Most companies now run key systems on AWS, Azure, Google Cloud or SaaS platforms, and outsource parts of IT to managed service providers. You can outsource the work, but not the accountability. When you audit cloud computing and outsourced operations, you check that both the provider and your own team meet their security duties.
This guide explains the shared responsibility model, what evidence to ask providers for, useful tools, the audit steps and a practical checklist.
Start with shared responsibility
In the cloud, security is split between the provider and the customer. The split depends on the service model:
| Service model | Provider secures | You secure |
|---|---|---|
| IaaS (for example, virtual machines) | Data centres, hardware, hypervisor | Operating system, network rules, apps, data, identities |
| PaaS (for example, managed databases) | Platform and runtime too | Configuration, access, data |
| SaaS (for example, Microsoft 365) | Almost the whole stack | User access, settings, data sharing, retention |
Most cloud breaches come from the customer side, such as public storage buckets, weak admin passwords or excessive permissions. Therefore, the audit must cover your own configuration, not just the provider.
Evidence to request from providers
You usually cannot audit a hyperscaler’s data centre yourself. Instead, rely on independent reports:
- ISO/IEC 27001 certificates, ideally with ISO/IEC 27017 (cloud security) and ISO/IEC 27018 (personal data in the cloud);
- SOC 2 Type II reports, which test controls over a period;
- CSA STAR entries based on the Cloud Controls Matrix;
- penetration test summaries and incident history for smaller providers.
Always check the scope. The report must cover the service and region you actually use.
Tools for the audit
- Native posture tools: AWS Security Hub, Microsoft Defender for Cloud and Google Security Command Center flag misconfigurations.
- Open-source scanners: tools such as Prowler or ScoutSuite check accounts against CIS Benchmarks.
- Identity reviews: export users, roles and access keys to find unused or over-privileged accounts.
- Contract and SLA review: compare promised controls with reports and incident records.
Steps to perform the audit
- Inventory: list cloud accounts, subscriptions, SaaS apps and outsourcing contracts. Look for “shadow IT” through finance and SSO records.
- Classify: note which services hold sensitive or regulated data.
- Review contracts: check security clauses, breach notification, data location, subcontractors and exit terms.
- Collect assurance: gather certificates and reports, and read the exceptions they list.
- Test your configuration: run posture scans and review identities, logging, encryption and backups.
- Report: rank findings, agree on owners, and schedule follow-up.
Checklist
Governance and contracts
- A cloud and outsourcing policy defines approval and risk assessment for new services.
- Contracts include security duties, audit rights or report access, and breach notification times.
- Contracts state where data is stored, which matters under laws such as India’s DPDP Act.
- An exit plan explains how you will retrieve and delete data.
Identity and access
- Admins use MFA, and the root or global admin accounts are locked away.
- Single sign-on controls access to SaaS apps where possible.
- Roles follow least privilege, and access reviews happen regularly.
- The team rotates long-lived access keys or replaces them with short-lived credentials.
Configuration and data
- Nobody can reach storage buckets and databases publicly unless that is intended.
- Encryption protects data at rest and in transit.
- Backups exist outside the main account, and the team tests restores.
- Logging, such as AWS CloudTrail or Azure activity logs, stays on and protected.
Outsourced operations
- The provider’s staff use named accounts with MFA, not shared logins.
- You receive regular reports on service levels, incidents and changes.
- You review the provider’s performance and security at least once a year.
Related guides
Sources
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
