AWS Security Assessment
196 questions on one AWS estate; a read-only collector proposes, an assessor accepts or overrides.
196 controls · 12 pillars · 40 categories · evidence can be collected automatically
196 questions on one AWS estate; a read-only collector proposes, an assessor accepts or overrides.
196 controls · 12 pillars · 40 categories · evidence can be collected automatically
An estate accumulates accounts, administrative roles, public endpoints and forgotten data stores faster than any annual review covers, and the breach that follows is usually a setting somebody could have seen. This assessment produces an independent scored position on that estate and a remediation list the board can track to closure. It is our own assessment and not an official Amazon review, audit or certification.
196 questions across 12 pillars and 40 categories: account and organisation governance, identity, privileged access, audit logging, detection and posture, network exposure, data and storage, keys and secrets, compute hardening, application and edge exposure, backup and recovery, and managed AI services with the delivery pipeline. A read-only collector runs against the estate first and pre-populates answers, so the session with your team is spent on judgement rather than on fetching settings. Setting up the read-only role takes an afternoon, there is no change freeze, and nothing is written to the estate.
The collector enumerates the estate through the provider's own read APIs: organisation membership and account guardrails, IAM principals and access key age, root user multi-factor registration, trail configuration and log destination protection, configuration recording coverage, security group ingress and public address allocation, bucket and snapshot exposure, default encryption and key rotation, secret rotation age, instance metadata service version and patch compliance, container and function posture, API and load balancer TLS policy, backup coverage and deletion protection, and registry and deployment identity. Each signal becomes a suggested answer with its raw value printed beside it, and the assessor accepts it or overrides it with a reason that stays in the report, so nothing scores purely because a script said so. A control the collector could not read - a denied permission, a region outside the agreed list - is recorded as not evidenced and never scored as a failure.
196 controls across 12 pillars and 40 categories. Every one is scored, and a control nobody can answer is recorded as unanswered rather than counted as a pass.
A read-only script collects configuration from the estate using credentials you issue and revoke afterwards. Each signal becomes a suggested answer with its raw value attached, which an assessor accepts or overrides on the record.
It reads configuration, not traffic, so it cannot tell you whether an open path was ever used - and anything it could not read is marked not evidenced rather than scored.
Account separation, egress control and private connectivity decide whether a sensitive workload is actually contained, and the governance, network and data pillars score all three against collected configuration.
Operational resilience work wants the cloud estate evidenced rather than attested, which is what the 15 audit logging questions and the 14 on backup and recovery produce.
Patient data in object storage and managed databases is the recurring exposure, and the data protection pillar's 19 questions begin with what is reachable from the internet.
A fixed fee for the engagement, not an annual licence. The band follows the size of the bank: this one is broad at 196 controls.
£4,500
Per engagement, excluding VAT.
£12,000
Per engagement, excluding VAT.
Hold three or more and the Combined Security View is produced at no extra charge: it is derived from the banks you already hold rather than assessed again. See the full assessment rate card, or build a quote with this assessment in it.
There are 16 of them, and the honest answer is that most organisations need two or three rather than all of them. Tell us what you run and what you are being asked to prove.