Question

A financial services company runs workloads across Azure and AWS. The CISO wants a single, consistent set of security controls that can be measured across both clouds, mapped to industry frameworks like CIS and NIST, and continuously assessed for drift. The architect is asked to recommend an approach that aligns with Microsoft's prescriptive guidance for defining and enforcing these controls. Which approach best meets these requirements?

Accepted Answer

Adopt the Microsoft Cloud Security Benchmark (MCSB) as the baseline, apply it through Microsoft Defender for Cloud across both Azure and AWS, and use its built-in mappings to CIS and NIST for continuous compliance assessment

Answer

Author a custom Azure Policy initiative for Azure resources and a separate AWS Config ruleset for AWS, then manually reconcile the two control sets each quarter

Answer

Deploy the Cloud Adoption Framework (CAF) landing zone accelerator and rely on its default guardrails to cover all cloud platforms

Answer

Use the Well-Architected Framework (WAF) security pillar checklist as the control catalog and track adherence in a spreadsheet reviewed during architecture reviews