Cloud Services

Every cloud implementation is unique, but there are native risks common to all. Whether you are looking for cloud advisory, cloud assurance or cloud consulting services, we know which risks to watch for to position your cloud environment for optimal success. We help you make sense of the rapid evolution in the industry in order to align the right technologies with the specific goals of your organization.

Our team has broad experience working across all cloud delivery models for providers and users of the services alike. We know Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), Software-as-a-Service (SaaS), Function-as-a-Service (FaaS) and more. We translate technical concepts and architectures into actionable items for your organization’ security and compliance needs.

For Cloud Service Providers, we:	For Cloud Consumers, we:
Consult on the design of compliance programs over frameworks such as SOC, ISO, or PCI; assessing the program’s readiness; and/or perform the examination. Assist in evaluating and guarding against third-party risks; designing and implementing continuous monitoring activities; and testing the security of cloud offerings.	Support you for the entire journey by helping design procurement processes that align internal and external requirements to cloud features and capabilities, evaluating whether the implementation will meet your unique risks of operating in the cloud, and assessing how cloud-based workloads and users meet your customers’ requirements.

We have extensive experience with these compliance standards and frameworks:

SSAE 21 – SOC for Service Organizations, SOC for Cybersecurity, Direct-Examinations and Assertion-based Examinations
Payment Card Industry Data Security Standards (PCI DSS)
Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) and Security, Trust, Assurance, and Risk (STAR 2)
National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), 800-53, 800-63, and 800-171
Center for Internet Security (CIS) Controls
Cyber Risk Institute (CRI) Profile
ISO 27001 / 27017 / 27018

We can:

Design and review your organization’s cloud strategy and roadmap
Evaluate the security of Personally Identifiable Information (PII) and Personal Health Information (PHI)
Design and readiness for compliance programs and information security management system (ISMS)
Provide attestation, certification, and examination of compliance programs and information security management systems (ISMS)
Design and implement continuous monitoring and cloud inventory monitoring programs
Conduct IT internal audit and reviews
Provide cybersecurity services including maturity assessments, penetration testing, and vulnerability assessments
Conduct assessments of cloud-based Disaster Recovery (DR) plans, Identity and Access Management (IAM), security over assets and data stores, and third-party interfaces

Download Continuous Monitoring Presentation Here.

Operating in the cloud can create challenges. No matter the problem, we help find solutions.

Cloud Providers

	Continuous Monitoring Preparing and implementing a cloud continuous monitoring program to support compliance and contractual requirements on an ongoing basis.
	Compliance Assessments Examination and readiness assessment for CIS, HIPAA, ISO 27001, ISO 27017, ISO 27018 , NIST, PCI-DSS, SOC 1, SOC 2, SOC for Cyber, and SOC for Supply Chain.
	CSA STAR Design and Examination Designing a compliance program for CSA STAR 2 or STAR 3 certification, and performing a STAR 2 certification audit.

Providers & Consumers

	Cloud Cybersecurity Cybersecurity and vulnerability assessments, penetration tests, cybersecurity maturity assessments and roadmaps.
	Cloud-Native Disaster Recovery Designing, implementing and testing DR policies aligned to cloud delivery models to preserve against first-party and third-party risks.
	Internal Audits and Reviews Identity and Access Management (IAM) controls, security over assets and data stores, third-party interfaces and integrations, etc.

Cloud Consumers

	Cloud Policy & Procedures Adapting existing change management, logical access and other policies for cloud-native risks and features to meet operational, regulatory and security needs.
	Cloud Roadmaps and Strategies Roadmaps supporting cloud strategies ranging from first-cloud deployment to multi-cloud and multi-region implementations.
	Managing Change in the Cloud Designing and testing processes to prevent unsanctioned use of cloud resources, maintain an inventory of cloud assets and reduce risks of shadow cloud deployments.