SekitCrosswalk
ENES
Start now
Sekit CSF · Family

Cloud Security

24 controls in 8 topics, each seen through the policy, process and technical lenses.

Policy

RCF-0334Cloud IAM7 mappingsAccess to cloud environments is formally governed by policies defining who can access what and under what conditionsRCF-0343Cloud logging5 mappingsThe company formally requires that all significant cloud activity is logged and retainedRCF-0337CSPM posture5 mappingsThe company formally requires continuous assessment of cloud environment configurations against security standardsRCF-0340KMS & HSM3 mappingsThe company formally governs how encryption keys are created, stored, rotated and retiredRCF-0349Multi-tenancy controls5 mappingsThe company formally addresses the risk of data leakage between tenants in shared cloud environmentsRCF-0352SaaS security configuration6 mappingsSecurity configuration requirements for all software-as-a-service applications are formally definedRCF-0331Shared responsibility model6 mappingsSecurity responsibilities between the company and its cloud providers are formally understood and documentedRCF-0346Workload protection7 mappingsSecurity standards for protecting workloads running in cloud environments are formally defined

Process

RCF-0335Cloud IAM7 mappingsCloud access rights are consistently reviewed and aligned with the principle of least privilegeRCF-0344Cloud logging5 mappingsCloud audit logs are consistently enabled across all accounts and services and reviewed regularlyRCF-0338CSPM posture7 mappingsCloud security posture is consistently monitored and misconfigurations are remediated within agreed timelinesRCF-0341KMS & HSM3 mappingsEncryption key management procedures are consistently followed and key material is never exposed in plain textRCF-0350Multi-tenancy controls5 mappingsMulti-tenant boundaries are consistently verified and configurations that could enable cross-tenant access are avoidedRCF-0353SaaS security configuration7 mappingsSaaS applications are consistently configured to meet security standards and reviewed when settings changeRCF-0332Shared responsibility model8 mappingsTeams consistently apply the correct security controls for their side of the cloud shared responsibility modelRCF-0347Workload protection6 mappingsCloud workloads are consistently assessed against security standards and anomalies are investigated

Technical

RCF-0336Cloud IAM8 mappingsTechnical controls enforce identity-based access policies across all cloud environments and servicesRCF-0345Cloud logging5 mappingsTechnical controls ensure cloud activity logs are centralised, tamper-proof and available for investigationRCF-0339CSPM posture7 mappingsCloud security posture management tools continuously scan for and alert on misconfigured cloud resourcesRCF-0342KMS & HSM3 mappingsTechnical key management systems and hardware security modules protect cryptographic material at rest and in useRCF-0351Multi-tenancy controls5 mappingsTechnical controls enforce strict tenant isolation to prevent unauthorised access to other customers' dataRCF-0354SaaS security configuration5 mappingsTechnical tools assess SaaS application configurations and alert on deviations from security baselinesRCF-0333Shared responsibility model7 mappingsTechnical controls fill the security gaps that fall on the company's side of the cloud shared responsibility boundaryRCF-0348Workload protection7 mappingsTechnical tools monitor cloud workloads for threats and enforce security policies at the workload level

This family in ISO/IEC 27001:2022

Every framework item the family's controls map to, most-connected first — grouped by Sekit CSF family, never by the framework's own index.

A.8.9 Configuration managementA.5.23 Information security for use of cloud servicesA.8.16 Monitoring activitiesA.8.15 LoggingA.8.24 Use of cryptographyA.8.22 Segregation of networksA.5.22 Monitoring, review and change management of supplier servicesA.8.2 Privileged access rightsA.8.8 Management of technical vulnerabilitiesA.5.18 Access rightsA.5.15 Access controlA.5.37 Documented operating proceduresA.5.19 Information security in supplier relationshipsA.8.5 Secure authenticationA.5.16 Identity managementA.8.7 Protection against malwareA.8.17 Clock synchronizationA.8.3 Information access restriction

This family in NIST CSF 2.0

PR.PS-02 Software maintainedDE.CM-01 Networks monitoredPR.AA-05 Access permissions managedPR.PS-01 Configuration management appliedPR.IR-01 Networks protected from unauthorized accessPR.AA-03 Users and devices authenticatedPR.DS-01 Data-at-rest protectedPR.DS-02 Data-in-transit protectedPR.AA-01 Identities and credentials managedDE.CM-03 Personnel activity monitoredDE.AE-03 Information correlatedGV.OC-04 Critical objectives and services understoodGV.SC-01 Supply chain risk program establishedGV.SC-05 Supply chain requirements in contracts

This family in ISO/IEC 42001:2023 — Annex A

A.10.2 Allocation of responsibilities

This family in Cyber Essentials

CE2.2 Change default and guessable passwordsCE2.1 Remove unnecessary accounts and softwareCE4.3 Require multi-factor authenticationCE4.2 Control administrative privilegesCE5.1 Operate a malware protection mechanismCE4.1 Manage the account lifecycleCE5.2 Restrict execution to approved software
Ask Sekura: “What evidence proves Cloud Security?”
Also via MCP, free with account