Fee
Register to see indicative feesConfirmed in writing after scoping01 / Build & Advisory · Supporting
Cloud Security
Cloud adoption moved faster than cloud governance, and the configuration drift has not been measured.
Strategy & ArchitectureBuild and advisory
Typical duration
6 to 10 weeksDepends on the number of accounts, subscriptions and tenanciesPrimary artefact
Cloud control baselinePlus one moreWho leads it
Steve SharmaFounder & Principal04 / What this is
What Cloud Security is
An assessment and design engagement covering cloud configuration, identity, data protection and logging across your cloud estate.
And what this service produces
It produces an evidenced gap register against a named baseline, and a control design that prevents the drift recurring.
05 / Who it is for
Built for a real assurance trigger, not a badge project.
01
This fits when
- Your estate spans multiple accounts or multiple clouds.
- Your team has adopted cloud faster than it has governed it.
- An audit with cloud scope is coming.
02
The usual trigger
- An audit or customer questionnaire covers cloud controls.
- A misconfiguration was found.
- Cloud spend and footprint have grown without governance.
06 / The obligation
Why cloud misconfiguration persists despite the tooling
Most organisations have cloud security posture tooling and most still have misconfiguration, because the tooling reports drift and nobody owns closing it.
Builders change the configuration
Cloud configuration is changed by the people building, not by the people accountable for security, and the feedback loop between them is a ticket queue.
Enforce at deployment
A baseline that is not enforced at deployment is a baseline that is measured after the fact and negotiated afterwards.
Generic benchmarks bury the signal
Most posture tooling ships with a generic benchmark and reports every deviation from it as a finding. That produces a register of several hundred items, most of which are deliberate architectural choices rather than mistakes, and a platform team predictably stops reading it.
Justified deviations, documented
A baseline is only useful once the justified deviations are documented as justified. It is unglamorous work, and it is the difference between a register that shrinks and one that is regenerated unchanged every quarter.
A gap register without an owner and a preventive control is a list that will be regenerated next quarter, unchanged.
07 / What you receive
Two artefacts. Each one yours to keep.
- 01
Cloud control baseline
The target configuration per service, justified against your risk rather than a generic benchmark.
Baseline documentCloud platform team - 02
Configuration gap register
Every gap, its severity, and what closes it, prioritised and owner-assigned.
RegisterCloud and security teams
08 / Scope
The whole system is visible before work begins.
Posture assessment
- Configuration reviewed against the baseline
- Identity and permission review
- Public exposure and data path review
Baseline design
- Target configuration per service
- Justified deviations documented
- Guardrail design
Prevention
- Preventive controls at deployment
- Policy-as-code approach
- Exception process
Handover
- Register handed to named owners
- Remediation sequenced
- Review cadence
09 / Included / not included
A useful boundary is part of the deliverable.
Included
- Cloud posture assessment
- Baseline design
- Preventive control design
- Handover to named owners
Not included
- Remediation: We find and sequence. Closing gaps is your team or separate work.
- Tooling deployment: Vendor-neutral. We state requirements.
- Ongoing posture management: Not a managed service.
10 / How we do it
A traceable path from scope to evidence.
Posture assessment
Configuration, identity and exposure reviewed against a named baseline.
Baseline design
Target configuration with justified deviations.
Prevention and handover
Preventive control design, owners assigned, cadence set.
Mapped againstCIS BenchmarksISO/IEC 27001NIST Cybersecurity FrameworkEssential Eight (Australia)
11 / Timeline
6 to 10 weeks of work.
Elapsed time and customer effort are separated because they are not the same number.
Weeks 1 to 3
Posture assessment
Review configuration, identity and exposure against a named baseline.
Customer effort
Read access to cloud accounts, plus 2-3 interviews.
Weeks 4 to 7
Baseline design
Set the target configuration per service and document the justified deviations.
Customer effort
Two review cycles with the platform team.
Weeks 8 to 10
Prevention design and handover
Design the preventive controls, assign owners and set the cadence. Across the engagement, expect roughly 10-14 hours of your team's time.
Customer effort
One handover session.
Our work: 6 to 10 weeks
12 / Scope check
Test whether Cloud Security
is the right next move.
We will cover likely scope, cost and fit.
Book a confidential strategy sessionWith Steve Sharma, who would lead.13 / Who leads the engagement
Named lead. Direct assessment.
Your engagement lead
Steve Sharma
Founder & Principal
Leads the assessment and authors the baseline.
ASD-endorsed IRAP AssessorCISSPCREST
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Review leadership record14 / Why Cybersecurity Link
Three decisions.
Accountability.
Preventive controls, not just a register.
A gap list without a preventive control regenerates next quarter. We design the guardrail too.
Baseline justified against your risk.
Not a generic benchmark applied wholesale. Deviations are documented with reasons.
Vendor-neutral.
No product margin on cloud security tooling.
15 / The boundary
What this engagement does not claim.
Delivery
We assess and design. We do not remediate or deploy tooling.
Closing gaps sits with your team or separately scoped work.
Independence
We are vendor-neutral and take no product margin.
The baseline states requirements, not preferred tools.
Operations
We are not a managed security service.
We do not run posture management after handover.
Frameworks
One baseline, mapped across four references.
The work maps to the CIS Benchmarks, ISO/IEC 27001, the NIST Cybersecurity Framework and, for Australian organisations, the Essential Eight.
What moves the fee
Per additional major account, subscription or tenancy in scope.
Where two or more cloud providers are in scope.
A starting fee, confirmed in writing after scopingCloud control baseline and configuration gap registerPreventive control design and handoverRemediation and tooling deployment excluded
18 / How this fits
Where this sits in the wider programme.
19 / When this is not right
Sometimes the best recommendation is a smaller service, or a later date.
20 / FAQ
The questions that change the decision.
Because tooling reports drift and something has to own closing it and preventing it. If your register is already owned and shrinking, you may not need us, and we would rather find that out in the scoping call.
No. We find, sequence and design the preventive control. Closing gaps is your team or separate scoped work.
Yes, though it costs more where two or more providers are in scope, and we state that before you engage rather than after.
21 / Next move
If Cloud Security is what you need, the next step is a conversation about scope.
A 45-minute conversation with Steve Sharma, who would lead the engagement: what your scope looks like, what it involves, and whether this is the right service for you at all.