Cloud security testing, monitoring, and continual improvement
Domain 7 tests whether cloud security is measured, tested and improved rather than assumed. Monitoring must cover provider, customer and service layers; testing must respect provider rules and contracts.
Core rules and concepts
- Monitor identities, configuration drift, APIs, network flows, data access, administrator actions, availability and SLA. Native cloud logs may be inaccessible or short-lived, so contract for export and retention.
- Use CSPM, CASB, SIEM, vulnerability scanning, configuration review, tabletop exercises and control testing.
- Review provider assurance: audit reports, certifications, penetration test summaries and subprocessor changes.
- Penetration testing and scanning need written authorization and scope; SaaS customers often cannot test the provider platform.
- Continual improvement uses KPIs, management review, corrective actions, lessons learned and updated risk treatment. Useful metrics include mean time to detect, patch latency, exception aging and control test pass rate.
Worked example
Annual assurance for a SaaS HR system: the customer reviews the provider audit report, checks SSO, MFA and retention settings, samples access reviews and requests the latest test summary. It does not run an unapproved scan against the provider. Findings become tracked actions with owners and dates.
Traps
Relying only on a certificate; scanning without permission; monitoring only infrastructure; no KPI or follow-up; treating an audit report as proof that customer configuration is correct.