Cloud Architecture Audit for Newport Beach Businesses

Enforces sign-in rules based on user, device, location, and risk so access decisions adapt to context rather than relying on a password alone.

• •Are conditional access policies applied to all users, including administrators and service accounts?
• •Is access blocked or challenged for sign-ins from outside expected regions or from non-compliant devices?
• •Are policies tested in report-only mode before enforcement to avoid locking out staff?

Requires a second verification factor across cloud sign-ins so a stolen password does not grant access on its own.

• •Is MFA enforced on every account, with phishing-resistant methods for privileged users?
• •Are legacy authentication protocols that bypass MFA fully disabled at the tenant level?
• •Are break-glass emergency accounts documented, excluded carefully, and monitored?

Limits standing administrative access and grants elevated roles only when needed and for a fixed window, reducing the damage from a compromised admin account.

• •Is the number of permanent Global Administrators kept small and reviewed regularly?
• •Is just-in-time elevation used for privileged roles rather than standing assignments?
• •Are role activations logged and reviewed for unexpected use?

Divides cloud resources into separate subnets and security boundaries so a compromise in one workload cannot move laterally into others.

• •Are workloads separated into distinct subnets or virtual networks by function and sensitivity?
• •Are network security groups or security lists scoped to least privilege rather than allowing broad ranges?
• •Is east-west traffic between workloads inspected or restricted?

Keeps storage, databases, and management interfaces off the public internet by routing access through private connections.

• •Are storage accounts, databases, and admin interfaces reachable only through private endpoints or allowlisted addresses?
• •Has a recent scan confirmed no management ports are exposed to the open internet?
• •Are public-facing services placed behind a web application firewall?

Provides reliable, secure connections between your Newport Beach offices and cloud resources, with failover so a single circuit outage does not stop work.

• •Is connectivity between offices and the cloud encrypted through VPN or a dedicated private link?
• •Is there a secondary internet path or cellular failover for cloud-dependent operations?
• •Is latency to your primary cloud region measured and acceptable for daily applications?

Matches the size and tier of compute, storage, and database resources to actual usage so you stop paying for capacity you never consume.

• •Are virtual machines and databases sized against real utilization data rather than initial guesses?
• •Are idle or stopped-but-billed resources identified and decommissioned?
• •Are storage tiers aligned to access frequency, with cold data moved to lower-cost tiers?

Applies reservations or savings plans to steady-state workloads to lower the rate you pay compared with on-demand pricing.

• •Are predictable workloads covered by reservations or savings commitments?
• •Is reservation utilization reviewed so you are not paying for unused commitments?
• •Are commitment terms revisited as the environment changes?

Tags resources by department, project, or client and sets budget alerts so spend is attributable and overruns are caught early.

• •Are resources tagged consistently so cost can be allocated to a business owner?
• •Are budgets and anomaly alerts configured to flag unexpected spend?
• •Is a monthly cost review held to catch drift before it compounds?

Captures recoverable copies of Microsoft 365 data and cloud workloads in a separate location so data is restorable beyond native retention windows.

• •Are Exchange Online, SharePoint, OneDrive, and Teams backed up independently of native retention?
• •Are cloud-hosted servers and databases backed up to a separate account or region?
• •Have restores been tested to confirm the backups are usable?

Protects stored and moving data so that intercepted or exfiltrated information stays unreadable without the keys.

• •Is encryption enabled on all storage, databases, and backups?
• •Are encryption keys managed and rotated rather than left at default settings?
• •Is data encrypted in transit across all connections, including internal traffic?

Sets measurable recovery time and recovery point targets and places critical data so a single region failure does not halt the business.

• •Are recovery time and recovery point objectives defined for each critical workload?
• •Is critical data replicated to a second region or zone for resilience?
• •Has a recovery scenario been tested in the last 12 months?

Enforces organizational rules automatically so new resources are created within approved regions, sizes, and security settings.

• •Are policies in place to prevent disallowed regions, public exposure, or untagged resources?
• •Is configuration drift detected and reported against a documented baseline?
• •Are exceptions tracked with an owner and an expiration?

Collects sign-in, administrative, and resource activity logs into one place so unusual behavior can be investigated and retained for compliance.

• •Are sign-in and audit logs collected centrally and retained to meet your compliance needs?
• •Are alerts configured for high-risk events such as new admin assignments or mass downloads?
• •Can you reconstruct who changed what and when across the environment?

Continuously scores your cloud configuration against security benchmarks and surfaces misconfigurations before they are exploited.

• •Is a posture or secure-score tool reviewing the environment against recognized benchmarks?
• •Are high-priority recommendations triaged and remediated on a schedule?
• •Is posture reviewed after major changes rather than only at audit time?