Cloud Baseline (CIS-Based)
206 hardening questions across five clouds, Kubernetes and MCP servers, scored per control.
206 controls · 7 pillars · 49 categories · evidence can be collected automatically
206 hardening questions across five clouds, Kubernetes and MCP servers, scored per control.
206 controls · 7 pillars · 49 categories · evidence can be collected automatically
Every environment you own arrived with defaults chosen for convenience, and the people who set it up are frequently no longer the people running it. This assessment establishes whether each environment meets a recognised hardening baseline, and prices the distance between where it is and where it should be. It tends to be the first assessment an auditor asks for, because almost every regime — ISO 27001, SOC 2, NIS2, DORA — wants configuration measured against a published standard rather than against local habit.
206 questions across seven environments and 49 categories: 29 on the Microsoft 365 and Entra ID tenant, 29 on Azure, 30 on AWS, 29 on Google Cloud, 24 on Oracle Cloud Infrastructure, 28 on Kubernetes and containers, and 37 on Model Context Protocol servers. Scope is additive, so an AWS-and-Kubernetes estate is 58 of the 206 and nothing else needs answering. Read-only collectors with reader-level credentials take the first pass, so interview time goes on the controls that need judgement, which makes this cheap enough to repeat quarterly rather than once a year.
Identity carries 43 of the questions: root and break-glass account protection, hardware MFA for administrators, subscription Owner and Contributor assignments inherited by habit, and service principal and service account key hygiene. From there it is audit trail completeness and retention, public exposure of storage and management interfaces, key and secret management with rotation, compute patching and organisation-level policy, then Kubernetes control plane exposure, cluster authorisation and service accounts, network policy, secrets held in the cluster, and image provenance and admission. The 37 MCP questions are the unusual part: transport binding and local exposure, token audience and passthrough, consent on delegated authorisation, state handle integrity, scope minimisation, server egress, provenance and sandboxing, and URL and command handling.
206 controls across 7 pillars and 49 categories. Every one is scored, and a control nobody can answer is recorded as unanswered rather than counted as a pass.
Read-only collector scripts query each provider's own API with reader-level credentials and return a machine score per control; the assessor then accepts it, overrides it with a note, or marks the control unreadable. A machine-scored control says so in the report, so a reader always knows which answers a person stood behind.
A baseline check sees configuration as it stood at scan time; it cannot tell you whether a setting was deliberately chosen for a reason that still holds, or whether it will survive the next deployment.
Segmented and air-gapped estates still run clusters, and the 28 Kubernetes questions apply with no internet route because the collectors only need reader credentials inside the boundary.
One productivity tenant plus one or two clouds is the usual shape, so scope reduces to the 29 Microsoft 365 and Entra ID questions plus whichever provider you actually run.
Audit trail completeness and key custody are what an ICT auditor opens with, and here they are 20 logging and detection questions and 20 secret and key questions.
Record loss in these sectors overwhelmingly follows a storage bucket or a management interface left reachable, which is what the 27 exposed-interface questions are built to catch.
A fixed fee for the engagement, not an annual licence. The band follows the size of the bank: this one is broad at 206 controls.
£4,500
Per engagement, excluding VAT.
£12,000
Per engagement, excluding VAT.
Hold three or more and the Combined Security View is produced at no extra charge: it is derived from the banks you already hold rather than assessed again. See the full assessment rate card, or build a quote with this assessment in it.
There are 16 of them, and the honest answer is that most organisations need two or three rather than all of them. Tell us what you run and what you are being asked to prove.