0 / 24

Model 45 of 74 · Cybersecurity

Cloud Security Maturity Assessment

Assess how well your organisation secures its cloud environments and workloads.

Pillars & areas

Identity & Workloads

Control the access

  1. 01Cloud Identity & Entitlements
  2. 02Workload Protection

Posture & Data

Harden the environment

  1. 03Configuration & Posture Management
  2. 04Cloud Data Security

Network & Detection

Defend the perimeter

  1. 05Cloud Network Security
  2. 06Logging, Detection & Response

Levels

  1. 1Lift-and-ShiftOn-prem thinking in cloud
  2. 2Cloud-AwareNative tools & policies
  3. 3Cloud-NativeAutomated & codified

01 Cloud Identity & Entitlements

Does the organisation enforce least privilege and govern identities across its cloud environments?

0/4 answered

CI-1How does your organisation manage IAM roles and policies in cloud environments?

Think about whether cloud permissions are designed intentionally or accumulate over time without review.

CI-2How does your organisation detect and address unused or excessive cloud permissions?

Consider whether anyone checks if granted permissions are actually being used, or whether entitlements only grow over time.

CI-3How does your organisation govern cross-account and cross-cloud access?

Think about whether workloads in one cloud account or provider can access resources in another, and whether those trust relationships are tracked.

CI-4How does your organisation manage machine identities and service credentials in cloud?

Consider how API keys, service account tokens, and workload identities are created, stored, and rotated.

02 Workload Protection

Does the organisation secure its cloud compute workloads from build through runtime?

0/4 answered

WP-1How does your organisation ensure the security of container images and deployment artifacts?

Think about whether images are scanned before deployment, or whether teams pull from public registries without checks.

WP-2How does your organisation protect workloads at runtime in cloud environments?

Consider whether you have visibility into what is happening inside running VMs, containers, or serverless functions.

WP-3How does your organisation control what gets deployed into cloud environments?

Think about whether there are guardrails that prevent unapproved or insecure workloads from reaching production.

WP-4How does your organisation manage vulnerabilities in cloud-native workloads?

Consider whether vulnerability scanning covers containers, serverless functions, and application dependencies — not just traditional servers.

03 Configuration & Posture Management

Does the organisation maintain a secure, compliant baseline across its cloud resources?

0/4 answered

CP-1How does your organisation detect misconfigurations in cloud resources?

Think about whether someone would notice if a storage bucket were made public, a security group were opened to the internet, or logging were disabled.

CP-2How does your organisation enforce configuration baselines for cloud resources?

Consider whether there are defined standards for how cloud resources should be configured, and whether those standards are enforced or advisory.

CP-3How does your organisation handle configuration drift in cloud environments?

Think about whether cloud resources stay in their intended configuration over time, or whether manual changes accumulate undetected.

CP-4How does your organisation manage compliance benchmarks across multiple cloud accounts or subscriptions?

Consider whether compliance is assessed centrally across all cloud accounts, or whether each team manages their own compliance independently.

04 Cloud Data Security

Does the organisation protect data stored and processed in cloud environments with appropriate controls?

0/4 answered

CD-1How does your organisation manage encryption keys for cloud data?

Think about whether you use provider-managed keys by default, customer-managed keys, or have no consistent encryption approach.

CD-2How does your organisation control access to cloud storage resources?

Consider whether storage buckets, blobs, or file shares have been reviewed for who can access them and whether any are unintentionally public.

CD-3How does your organisation manage data residency and sovereignty in cloud?

Think about whether you know which regions your data is stored in, and whether there are rules about where data can and cannot go.

CD-4How does your organisation prevent sensitive data from leaking through cloud services?

Consider whether you can detect if sensitive data (PII, credentials, financial records) is being stored or transmitted insecurely in cloud.

05 Cloud Network Security

Does the organisation design and enforce network controls that match the cloud operating model?

0/4 answered

CN-1How does your organisation design and manage virtual network architecture in cloud?

Think about whether VPCs or virtual networks are designed with segmentation in mind, or whether everything runs in a flat network.

CN-2How does your organisation manage security groups and firewall rules in cloud?

Consider whether security group rules are reviewed regularly, or whether they accumulate over time with overly permissive entries.

CN-3How does your organisation control egress traffic from cloud environments?

Think about whether outbound traffic from cloud workloads is filtered and monitored, or whether anything can reach any destination.

CN-4How does your organisation protect cloud applications against web attacks and DDoS?

Consider whether internet-facing applications have protection against common web exploits and volumetric attacks.

06 Logging, Detection & Response

Can the organisation see what is happening across its cloud estate and respond to threats effectively?

0/4 answered

LD-1How does your organisation collect and centralise cloud security logs?

Think about whether cloud audit logs, flow logs, and service-level logs are collected centrally or scattered across individual accounts.

LD-2How does your organisation detect threats in cloud environments?

Consider whether cloud-specific threats (credential abuse, resource hijacking, privilege escalation) are actively detected or would go unnoticed.

LD-3How does your organisation use automation to respond to cloud security findings?

Think about whether security findings require manual triage and action, or whether some responses happen automatically.

LD-4How does your organisation conduct incident response for cloud-specific security events?

Consider whether your incident response process accounts for cloud-specific challenges — ephemeral evidence, API-based forensics, multi-account scope.

Self-assessment report

Cloud Security

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Cloud Security maturity model

Securing cloud environments is fundamentally different from securing traditional on-premises infrastructure. The shared-responsibility model means your provider manages security of the cloud, but security in the cloud — your data, identities, configurations, and workloads — remains entirely your problem. Organisations that treat cloud security as an extension of their data-centre controls inevitably leave gaps, because the attack surface has shifted from network perimeters to identity permissions, API configurations, and ephemeral infrastructure that may exist for minutes before being replaced.

Cloud security maturity is not measured by how many security tools you have deployed. It is measured by whether your organisation understands the unique risks of cloud-native architectures and has built controls that match the speed, scale, and programmability of the cloud itself. At the lowest maturity, teams apply familiar on-premises patterns — manual firewall rules, static credentials, infrequent audits — to an environment that changes by the hour. At the highest maturity, security is expressed as code, enforced automatically, and continuously validated against a known-good baseline.

This model focuses exclusively on the security of cloud environments and workloads. It complements the broader Cloud Maturity model (which covers strategy, adoption, and operations) by drilling into the specific controls, practices, and culture needed to keep cloud infrastructure, data, and applications secure as they scale.

The Cloud Security maturity model assesses 24 questions across six areas that together cover the full scope of securing cloud environments — from identity and entitlements through workload protection, configuration management, data security, network controls, and detection and response. It is designed for any organisation using public, private, or hybrid cloud, regardless of provider or scale.

Each question describes three levels of maturity through concrete, observable behaviours. The assessment surfaces the gaps between where your cloud security stands today and where it needs to be — whether you are running a handful of workloads in a single account or operating a complex multi-cloud estate.

Who this assessment is for

  • Cloud security architects and engineers responsible for securing cloud environments
  • CISOs and security leaders seeking visibility into cloud-specific security gaps
  • Platform and infrastructure teams building or operating cloud landing zones
  • DevOps and SRE teams who provision and manage cloud resources daily
  • Risk and compliance teams assessing cloud security posture across the organisation
  • Consultants advising clients on cloud security strategy and architecture

The three maturity levels

  • Level 1 — Lift-and-Shift: On-premises security thinking applied to cloud. Controls are manual, inconsistent, and often misconfigured. Cloud-specific risks — over-permissioned identities, public storage buckets, unmonitored API activity — are not systematically addressed. Security relies on individual knowledge rather than repeatable processes.
  • Level 2 — Cloud-Aware: The organisation recognises that cloud requires different security controls and has adopted cloud-native tools and policies. Identity governance, configuration baselines, and logging are in place. Security is integrated into cloud operations, though some manual steps remain and coverage may be uneven across accounts or providers.
  • Level 3 — Cloud-Native: Security is codified and enforced by default. Policy-as-code prevents misconfigurations before deployment, permissions match what workloads actually use, and the organisation knows its security posture at any moment. Serious issues are detected and fixed within hours, incident response is rehearsed for cloud-specific scenarios, and security scales with the environment without adding manual overhead or slowing delivery.

The 6 areas assessed

1. Cloud Identity & Entitlements

How the organisation manages identities, roles, and permissions across its cloud environments. This area examines whether least-privilege principles are actively enforced, whether cross-account and cross-cloud access is governed, and whether permissions sprawl is detected and remediated. In the cloud, identity is the new perimeter — an over-permissioned role can bypass every network control you have.

2. Workload Protection

How the organisation secures the compute workloads running in cloud — virtual machines, containers, serverless functions, and managed services. This area covers image and artifact security, runtime protection, admission controls, and vulnerability management for cloud-native workloads. Ephemeral infrastructure demands security controls that are embedded at build time, not bolted on after deployment.

3. Configuration & Posture Management

Whether the organisation maintains a secure and compliant baseline across its cloud resources. This area assesses how misconfigurations are detected, whether compliance benchmarks are enforced, and how configuration drift is identified and corrected. Misconfiguration remains the leading cause of cloud security incidents — most breaches exploit what was left open, not what was cleverly hacked.

4. Cloud Data Security

How the organisation protects data stored and processed in cloud environments. This area covers encryption key management, storage access policies, data residency and sovereignty controls, and data loss prevention. Cloud makes data easier to share, replicate, and expose — security must keep pace with the speed at which data moves across services, regions, and accounts.

5. Cloud Network Security

How the organisation designs and enforces network controls in cloud environments. This area examines VPC architecture, security group management, egress controls, service endpoint configuration, and protection against web and DDoS attacks. While cloud security is increasingly identity-centric, network controls remain an essential layer of defence — especially for controlling east-west traffic and limiting blast radius.

6. Logging, Detection & Response

Whether the organisation can see what is happening across its cloud environments and respond effectively to threats. This area covers cloud-native logging, SIEM integration, automated remediation, and incident response adapted for cloud. The speed at which cloud resources can be created, modified, and destroyed means that traditional detection approaches — manual log review, weekly reports — are fundamentally inadequate.

How this model relates to other frameworks

This is an original, simplified maturity model and is not derived from or intended to replace any of the following. However, organisations that use this assessment may also find value in these established frameworks:

  • CSA Cloud Controls Matrix (CCM) — a comprehensive control framework for cloud computing security
  • NIST SP 800-144 / SP 800-210 — guidelines on security and privacy in public cloud computing and cloud access control
  • CIS Benchmarks for Cloud Providers — prescriptive configuration baselines for AWS, Azure, GCP, and other platforms
  • ISO/IEC 27017 — guidelines for information security controls in cloud services
  • MITRE ATT&CK Cloud Matrix — a knowledge base of adversary tactics and techniques specific to cloud environments

Frequently asked questions

What is the Cloud Security maturity model?

Assess how well your organisation secures its cloud environments and workloads. It is an original, simplified model with three maturity levels (Lift-and-Shift, Cloud-Aware and Cloud-Native), assessed through 24 questions across 6 areas: Cloud Identity & Entitlements, Workload Protection, Configuration & Posture Management, Cloud Data Security, Cloud Network Security and Logging, Detection & Response.

How long does the Cloud Security assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Lift-and-Shift), 2 (Cloud-Aware) or 3 (Cloud-Native). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.