and remediation are both actionable.
Why it is structured the way it is, and the failure patterns it was designed around.
Nobody reaches least privilege by reviewing 900 IAM roles. You get there by removing the classes of permission that cause breaches, in a specific order.
A working risk register with a pre-populated scenario library, quantified exposure model and treatment tracking — not an empty template.
Most organisations discover their first real gap during an audit or an incident. The assessment surfaces it in fifteen minutes instead — scored, benchmarked and prioritised, with nothing to buy.
Built for
Kept current
Version 3.5, revised 30 June 2026. We update when a framework changes, when new rules are notified, or when an engagement teaches us something that improves it.
XLSX + Terraform modules · 24 pages
What this will not do
A template cannot know your systems, test your controls or make the judgement calls that determine whether a programme holds up in an audit. Use it to move faster, not to skip the thinking — and treat any resource claiming to make you compliant on its own as a warning about its author.
Tiering model plus four proportionate question sets, so a low-risk vendor answers eight questions and a critical one gets genuine scrutiny.
A DPDPA-conformant notice set — customer, employee, vendor and website — with itemised processing tables and multilingual structure built in.
Your position across privacy, security, governance, risk and AI accountability, scored against sector benchmarks rather than a generic scale.
The specific gaps that matter most for your sector and size, ordered by risk reduction rather than by framework clause number.
Where you stand against DPDPA, ISO 27001, ISO 42001 and SOC 2 — and which of them your buyers are most likely to ask for next.
No sales call required to see your results. Take it, read the output, and decide independently whether you want to talk to anyone.
