Lesson 8 of 10

Compliance & Governance in the Cloud

Cloud security is not just about technical controls — it is also about demonstrating compliance with regulatory frameworks and industry standards. This lesson covers the major compliance frameworks relevant to cloud environments (SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP) and how cloud-native tools like AWS Security Hub, Azure Policy, and GCP Security Command Center map to compliance requirements.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

In simple terms: Map cloud controls to compliance frameworks including CIS, SOC 2, and PCI DSS. This means building enough understanding that you can apply this concept in a real scenario — not just answer a quiz question about it, but actually use it when it matters. Focus on the "why" behind the concept, not just the "what."

Why this matters

Cloud infrastructure now hosts the majority of the world's data and applications. Misconfigured cloud resources are responsible for some of the largest data breaches in history. Cloud security skills are among the most in-demand and highest-paying in the entire field.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Compliance & Governance in the Cloud · Objective 1 of 4

VIDEO

Loading video…

Enable AWS Security Hub

Enable Security Hub and activate the CIS AWS Foundations Benchmark standard.

aws securityhub enable-security-hub --enable-default-standards

Run a CIS benchmark check with Prowler

Use Prowler to audit your account against the CIS AWS Foundations Benchmark.

prowler aws --compliance cis_level2_aws_account_security_onboarding_aws

Review Security Hub findings

List failed Security Hub controls sorted by severity.

aws securityhub get-findings --filters file://sh-filter.json --query "Findings[*].[Title,Severity.Label]" --output table

Create an SCP guardrail

Apply an SCP to prevent member accounts from disabling CloudTrail or leaving the organization.

aws organizations create-policy --name PreventCloudTrailDisable --type SERVICE_CONTROL_POLICY --content file://scp-cloudtrail.json

Previous: Cloud Penetration Testing Next Lesson