The Screenshot Audit

Edition #4: The Screenshot Audit

"Can you send me a screenshot of your security group configurations?"

Been there a number of times - from enterprise internal audits to recent SOC2 audits at Turbot.

A screenshot...of dynamic cloud infrastructure...that could change at anytime.

This is The Screenshot Audit - where point-in-time evidence tries to prove continuous security.

Screenshots show what WAS true, not what IS true. Manual collection takes weeks, evidence is stale before it's compiled. Engineers spend time documenting instead of building. Auditors get snapshots instead of meaningful assurance.

Screenshot audits assume infrastructure is static. But cloud infrastructure is ephemeral, dynamic, and constantly evolving. Screenshots of configurations, spreadsheets of access reviews, quarterly compliance reports - these approaches can't keep pace with environments that deploy multiple times per day.

The organizations moving beyond this have stopped asking "How do we document our cloud?" and started asking "How do we prove our cloud is continuously compliant?"

Cloud environments demand continuous compliance through automated evidence. This is where the Cloud Governance Loop becomes essential. Real-time visibility instead of point-in-time snapshots, policy as code that prevents violations, and continuous monitoring that scales with deployment velocity.

When infrastructure is code, compliance should be code too.
When deployments are continuous, monitoring should be continuous too.
When everything is automated, evidence collection should be automated too.

That's how you prove compliance continuously, not based on calendars.

- Keep on Herding, Bob

What's Happening in Cloud Governance 📡

CIS Information Technology and Information Security Governance: Guidance on distinguishing enterprise governance from IT governance, with 26 CIS safeguards aligned to NIST's "Govern" function. Covers framework hierarchy and right-sizing governance based on organizational maturity.

CIS DigitalOcean Benchmarks v1.0.0: CIS introduces a new two-step approach for cloud service provider benchmarks: start with Foundations for prescriptive guidance involving architecture agnostic settings, then a Services specific benchmark for recommendations on services you actually use.

Cloud Security Governance for Multi-Cloud Environments: Cyber Lois provides practical guidance on managing security across multiple cloud platforms, including two-part policy approaches, centralized identity management, and compliance automation strategies. Real-world example of 87% reduction in misconfigurations through secure templates.

From Bureaucracy to Brilliance: How DevOps Culture Can Transform Cloud Governance: CloudGovernance.org contributor Matty Stratton examines why traditional governance creates "governance theater" in cloud environments and how DevOps culture principles can create governance that teams actually work with rather than around.

Get Involved 👋

Join the conversation on LinkedIn about this newsletter edition.