Architecture blueprint · Review & hardening
A cloud that's locked down from day one.
Review of cloud, server, identity and network configuration, hardened to best practice and NCA's Cloud Cybersecurity Controls.
- Legend
- 1Identity & access
- 2Network boundary
- 3Compute & servers
- 4Data & storage
- 5Logging & monitoring
- Project
- Your cloud estate
- Scope
- Public · private · hybrid
- Reference
- CIS · CCC
- Not to scale
- NTS · REV D
Every layer has its own settings and its own usual mistakes. Pick one to see what we review.
Identity & access
Who can do what, and with which key.
What we review
- IAM.1Root and owner accounts, and MFA on each of them
- IAM.2Roles and policies that grant broad permissions for no reason
- IAM.3Unused users, and access keys that never expire
- IAM.4Cross-account trust and single sign-on
Typical risk: One over-privileged key leaks in code and opens the whole account.
The dividing line moves with the service model, but data and identity are always yours. That's exactly where we work.
A simplified split; details vary by provider and service, and we pin it down for your setup on the scoping call.
- CLD-S01Least-privilege roles, no blanket adminCIS · CCC
- CLD-S02MFA on every privileged accountCIS · CCC
- CLD-S03Encryption at rest and in transit, managed keysCCC
- CLD-S04No storage publicly accessible by defaultCIS
- CLD-S05Admin ports closed to the internetCIS
- CLD-S06Audit logging on across accounts and regionsCIS · CCC
- CLD-S07Backups isolated, encrypted and testedCCC
- CLD-S08Hardened, patched servers and imagesCIS
Every item appears in the report with its current state, its impact and the steps to fix it.
CCC
NCA's Cloud Cybersecurity Controls (CCC)
The Cloud Cybersecurity Controls build on the Essential Cybersecurity Controls (ECC) and set requirements for both cloud service providers and the organizations that use them. We map every finding in our report to its matching control, so each fix doubles as compliance evidence.
Related frameworks
- CCC
- ECC
- ISO 27001
- NIST CSF
- RevA
Architecture review
We map how your estate is built: accounts, networks, data flows and entry points.
- RevB
Configuration audit
We audit configuration with read-only access, by hand and with tooling, against the benchmarks.
- RevC
Hardening
We rank findings by risk and work with your team to close them.
- RevD
Continuous checks
We re-check on a schedule so settings don't drift with every change.
- 1.You're migrating to the cloud or running a hybrid environment.
- 2.Permissions have grown over time and nobody has reviewed them.
- 3.You need your configuration aligned with NCA's CCC.
- IN-01Read-only access to your cloud accounts
- IN-02A simple architecture and network diagram
- IN-03A list of critical systems and sensitive data
A short list we go through together on the scoping call.
- CLD-01Configuration review
- CLD-02Identity & access
- CLD-03CIS benchmarks
- An NDA before we start
- A report in Arabic and English
- An executive summary for leadership
- Findings shared over secure channels only
A short scoping call, read-only access, and a report in Arabic and English.