Access Control

• All IAM users have unique credentials — no shared accounts
• MFA enforced via SCP for all human users including root
• Least-privilege IAM policies — no wildcard actions on sensitive resources
• IAM Access Analyzer enabled to surface overpermissioned roles
• Quarterly access reviews documented with reviewer name, date, findings, and changes
• Offboarding process revokes IAM access within stated SLA (typically 24 hours)
• No long-lived IAM access keys — rotate or replace with roles

Encryption

• S3 Account-Level Public Access Block enabled on all accounts
• All S3 buckets encrypted with SSE-KMS
• All RDS instances encrypted at rest
• All EBS volumes encrypted
• DynamoDB tables encrypted with KMS
• TLS 1.2+ enforced on all load balancers and API endpoints
• KMS automatic key rotation enabled on all customer-managed keys
• Secrets stored in Secrets Manager — not in environment variables or code

Logging and Monitoring

• CloudTrail enabled in all active regions with multi-region trail
• CloudTrail logs in S3 with Object Lock and log file validation
• Log retention meets policy (minimum 12 months)
• GuardDuty enabled in all regions and accounts
• GuardDuty findings routed to a reviewed queue with resolution SLA
• AWS Config enabled with SOC 2 managed rules active
• Security Hub enabled with CIS Benchmark and FSBP standards
• VPC Flow Logs enabled

Network Security

• Security Groups follow least-privilege — no 0.0.0.0/0 on sensitive ports
• Production resources in private subnets — public internet access via ALB/NAT only
• WAF configured on public-facing load balancers

Change Management

• All code changes require pull request review before merge
• CI/CD pipeline includes automated security scanning
• Infrastructure changes (Terraform/CDK) require review and approval
• Production deployments require documented approval

Incident Response

• Incident Response Plan documented with severity levels, escalation paths, and notification SLAs
• On-call rotation defined and tested
• Annual IR tabletop exercise with documented outcomes
• Post-incident reviews conducted and retained

Organizational Controls

• Information Security Policy (parent policy document)
• Access Control Policy
• Change Management Policy
• Vendor / Third-Party Risk Management Policy
• Employee security awareness training with completion records
• Annual risk assessment with documented findings and remediation tracking
• DR/BCP plan with annual test and documented results

SecureSpect runs all 29 AWS-specific checks automatically across every account in scope and surfaces every gap with remediation guidance linked directly to the relevant Trust Service Criteria. When your auditor asks for evidence, every check has a timestamped audit trail ready to export.