The pattern
After enough incident reviews you start to see the same shape: a public storage bucket, an over-permissive IAM role, an unrotated key, a forgotten test environment. The attackers were not sophisticated. The configuration was.
What a baseline buys you
- Predictable controls across every account and project.
- Auditable, version-controlled policies instead of click-ops drift.
- A clear line between ‘this is broken’ and ‘this is by design’.
Where to start
- Pick a reference: CIS Benchmarks, AWS Security Reference Architecture, Azure Cloud Adoption Framework.
- Encode the parts that matter to your business in IaC.
- Detect drift continuously, not at audit time.
Your next tool can wait. Your baseline cannot.