The core multi-cloud security checklist is: inventory every account, centralize identity, apply baselines, encrypt and manage keys, log in one place, segment workloads, control third party access, and rehearse recovery. Each cloud has its own terms, so keep the policy common and the implementation specific.
Why is multi-cloud harder than one cloud?
Every provider has its own identity model, logging format and configuration vocabulary. Policies written once must be translated three times, and gaps appear in the translation. The NIST Cybersecurity Framework 2.0 helps because it describes outcomes, not products. It is meant for organizations of any size or sector and does not prescribe how to achieve them, so one outcome can be implemented in each cloud.
The eight checks
1. Inventory accounts, subscriptions and projects. Shadow accounts are the cheapest attack path. CISA's Cyber Essentials tells leaders to learn what is on the network and maintain inventories of hardware and software assets.
2. One identity source. Federate sign in from a single identity provider and prefer phishing resistant multi-factor authentication. CISA's fact sheet says any MFA is better than none but calls phishing resistant MFA the gold standard.
3. Configuration baselines. CISA's SCuBA project publishes secure configuration baselines for Microsoft 365 and Google Workspace, which shows the idea: write baselines, then measure drift. Do the same for your infrastructure clouds using the provider's own hardening guides.
4. Encryption and keys. Decide who owns keys in each cloud and how they are rotated and revoked.
5. Logging in one place. NIST's zero trust model depends on collecting data about asset state and access requests. Pick a common schema and a retention period, then verify administrative actions are logged in every account.
6. Segment workloads. Treat each environment as its own trust zone. NIST's enclave model for zero trust puts gateways at the boundary of a resource group when individual resources cannot host one.
7. Third party access. Managed service providers and tools with cloud access count as identities. The CPG 2.0 update added goals for MSP related risk.
8. Backup and recovery. The CISA ransomware guide recommends offline, encrypted backups and regular testing, because ransomware often tries to find and delete accessible backups. It also added recommendations for cloud backups in its September 2023 update.
What does a failure look like?
A constructed example: a company moved analytics to a second cloud during a project. The project ended, but a service account with broad read access stayed active and was missing from the identity provider. Nobody noticed because logs for that account never reached central storage.
Checks 1, 2 and 5 would each have caught it.
How do you keep this manageable?
Limit the checklist to controls you can verify automatically. Write the policy sentence once, such as "administrators sign in with phishing resistant MFA", then record how each cloud meets it and who checks.
Assign one owner per control, not one owner per cloud. Cloud teams change, and controls fall between them.
What should you report to the board?
Report outcomes, not tool counts. Useful measures are the percentage of cloud accounts in the register, the percentage of administrators on phishing resistant sign in, the age of the oldest unreviewed third party identity and the time to restore from the last backup test. These are all measurable and map to checklist items.
How to check or apply this
- Export every account list from each provider and compare against the register.
- Check each administrator against the identity provider and MFA type.
- Run a baseline tool or provider benchmark and record exceptions.
- Verify key ownership for the top five data stores.
- Confirm administrative logs from each account arrive centrally.
- Review network paths between environments and remove unused ones.
- List third party identities with cloud access and their last use.
- Restore one backup per quarter and time it.
Quick check
Should every cloud follow the same policy?
Yes at the outcome level. Implementation differs by provider, but the rule, for example phishing resistant MFA for administrators, should be identical.
What do I fix first?
Unknown accounts and unprotected administrator access. They are the fastest wins and most common entry points.
Sources
- NIST, Cybersecurity Framework 2.0 (CSWP 29)
- CISA, Cyber Essentials
- CISA, Implementing Phishing-Resistant MFA (Oct 2022)
- CISA, Secure Cloud Business Applications (SCuBA) Project
- CISA, #StopRansomware Guide
- NIST SP 800-207, Zero Trust Architecture
Last reviewed: 18 October 2026.
