Cloud security, ISMS and privacy
I’ve assessed AWS and Azure security configurations, reviewed ISO/IEC 27001 policies, and carried out privacy reviews informed by India’s DPDP Act. The evidence and the next step differ for each kind of review.
Cloud configuration
I’ve reviewed access, encryption, network segmentation and recovery using CIS Benchmarks, CSA CCM and CAIQ. I start by identifying which accounts and services belong to the review and who owns them. Then I compare configuration evidence with the applicable requirement. For recovery, I look for recorded restore tests that support the stated recovery targets.
Policy and control gaps
I’ve reviewed ISMS policies on identity and access, assets, change, incidents and continuity. I’ve mapped controls across ISO/IEC 27001, IRDAI requirements and NIST guidance, and assessed governance gaps against the SAMA Cybersecurity Framework. I turn a requirement into a testable question, ask for evidence and record the gap and residual risk. The action plan should tell the owner what to change and what to bring back for retesting.
Where personal data appears
I’ve traced data through applications, APIs, logs, reports and exports. For a match in a log or report, I check why the value is there, who can read it and what would break if it were removed or masked. I’ve recommended minimisation, hashing, consent and retention controls where relevant.