Technical self-check · about 4 to 6 minutes

Cloud & identity

Follow permissions, exposure and recovery. Rate 12 original prompts as Operating, Partial, Planned, Not in place or Not sure, see your readiness by area, and get a remediation template for every gap. Everything stays in your browser.

12 prompts4 areas100% privateFree

Start this assessment See all 15

Scope. 12 vendor-neutral screening prompts, informed by cloud security principles. No account connection, live scan or cloud certification. Reference: AWS Well-Architected security pillar (context only, not an endorsement).

What this assessment covers

The 12 prompts, grouped by area. Each one has a "what to look for" note and a concrete action inside the assessment.

Identity

Are privileged identities protected with strong authentication?
Are workload permissions limited to their actual purpose?
Are long-lived secrets managed and rotated?

Exposure

Is internet-facing exposure intentionally approved?
Are trust boundaries represented in the architecture?
Are risky configuration changes detected or reviewed?

Visibility

Are administrative events retained in a protected location?
Can alerts be tied back to an accountable service owner?
Have logging gaps been exercised safely?

Resilience

Can important data be recovered after account compromise?
Are infrastructure changes reproducible and reversible?
Are cloud responsibilities assigned between providers and your team?

How scoring works. Only rated prompts count toward the index. Not sure and unanswered prompts are reported separately and never scored as a pass or a gap. Gaps are listed highest priority first, each with a link to a matching template in the open GRC Documentation Kit. This is a conversation starter, not an audit or a certification.

Start the Cloud & identity assessment

Other assessments: NIST CSF 2.0 · ISO 27001 readiness · SOC 2 preparation · AI & agent security · SOC & incident readiness · Small business security · Web & API release readiness · Supplier security review · Backup & recovery readiness · Secure software delivery · Identity & privileged access · Mobile release readiness · Data protection operations · Security culture & role readiness