IAM — Access Control (CC6.1, CC6.2, CC6.3)

IAM is the foundation. Auditors verify: all human users have unique credentials with MFA enforced, root account has no active access keys, IAM policies follow least privilege (no wildcard * actions on sensitive resources), access reviews are conducted quarterly with documented outcomes, and terminated employees lose access within the SLA your policy states.

Common failure: overpermissioned IAM roles created by developers for "temporary" testing that never get cleaned up, and access reviews that were "done" informally with no evidence.

CloudTrail — Audit Logging (CC7.2, CC7.3)

CloudTrail must be enabled in all AWS regions, not just your primary one. Logs must flow to a locked S3 bucket with object lock and log file validation enabled. Log retention must meet your stated policy (minimum 12 months).

Common failure: CloudTrail enabled in us-east-1 and us-west-2 but missing in ap-southeast-1 and eu-west-1 where workloads quietly run.

GuardDuty — Threat Detection (CC7.2)

GuardDuty must be active in all regions and accounts. Auditors verify not just that it's on, but that findings are reviewed and resolved — a high-severity finding that sat open for 60 days is a Type II exception, not a configuration note.

Common failure: GuardDuty enabled but findings routed to an email alias no one checks, with no documented resolution workflow.

AWS Config — Configuration Compliance (CC7.1)

Config records resource configuration changes over time and evaluates them against rules — exactly what Type II needs. Key managed rules: mfa-enabled-for-iam-console-access, s3-bucket-public-read-prohibited, encrypted-volumes, cloudtrail-enabled.

Common failure: Config enabled but no rules configured, or rules flagging non-compliant resources that no one remediated.

KMS — Encryption (CC6.1)

Automatic key rotation must be enabled on all customer-managed KMS keys. All storage services — S3, RDS, EBS, DynamoDB, Secrets Manager — must use KMS-managed encryption.

Common failure: encryption enabled on most resources but one or two S3 buckets or EBS volumes created before an encryption policy existed, still running without it.

Security Hub — Centralized Posture

Security Hub aggregates findings from GuardDuty, Config, Inspector, and third-party tools. Auditors increasingly expect it as evidence of a mature security program. Enable the AWS Foundational Security Best Practices standard and the CIS AWS Foundations Benchmark.

SecureSpect monitors all 29 AWS service checks continuously, maps each finding to the relevant Trust Service Criteria, and provides timestamped evidence exports your auditor can work with directly.