Your First Cloud Security Audit: An Irish Checklist BuiltBrilliant

The first cloud security audit a business runs is rarely sophisticated, because it does not need to be: the basics are missing, and finding them is the point. This is the checklist we run for Irish companies, in the order the findings matter.

1. Identity: who can touch what

MFA enforced on every account, including service accounts and the root account.
Least privilege by default: no shared admin logins, no access broader than the role needs.
Offboarding happens the day someone leaves, not the month after.

Identity is where most cloud breaches start, and the cloud IAM service exists because it is the highest-leverage fix. Our IAM and SOC 2 case study shows the before and after of doing it properly.

2. Exposure: what faces the internet

Public buckets and databases are the classic accidental leak, check every storage bucket and database for public access.
Security groups and firewalls restricted to what is actually needed, per service.
No secrets in code, repositories, or logs, the rule from our API security guide.

3. Data: where it lives and who backs it up

Data residency confirmed per service, the region discipline from our cloud guide.
Backups exist, off-site, and tested, the 3-2-1 rule.
Retention rules delete what should not exist, which is security and GDPR at once.

4. Monitoring: would you notice

Logging enabled on the systems that matter, with alerts for anomalies.
The incident response list is names, not intentions: who is called, who decides, who reports, with the 72-hour GDPR clock in mind.

The cadence

Run the basics quarterly, and a deeper review annually or after any major architecture change. The businesses that treat the audit as a habit, not an event, are the ones whose findings are small, which is the pattern from our data plane hardening case study.