Summary

In summary, taking your security program to the next level includes creating a security baseline with CIS or STIGS. Make sure you align it with your compliance. Auditors will ask if you are using a secure configuration baseline and don’t care if it’s IG1, IG2, or STIGS unless it’s a Federal customer or FedRAMP. They will ensure you have the proper controls implemented. Remember that 99% of cloud breaches are due to misconfiguration.

In the next chapter, we will be covering asset and data classification and segmentation. It’s imperative to know where your critical data are in order to secure them.