Cloud configuration review
Connect a cloud account read-only and test the selected controls against its live configuration, from inside the audit.
- NIST CSF
- ISO 27001
- SOC 2
- PCI DSS
Cloud configuration review
Connect a cloud account
A read-only role. The review never changes the account; it reads the configuration and tests the controls in scope against it.
Result
Each control in scope is judged against what the account actually says, and the configuration it was judged against is kept with the audit as evidence.
Starting…
A concept simulation of a planned product. Watch it play, or pressTry it yourself to click through.
What it is
A planned fieldwork tool that tests the controls in scope against a cloud account's live configuration and keeps what was read as evidence.
What you do, as the auditor
- 1Open cloud configuration review from the fieldwork hub and connect the cloud account read-only.
- 2Choose the controls from scope to test against the live configuration.
- 3Read the result: the controls tested, the configuration each was judged against, and the conclusion, kept with the audit as evidence.
- 4Today: see the card on the audit map; the review tool is not available yet.
On the roadmap
This is on the roadmap. The simulation above is a concept: it shows the intended flow, and screens and behaviour will change.
What it will do
What cloud configuration review will do
Connect a cloud account read-only
The review reads the cloud provider's configuration and nothing more. It never changes the account and never remediates what it reports; the auditee's engineers keep the keys to change.
Test the selected controls against the live configuration
One tool, test controls, reads the configuration and tests the controls selected in scope against it, so the auditor concludes from the configuration itself rather than from a screenshot.
What was read, kept as evidence
One review names the cloud account, the controls, and the conclusion. It is kept with the audit as evidence for the compliance test stage and shown in that stage's workbench inspector.
An audit log entry, no silent change
Each review writes evidence and an audit log entry. It changes no control test; correcting and signing off the work paper stays in the workbench.
Deliberately not in scope
- Changing the cloud account, or remediating what the review reports.
- Replacing document-based control testing; the workbench remains where a work paper is corrected and signed off.
- A general cloud inventory or monitoring view.
Why configuration is evidence
Some controls cannot be tested from documents alone. A policy may say that storage is encrypted at rest and that administrator access requires a second factor; whether the cloud account actually enforces either is a fact about the live configuration. Today the IS auditor reads that configuration by hand, and the audit does not hold what was read or how it was judged. Cloud configuration review brings that work inside the audit. The auditor connects the account read-only, picks the controls from scope, and the tool reads the configuration and tests those controls against it. The result names the controls tested, the configuration each was judged against, and the conclusion, and it is kept with the audit as evidence for the compliance test stage. It is shown in that stage’s workbench inspector and never read as evidence of design effectiveness.
What is settled and what is not
The review is a sibling view of the fieldwork hub, reached from it and never merged into it. It writes evidence and an audit log entry and changes no control test; the auditor still concludes on the control, corrects the work paper, and signs it off in the workbench. It does not change the account, remediate anything, or become a general inventory or monitoring view. Two questions are open in the PRD. Which cloud providers are in v1 is not settled, so the frameworks shown on this page are illustrative: the ones whose technical controls a configuration can answer for. Whether the review writes its own record or a work paper directly is not settled either. What the auditor will see is fixed: one review, one account, the controls, and a conclusion that walks back to the configuration it rests on.
Products
The other products
AI document auditing
AvailableUpload the evidence the auditee already keeps, test the controls against it, correct and sign off the work papers, issue the report.
For the auditor
- NIST CSF
- DORA
- GDPR
- ISO 27001
- PCI DSS
- SOC 2
Pre-audit planning
PlannedStudy the prior audits, see where risk concentrates, and decide who to talk to and what evidence to request before fieldwork starts.
For the auditor
Voice interview
PlannedInterview the auditee from inside the audit and keep what was said as evidence a work paper can cite.
For the auditor
Follow-up on audit
In developmentKeep every work paper with a gap open past report issue, request corrective-action evidence from the auditee, and close only on signed-off evidence.
For the reviewer and audit manager
- NIST CSF
- DORA
- GDPR
- ISO 27001
- PCI DSS
- SOC 2
See it on your own evidence
A walkthrough takes forty minutes: one framework, a handful of controls, and the documents an auditee already keeps.