IAM & Access
- Privileged account inventory and root/global admin protection
- MFA coverage and phishing-resistant factors
- Over-permissive roles, policies and unused entitlements
- Federation, service principals and workload identity
Cloud Security Assessment · AWS, Azure & hybrid
Know Your Cloud Risks. Fix What Matters.
Independent security assessment for AWS, Azure and hybrid cloud environments — focused on real exposure, prioritised risks and an actionable remediation roadmap.
From €497 · Delivered remotely across Europe, Portugal and Brazil
Scoring methodology
One score, seven domains, no ambiguity
Every assessment produces a comparable score so you can track posture over time and explain it to people who do not read control matrices.
ASNC Cloud Security Score
0 – 100
A single, comparable indicator of your cloud security posture, derived from control coverage across the seven assessment domains and weighted by exposure.
0–39
Critical
Material exposure requiring immediate action.
40–59
High Risk
Significant control gaps across several domains.
60–74
Moderate
Baseline controls present, key gaps remain.
75–89
Good
Consistent controls with targeted improvements.
90–100
Advanced
Mature, automated and continuously validated.
The ASNC Cloud Security Score is an ASNC assessment methodology. It is not a certification, accreditation or independently verified rating.
What we assess
Seven domains, reviewed against your live configuration
We assess what is actually deployed — not what a policy document says should be deployed.
Network Security
- Internet-facing exposure and open management ports
- Security group, NSG and firewall rule review
- Segmentation, peering and egress control
- Public endpoints on managed services
Data Protection
- Public object storage and anonymous access
- Encryption at rest and in transit, key ownership
- Secrets management and hardcoded credentials
- Backup, retention and recovery configuration
Logging & Detection
- Coverage of control-plane and data-plane audit logs
- Centralisation, retention and tamper protection
- Alerting on high-risk identity and network events
- Native security services enabled per region and account
Compute & Kubernetes
- Instance, container and serverless hardening baselines
- Cluster API exposure, RBAC and admission policy
- Image provenance, vulnerability and patch posture
- Runtime protection and privileged workload usage
Governance & Compliance
- Account, subscription and tenancy structure
- Guardrails: SCPs, Azure Policy and organisation constraints
- Tagging, ownership and asset accountability
- Control mapping to your applicable frameworks
DevSecOps
- Infrastructure-as-code scanning and drift control
- Pipeline permissions, OIDC and secret handling
- Branch protection, review and approval gates
- Dependency and artefact supply-chain checks
Interactive discovery
Turn your cloud context into focused assessment priorities
Answer a short series of focused questions and receive a tailored starting point for an ASNC security assessment.
Guided assessment
Build your assessment priorities
Describe your environment in plain language. ASNC’s AI guide will ask focused questions, then organise the areas that deserve validation first.
AWS, Azure, hybrid and multi-cloud context
Saved securely for this browser so you can return
Priorities, rationale, actions and recommended package
Discovery progress0%
Restoring your assessment…
This guided output is preliminary and is not an audit, certification, vulnerability scan or guarantee of security.
Packages
Fixed-scope, fixed-price engagements
Choose the depth you need now. Assessment fees are credited against a subsequent Security Advisory subscription where scope overlaps.
Quick Assessment
€497one-off
48–72 hours
A fast, focused review of your live cloud configuration and the exposure that matters most right now.
- Cloud security configuration review
- IAM and MFA coverage review
- Network exposure analysis
- Firewall and security group review
- Logging configuration review
- Encryption review
- Top risks identified and ranked
- Remediation recommendations
- Executive report
- 1-hour findings workshop
Prices exclude VAT. Scope confirmed before engagement.
Professional Assessment
Most complete€997one-off
5–7 business days
Everything in Quick, plus architecture review, a full risk register and a sequenced remediation roadmap.
- Everything in the Quick Assessment
- Cloud architecture review
- Prioritised risk register
- Compliance and control mapping
- 30/60/90-day remediation roadmap
- 2-hour technical workshop
Prices exclude VAT. Scope confirmed before engagement.
Security Advisory
€750/ month
Ongoing, monthly
Continuous architect support after the assessment, so the roadmap actually gets delivered.
- Monthly security reviews
- Architecture guidance
- Risk management support
- Technical advisory on demand
- Monthly report
Prices exclude VAT. Scope confirmed before engagement.
What you receive
Deliverables your teams can act on
Executive Summary
A board-readable view of posture, exposure and what to decide.
Security Score
Your ASNC Cloud Security Score with the per-domain breakdown behind it.
Prioritised Risk Register
Findings ranked by exposure and business impact, with owners.
Technical Recommendations
Specific, actionable fixes written for the engineers applying them.
30/60/90-day Roadmap
Sequenced remediation that fits change windows and team capacity.
Executive Report
The consolidated written deliverable, ready to circulate internally.
Security Workshop
A live session to walk findings, challenge them and agree next steps.
Example output
What a findings summary looks like
The figures and findings below are an illustrative example built to show report structure. They are not client data and not a prediction of your results.
Illustrative example — not client data
- Critical
- 2
- High
- 7
- Medium
- 13
- Low
- 8
- Critical
Public storage exposure
An object storage bucket permits anonymous read access to files that appear to contain internal operational data. Remediation: block public access at account level, scope bucket policy to named principals and review access logs for prior retrieval.
- High
Excessive IAM privileges
Several human and automation identities hold broad administrative policies well beyond observed usage. Remediation: right-size to least privilege from access history, split automation roles per pipeline and require approval for privilege escalation.
- Medium
Incomplete centralised logging
Audit logging is enabled inconsistently across accounts and regions, with short retention and no tamper protection. Remediation: enforce organisation-wide logging, ship to a dedicated append-only account and set retention to your regulatory minimum.
Remediation roadmap
A 30/60/90-day plan, sequenced by exposure
Fix what is exposed first, then close structural gaps, then make the improvement durable.
Days 0–30
Reduce exposure
- — Close public storage and internet-facing management access
- — Enforce MFA on privileged and break-glass accounts
- — Remove unused high-privilege roles and stale credentials
Days 31–60
Strengthen controls
- — Centralise and retain audit logging across accounts and regions
- — Baseline network segmentation and egress control
- — Standardise encryption and key ownership on data services
Days 61–90
Build security maturity
- — Codify guardrails and detections in version control
- — Wire findings into engineering backlogs with owners and SLAs
- — Establish recurring posture review and control validation
Compliance mapping
Findings mapped to the frameworks that govern you
One set of technical findings, expressed in the language of each framework your organisation reports against.
ISO 27001
Annex A control alignment for cloud infrastructure.
NIST CSF
Findings mapped across Identify, Protect, Detect, Respond, Recover.
CIS Controls
Configuration findings mapped to CIS benchmark expectations.
NIS2
Technical measures relevant to essential and important entities.
DORA
ICT risk and resilience controls for financial entities.
GDPR
Technical measures relevant to personal data protection.
PCI DSS
Cloud-hosted cardholder environment control considerations.
This service is a technical security assessment with control mapping. It is not a compliance audit, certification, attestation or legal opinion, and it does not confer compliance with any framework or regulation.
FAQ
Common questions before booking
How booking works
- 01 — We confirm scope, package and price by email.
- 02 — NDA signed and read-only access arranged.
- 03 — Assessment runs; report and score delivered.
- 04 — Workshop to walk findings and agree the roadmap.
Prefer to talk first?
Use the general contact form to reach an architect about a broader programme, or explore our wider cloud security engineering services.
Contact ASNC