An AWS security assessment is a structured, evidence-based review of how an AWS environment is configured, governed and operated. It measures the environment against recognised best practices, identifies security and compliance gaps, and produces a prioritised remediation plan.
A complete assessment covers identity and access management, network security, data protection, encryption and key management, logging and monitoring, vulnerability management, workload security, backup and disaster recovery, incident response, governance, compliance and configuration security. It should follow a defined sequence rather than rely on a single scan:
Discovery + Configuration Review + Evidence Collection + Control Mapping + Risk Assessment + Gap Analysis + Remediation Planning + Continuous Monitoring
Executive Summary
AWS environments change continuously as new accounts, workloads and permissions are added. Under the AWS Shared Responsibility Model, the customer is responsible for security in the cloud, and most exposure comes from customer-side misconfiguration: over-privileged identities, unintended public access, logging gaps and weak governance.
Automated tools such as AWS Security Hub are valuable, but they cannot judge business context or confirm whether an exposure is intentional. Evidence validation and expert judgement are needed to separate genuine risk from acceptable design.
ServQual provides structured AWS security assessments delivered by security professionals. Its SUSAN platform then helps keep findings, evidence and remediation status current between assessments.
Why AWS Security Assessments Matter
These four activities are often confused, but each answers a different question.
| Activity | Question It Answers |
|---|---|
| Security Monitoring | Is something happening right now? |
| Security Assessment | How strong is our posture, and where are the gaps? |
| Security Audit | Do our controls meet a defined standard? |
| Penetration Testing | Can an attacker exploit a specific weakness? |
An assessment is advisable after a new AWS deployment, cloud migration, major architecture change or security incident. It is also advisable before compliance audits, after mergers or account consolidation, before exposing new workloads to the Internet, and at least annually.
AWS Security Assessment Checklist
Apply these checks to every in-scope account and Region, not only production.
| Domain | Key Checks |
|---|---|
| IAM and Access | Root MFA and no root keys; MFA for all users; least privilege; no stale keys or dormant users; cross-account trust reviewed |
| Network | Private subnets for internal workloads; no 0.0.0.0/0 to ports 22 or 3389; VPC Flow Logs enabled; public resources justified |
| Data Protection | S3 Block Public Access; encryption at rest with AWS KMS; secrets in Secrets Manager; data classified and retained by policy |
| Logging and Monitoring | CloudTrail in all Regions; logs centralised and protected; retention defined; alerts for high-risk events |
| Threat Detection | GuardDuty and Security Hub enabled in all Regions; Macie where data warrants; findings owned and triaged |
| Workloads | IMDSv2; hardened AMIs; automated patching; EBS encryption; least-privilege Lambda, ECS and EKS roles |
| Vulnerability Management | Amazon Inspector coverage; container image scanning; end-of-life software tracked; Internet-facing assets prioritised |
| Backup and Recovery | AWS Backup coverage; RTO and RPO defined; backups encrypted and isolated; restores tested |
| Incident Response | Cloud playbooks; escalation contacts; evidence preservation; lessons learned recorded |
| Governance | Approved policies; named asset owners; change control; third-party access reviewed; compliance scope defined |
AWS Security Assessment Methodology
- Scope definition: agree AWS accounts, Regions, workloads, business-critical applications and objectives.
- Asset discovery: inventory EC2, S3, RDS, VPCs, IAM, Lambda, containers, load balancers, security services and Internet-facing assets.
- Configuration assessment: review settings against the CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices.
- Evidence collection: capture dated IAM, CloudTrail, Security Group, S3 and encryption settings, security findings and policies.
- Control mapping: map findings to the AWS Well-Architected Security Pillar (design guidance), CIS (technical baseline), NIST CSF (risk outcomes), ISO/IEC 27001 (certifiable ISMS) and SOC 2 (attestation) as applicable.
- Gap assessment: record each gap as Finding → Evidence → Security Risk → Business Impact → Recommended Control → Priority → Owner.
- Remediation roadmap: group actions into Immediate, Short Term, Medium Term and Long-Term phases.
- Validation: re-test remediated findings and update the evidence.
- Continuous monitoring: use AWS Config, Security Hub and periodic reassessment to detect drift.
Where ServQual and SUSAN Fit
Where ServQual and SUSAN fit · 5 assessment phases
ServQual professionals perform each phase of the assessment. SUSAN holds the evidence, risk scores and remediation status so that the next cycle starts from a current baseline.
Example AWS Security Assessment Finding
Hypothetical example for illustration only. It does not describe any actual customer or incident.
| Field | Detail |
|---|---|
| Finding | Publicly accessible S3 bucket |
| Evidence | Bucket policy, Block Public Access settings, Security Hub and IAM Access Analyzer findings |
| Risk and Impact | Unauthorised access to business data, with possible compliance and reputational impact |
| Recommendation | Enable Block Public Access, apply a least-privilege bucket policy and monitor policy changes |
| Mapping | CIS AWS Foundations Benchmark; Security Hub S3.1; NIST CSF PR.DS; ISO/IEC 27001 A.8.3; SOC 2 CC6.1 |
| Priority and Owner | Critical; cloud platform team |
| Status | Open / In Progress / Remediated |
How ServQual Supports AWS Security Assessments
ServQual is a UK-headquartered cybersecurity, GRC and compliance firm with support presence across the UK, India and the USA. Its Cloud Security Services cover AWS, Azure, Google Cloud and Microsoft 365. For AWS, the assessment focuses on IAM users, roles and permissions, MFA and privileged access, S3 exposure, logging and monitoring, compute access posture, encryption, network exposure and compliance evidence.
Findings connect directly to related ServQual services, including ISO 27001 and SOC 2 readiness, vulnerability assessment and penetration testing, Managed SOC, Incident Response and GRC and audit support.
How the Engagement Works
- Discovery workshop: agree scope, accounts, Regions and compliance drivers.
- Evaluate: review AWS configuration, then collect and validate evidence.
- Analyse and map: rate each finding by risk and map it to relevant frameworks.
- Design: build a phased remediation roadmap with named owners.
- Validate and monitor: re-test fixes and maintain evidence, optionally through SUSAN.
How SUSAN Can Support the Assessment Lifecycle
SUSAN (ServQual Unicorn Security Assessment Nexus) is ServQual’s AI-driven cybersecurity, privacy and GRC platform. It supports continuous assurance across more than 13 frameworks, including ISO 27001, SOC 2, NIST CSF and CIS Controls. It is available through AWS Marketplace and integrates with AWS, Azure, Microsoft 365, Google Cloud and major SIEM platforms.
| SUSAN Module | Role in an AWS Assessment |
|---|---|
| Cloud Security Validation | Visibility of IAM, MFA, S3 exposure, logging, encryption and compute posture |
| Continuous Monitoring and Evidence | Evidence ownership, control mapping and freshness checks |
| AI Risk Scoring | Prioritises findings by control impact and business risk |
| Global Compliance and Trust | Maps one piece of evidence to several frameworks |
| Unified GRC Dashboard | Single view of risks, remediation and audit readiness |
ServQual states that SUSAN uses AES-256 encryption, TLS 1.2 or higher, MFA, role-based access and regional data residency, and that customer data is not used for AI training.
The roles are distinct. ServQual professionals scope the work, interpret configuration in business context, validate evidence and judge risk. SUSAN organises, tracks and monitors the results. Automation supports expert assessment; it does not replace it.
ServQual Assessment Deliverables
| Deliverable | Kept Current In SUSAN |
|---|---|
| Executive Summary and Management Report | Unified GRC Dashboard |
| AWS Asset Inventory | Asset Inventory |
| Completed Assessment Checklist and Configuration Review | Cloud Security Validation |
| Security Findings and Risk Register | AI Risk Scoring |
| Compliance and Control Mapping | Global Compliance and Trust |
| Evidence Register | Continuous Monitoring and Evidence |
| Gap Analysis and Prioritised Remediation Roadmap | Remediation tracking |
| Technical Report | Not applicable |
| Reassessment and Validation Report | Continuous Monitoring and Evidence |
Common AWS Security Assessment Gaps
Gaps frequently tested in AWS assessments include excessive IAM permissions, missing MFA, long-lived access keys, publicly accessible resources, open Security Group rules, incomplete CloudTrail coverage, short log retention, no centralised monitoring, unencrypted data, secrets stored in code, missing vulnerability scanning, untested backups, no cloud incident playbooks, unclear asset ownership and incomplete compliance evidence. These are general examples, not findings from any specific organisation.
Manual, Automated and Hybrid Assessment
| Approach | Strength | Limitation |
|---|---|---|
| Manual | Context and expert judgement | Time-consuming |
| Automated | Fast and scalable | Lacks business context |
| Hybrid | Automation with expert validation | Needs a structured method |
The methodology in this article favours a hybrid approach: automated discovery for coverage, and expert review for validation and prioritisation.
“AWS security is not a one-time configuration check. A strong assessment combines evidence, business context and continuous monitoring to keep cloud risk visible as the environment changes.”
Rohan Kanthe
Sr. IT Engineer | ServQual
FAQ
Most frequent questions and answers
An AWS Security Assessment is a structured, evidence-based review of how an AWS environment is configured, governed and operated. It identifies security and compliance gaps and supports a prioritized remediation plan.
It should assess IAM and access, network security, data protection, encryption and key management, logging and monitoring, threat detection, workloads, vulnerability management, backup and recovery, Incident Response, governance and compliance.
The article recommends assessment at least annually and after major deployments, migrations, architecture changes, acquisitions or security incidents.
No. AWS Security Hub automates checks and aggregates findings, but expert review is still needed to understand business context, governance and risk priority. AWS Security Assessment Checkli…
A security assessment evaluates the overall security posture and control gaps, while penetration testing attempts to exploit specific weaknesses. The two approaches are complementary.
Yes. Findings can be mapped to frameworks such as ISO/IEC 27001, SOC 2, NIST CSF, CIS and the AWS Well-Architected Security Pillar where applicable.
ServQual supports scoping, configuration review, evidence validation, risk and framework mapping, remediation planning, re-testing and ongoing monitoring.
SUSAN can maintain findings, evidence, risk scores, remediation ownership and compliance mapping between assessments, while expert assessment remains with ServQual professionals.
Strengthen Your AWS Security Posture
Identify security gaps, validate controls, prioritise remediation and maintain a current AWS security baseline with ServQual and SUSAN.
Disclaimer:This checklist is provided for general security assessment guidance and does not guarantee compliance, certification, audit success, or the elimination of security risk. Assessment scope and findings will vary based on each organization’s AWS environment, architecture, business context, and applicable requirements. AWS and related service names are trademarks of Amazon Web Services, Inc. or its affiliates.
