CIS · Control 7.4 · Priority: critical · Component: Protect

What this control covers

Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.

Why it matters

Cloud misconfiguration is the leading cause of cloud-related breaches; posture management is how you catch it before someone else does.

How to implement

AWS

Manage all changes in Terraform/CloudFormation; enforce SCPs that deny console writes for prod. Use AWS Config rules + conformance packs (CIS, HIPAA, PCI) to detect drift.

Azure

Azure Policy + Blueprints baseline landing zones; Bicep/Terraform as IaC and Policy Insights for drift.

GCP

Org Policy Service for guardrails and Config Validator in CI to pre-check Terraform plans against policy as code (Rego).

Google Workspace

Forward the Admin, Login, Drive, Token and Mobile audit logs to Cloud Logging (Workspace BigQuery export). Alert on impossible-travel logins, OAuth-scope grants for high-risk scopes, and external Drive sharing of sensitive labels.

GitHub

Stream the Enterprise audit log to your SIEM and enable Audit Log API alerting on key events: owner changes, IP allowlist edits, secret deletions, repo visibility flips.

Evidence to collect

  • infra_scan — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Perform Automated Application Patch Management.

Quick checklist

  • Perform — Enterprise
  • Protect — Enterprise

Related articles on this site