Audit Readiness: 60% - At risk of failing2 critical, 2 high, 1 medium, 1 low drifts open

Framework Breakdown4 frameworks

SOC25 clauses affected / 5 findings

CC6.1- Logical and physical access controls - public exposure of customer data.

S3 Bucket Public Access Block disabled manuallyDRIFT-001

CC6.6- Logical access security - unrestricted network access to management interface.

Security Group port 22 open to 0.0.0.0/0DRIFT-002

CC6.7- Transmission and disposal of sensitive information controls.

RDS instance missing encryption at restDRIFT-03

CC6.3- Logical access - least-privilege authorization not enforced for production data access.

IAM role granted wildcard s3:* on production accountDRIFT-004

CC7.2- System monitoring - audit trail disabled prevents detection of unauthorized activity.

CloudTrail logging disabled on management bucketDRIFT-006

GDPR3 clauses affected / 3 findings

Art. 32- Security of processing - insufficient protection against unauthorized disclosure.

S3 Bucket Public Access Block disabled manuallyDRIFT-001

Art. 32(1)(a)- Encryption of personal data at rest - order history contains customer identifiers.

RDS instance missing encryption at restDRIFT-03

Art. 30- Records of processing activities - logging controls compromised.

CloudTrail logging disabled on management bucketDRIFT-006

CIS AWS1 clause affected / 1 finding

4.1- Ensure no security groups allow ingress from 0.0.0.0/0 to port 22.

Security Group port 22 open to 0.0.0.0/0DRIFT-002

CIS GCP1 clause affected / 1 finding

4.2- Ensure no firewall rules allow RDP from the internet.

GCP firewall rule allows RDP from 0.0.0.0/0 on port 3389DRIFT-005