EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
Recent Searches
Trending
-
The criterion of sustainability for Ukrainian agribusiness products based on the guidelines of FAO and the EU Taxonomy as a driver for strengthening the country’s position on commodity markets
19 Sep 2023 Climate change and sustainability services -
-
Why Europe’s CEOs are confident but cautious, pushing AI and pausing ESG
09 Jan 2024 CEO agenda
Cloud Security Assessment
As cloud environments become increasingly complex and their adoption across organizations continues to grow rapidly, securing these environments is becoming critically important. 88% of organizations already use hybrid or multi-cloud environments, while 81% rely on at least two cloud service providers to run mission-critical workloads. A comprehensive assessment helps an organization understand the actual security posture of its cloud environment, focus resources on the most significant risks, and make informed decisions about its future development. EY offers a comprehensive Cloud Security Assessment service that provides assurance over the effectiveness of security controls, the appropriateness of configurations, and the cloud environment’s compliance with applicable requirements (CIS Benchmarks, NIST SP 800-144, and BSI C5).
How can EY help
We offer assessments of key cloud environment functions, as well as assessments against BSI C5 (Cloud Computing Compliance Criteria Catalogue), delivered by experienced EY professionals.
Our approach combines an assessment of cloud architecture, processes and security controls with technical scanning of the environment. Following the assessment, the client receives a report containing a prioritized list of identified deficiencies, a risk assessment and practical remediation recommendations.
Through collaboration with EY, clients can gain answers to the following key questions:
- Do the cloud architecture, processes and controls comply with applicable standards, requirements and leading practices?
- How effectively does the organization manage vulnerabilities, threats and incidents in its cloud environment?
- Are cloud security controls appropriately designed and implemented?
- What security gaps exist in the organization’s cloud environment, and how can they be remediated?
- Which identified deficiencies pose the greatest risk to the organization?
We help our clients identify and remediate cloud security deficiencies in a timely manner, enhance control effectiveness and reduce the associated risks to the organization.
Contact us
Find out more information about this service
What we do
The service provides a comprehensive assessment of the cloud environment’s security posture and an internal report with practical recommendations. For cloud service providers, the assessment can also be performed against the C5 criteria, followed by the preparation of a SOC 2+ or ISAE 3000 report.
Technical Review
We perform a technical assessment of the defined cloud environment by collecting metadata, configuration data, and security settings. As agreed, we use the Cloud Security Intelligence platform or other tools of your choice to scan the environment.
Security Assessment
We interpret the security scanning results, review policies, assess control design, and evaluate risks in the context of the organization’s architecture and the current threat landscape.
Internal Report Preparation
We prepare a report containing a prioritized list of identified deficiencies, a risk assessment, practical recommendations, and an executive summary.
SOC 2+/ISAE 3000 Report Preparation
For cloud service providers, we assess controls against the C5 criteria and prepare a SOC 2+ or ISAE 3000 report.
