Product · Frameworks

Findings tied to frameworks your auditors already use

We do not invent a private scoring language. Every material finding is ranked by real risk and mapped to the controls boards, insurers, and buyers already ask about.

Take free readiness check Request a health check

Baseline & architecture

CIS Benchmarks — CIS Benchmarks for AWS, Azure & GCP
NIST CSF — NIST Cybersecurity Framework 2.0
ISO 27001 — ISO/IEC 27001:2022

Industry & trust

SOC 2 — SOC 2 — System and Organization Controls 2
HIPAA — HIPAA Security Rule
PCI-DSS — PCI-DSS v4.0.1
GLBA — Gramm-Leach-Bliley Act — Safeguards Rule
HITRUST — HITRUST CSF
FFIEC — FFIEC IT Examination Handbook

Public sector & critical

CMMC — Cybersecurity Maturity Model Certification (CMMC)
FedRAMP — FedRAMP

Regional & privacy

US state privacy laws, GDPR, and Canadian regimes — mapped to your cloud.

Regional privacy overlays

A health check finds and prioritizes real exposure. It is not a certification or a promise you will never be breached — closing the findings is what changes your risk. Mapping is guidance for prioritization and evidence — not a certification.

Assessment domains

Where findings come from

Identity & access (IAM)

Over-privileged roles, stale keys, missing MFA, risky trust policies, and cross-account access. The number-one cause of cloud breaches — assessed first.

Data security & storage

Public buckets and blobs, unencrypted stores, unmanaged snapshots, and where your crown-jewel data actually lives across accounts, projects, and tenants.

Network exposure

Open security groups and firewall rules, exposed management ports, unnecessary public endpoints, and segmentation gaps between workloads.

Logging & monitoring

CloudTrail / Cloud Audit Logs coverage, log retention and integrity, and whether you could actually detect and reconstruct an incident.

Configuration & posture

Baseline drift against CIS Benchmarks and provider best practice across every account, project, subscription, and tenant — the misconfigurations scanners miss.

Framework mapping

Every finding tied to the frameworks your industry answers to — SOC 2, HIPAA, PCI-DSS, GLBA, ISO 27001, CMMC, FedRAMP — plus the privacy law of your region.