Standard
Cloud Security Configuration Baseline
This standard defines the secure configuration baseline for cloud and cloud productivity environments. It establishes minimum security configuration requirements for the cloud platform, enterprise identity provider, cloud productivity platform, and associated services to reduce attack surface and ensure that a consistent security posture is maintained across all tenants and subscriptions.
- Type
- Standard
- Version
- 1.4.23
- Date
- 2026-10-27
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Operations
- Review frequency
- Annual and upon material platform or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Governance
- 4. Enterprise identity provider baseline
- 5. Cloud productivity platform baseline
- 6. Cloud platform baseline
- 7. Configuration drift
- 8. Framework alignment
Frameworks it maps to
- ISO/IEC 27001:2022
- ISO/IEC 27017:2026
- CIS Cloud Foundations Benchmark
- CIS Cloud Productivity Foundations Benchmark
- NIST SP 800-53 Rev. 5
- NIST SP 800-210
- COBIT 2019
- CSA CCM v4.1
- TBS Direction on the Secure Use of Commercial Cloud Services, SPIN 2017-01
- CCCS ITSP.50.103, Guidance on the Security Categorization of Cloud-Based Services
- CCCS Medium Cloud Control Profile (ITSP.50.103 Annex B)
- CCCS Baseline Cyber Security Controls for Small and Medium Organizations V1.2
Related documents
- Information Security Policysecurity
- Privileged Access Management Standardsecurity
- Authentication and Password Management Standardsecurity
- Data Classification and Handling Standardsecurity
- Production Security Requirementsoperations
- Network Security and Segmentation Standardoperations
- Canada Public Sector GRC Requirements Annexcompliance
Next
All Documents