Need indicators
This capability is usually relevant when these signals appear in the operating environment.
Cloud workloads lack a baseline.
Responsibilities with service providers are unclear.
Sensitive third-party integrations exist.
Back to solutions
Discuss the service scope
What does the service cover?
Cloud security advisory assesses controls across an existing or planned estate, from administrative identities and data flows to networks and logs. It identifies who implements each control under the service model, prioritizes risks, and defines evidence needed to verify remediation.
Cloud security advisory combines a cloud hosting security assessment with a cloud shared responsibility assessment before selecting controls and integrations.
Practical example
An organization is preparing to move a service to the cloud. We review access paths and integrations and separate provider responsibilities from those retained by the organization.
Technical summary and scope of use
Technical explanation
These workstreams describe a reference architecture that combines separate products and services. An assessment determines what is needed and available and who owns implementation and operations.
The technologies covered by this advisory can protect IT environments, cloud services, enterprise communications, endpoints, applications, email, and sensitive data.
The system operates through several layers of protection including: encryption, access control, multi-factor authentication, hardware management, document and mail classification, data loss prevention, web applications and APIs protection, e-mail protection, email archiving, catch analysis, and mail domain reputation verification.
The technical objective is to reduce the risks of unauthorized access, protect data during transport and storage, improve security activity monitoring, support compliance, and protect communication channels, mail and applications from cyber attacks.
This system helps organizations protect daily business channels such as email, hardware, applications, data, and internal communications from common and advanced cyber risks.
Instead of dealing with each risk separately, the system combines encryption, hardware management, information classification, data loss prevention (DLP), mail protection, multi-factor authentication, and applications protection in integrated layers.
Practically, this means that the organization can reduce the risk of catch, prevent the leakage of sensitive information, protect email from links and malicious files, manage devices from one center, and control users’ access to sensitive apps and services.
It also helps to improve security visibility through classification, monitoring, archiving, and verification of mail sources, which supports information technology and cybersecurity teams in risk management and compliance more clearly.
Scope of use
In corporate environments that contain office and portable devices, personal devices within the BYOD policy, corporate e-mail, web applications and APIs, sensitive data, cloud services, and users who need a secure connection and centralized management.
What the service delivers
Assessment workstreams that lead to actionable recommendations.
Secure communications and encryption
Document and email classification
Endpoint management
Expected value
The impact security teams and leadership can expect from the right implementation.
Clearer responsibility
Lower exposure
Better readiness for technology selection
Workstreams
Activities and deliverables are agreed with your team as part of the scope.
Secure communications and encryption
Safe communications with encryption from one side to the other.
Limit data readability without the required keys; confirm where encryption starts and ends.
Support for encrypted text messages.
Use the supported channel and define who can join or view content under team policy.
Support for encrypted voice calls.
Use the supported channel and define who can join or view content under team policy.
Support for video calls.
Use the supported channel and define who can join or view content under team policy.
Supporting encrypted group conversations.
Use the supported channel and define who can join or view content under team policy.
Share the site within a safe communication environment.
Define when location is shared, who can see it, and how the feature behaves offline.
Document and email classification
Classification of documents before sending them.
Assign information to a category that determines how it is handled so safeguards reflect sensitivity.
Classification of the email before sending.
Assign information to a category that determines how it is handled so safeguards reflect sensitivity.
Increase awareness of the importance of protecting information.
Coach staff to spot unusual requests and verify them through an approved channel before sharing work information.
Support Ranking Levels: General, Restricted, Secret, Very Secret.
Assign information to a category that determines how it is handled so safeguards reflect sensitivity.
Integration with data loss prevention systems.
Apply policy to sensitive data movement on covered channels; test alerting, blocking, and exceptions.
Endpoint management
Office and mobile equipment.
Apply work settings to enrolled devices and review policy support on each platform.
Management of personal devices within the BYOD policy.
Apply work policy on personal devices while keeping organizational and personal data boundaries distinct.
Develop detailed policies for devices, applications, networks and data.
Turn organizational requirements into testable settings and define who may approve exceptions.
Publish applications and share documents from a central site.
Restrict sharing paths and recipients according to work policy and test unauthorized access.
Blocking the malicious software.
Assess malware controls for relevant devices and test alerting and blocking within a representative scope.
Phishing prevention
Assess controls for phishing links and impersonation, then test what happens to a message when those controls detect it.
Reduce the loss of data.
Monitor work data egress and configure blocking or alerts according to sensitivity.
Web application and API protection
Protect critical web-based applications.
Inspect requests before they reach the service and define covered routes and rejection behavior.
Protecting the API.
Inspect requests before they reach the service and define covered routes and rejection behavior.
Protect against attacks and unwanted visitors.
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
support of container environments.
Support deployment in the covered container environment; test networking, storage, and secret handling before production.
Assess controls for detecting previously unseen attack behavior
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Protection from robots.
Distinguish suspicious automation from normal traffic and test exceptions for legitimate integrations.
Protect against DDoS attacks.
Gateway controls limit abusive requests within available capacity; volumetric floods may need upstream protection.
Create a stronger security infrastructure for applications.
Inspect requests before they reach the service and define covered routes and rejection behavior.
Support 2FA binary authentication within the application protection.
Add independent verification to covered sign-in paths and test factor loss and recovery.
Application Security Testing
Supports the SAST Fixed Application Security Test.
Inspect source or build artifacts without running the application to find issues early.
DAST Dynamic Applications Security Test Support.
Test the running application for exploitable behavior in an authorized environment.
Supports SCA software component analysis.
Inventory third-party components and versions to identify known vulnerabilities or constraints.
Integrate the tests into one interface.
Tie test results to promotion decisions and identify who reviews exceptions.
Support the development, testing, experimental production and production stages.
Tie test results to promotion decisions and identify who reviews exceptions.
Support security ports within the development cycle.
Tie test results to promotion decisions and identify who reviews exceptions.
Email protection
Protect the company from threats.
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Protected environment is dedicated only to mail.
Manage message inspection and quarantine centrally for integrated mail paths only.
Sandboxing for suspicious messages or files.
Analyze suspicious content in an isolated environment instead of executing it directly on the user’s device.
Protection from file attacks.
Assess mail attachment inspection and when content is quarantined or forwarded based on the selected tools.
Protect from URL attacks.
Review how the mail layer inspects URLs and where its responsibility ends when a link opens in the browser.
Protecting the corporate mail.
Manage message inspection and quarantine centrally for integrated mail paths only.
Simulation of phishing.
Train employees to detect phishing.
Address suspicious messages or behavior according to the solution’s role and review legitimate cases to reduce false positives.
Simulate phishing messages to test the user’s fraudability.
Expose a decoy target to detect unexpected interaction without exposing a production asset.
Measure the impact of awareness on reducing capability.
Address suspicious messages or behavior according to the solution’s role and review legitimate cases to reduce false positives.
Supports user weakness analysis towards phishing messages.
Address suspicious messages or behavior according to the solution’s role and review legitimate cases to reduce false positives.
Secure mobile container
Full control of corporate information on mobile devices.
Separate work data from personal apps or storage under the device’s supported policy.
Separation of privacy between employees’ data and corporate data.
Separate work data from personal apps or storage under the device’s supported policy.
Collect mail, calendar, notes, tasks, documents and contacts in one application.
Separate work data from personal apps or storage under the device’s supported policy.
Enable work on the desktop or phone in an isolated environment.
Separate work data from personal apps or storage under the device’s supported policy.
Multi-factor authentication
Strong and secure certification.
Use verification appropriate to the action’s risk and reject expired codes or unenrolled factors.
Protect against theft of passwords.
Use verification appropriate to the action’s risk and reject expired codes or unenrolled factors.
Reduce the risk of catch.
Address suspicious messages or behavior according to the solution’s role and review legitimate cases to reduce false positives.
Reduce social engineering attacks.
Coach staff to spot unusual requests and verify them through an approved channel before sharing work information.
Balance between protection and user experience.
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Preventing Data Loss
Data security solutions include network and terminal devices.
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Discover sensitive data.
Identify data that may need protection using supported matching criteria; test accuracy on representative examples.
Monitoring of sensitive data.
Identify data that may need protection using supported matching criteria; test accuracy on representative examples.
Protect sensitive data in user devices, servers, cloud storage and email.
Identify data that may need protection using supported matching criteria; test accuracy on representative examples.
Protect data at rest
Identify where data is stored, who manages the keys, and how encryption and access work in that service model.
Protection of data in transit.
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Check the content to detect sensitive data.
Identify data that may need protection using supported matching criteria; test accuracy on representative examples.
Preventing leakage using custom workflow rules.
Apply policy to sensitive data movement on covered channels; test alerting, blocking, and exceptions.
Email archiving
Protect sensitive business information.
Identify sensitive business data and its handling paths, then apply the appropriate controls to each path.
Supporting e-mail governance.
Inventory organizational senders and compare activity with reports and policy before changing delivery rules.
Support risk management and compliance.
Map settings and evidence to organizational policy; applicability and effectiveness must still be assessed.
support for eDiscovery electronic discovery.
Find messages relevant to a case and retain results under controlled access.
Full and fast text search within the archives.
Keep records retrievable under retention and access rules; test preservation and disposal.
Email and domain reputation protection
Control of e-mail reputation.
Inventory organizational senders and compare activity with reports and policy before changing delivery rules.
Reduce sender-domain impersonation
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Management of SPF, DKIM and DMARC from a standard interface.
Provide a verifiable email signature; review the selector and key rotation process.
No need to have an intense DNS experience.
Manage the configuration through domain records and verify published values and propagation before rollout.
Identify and validate legal mail sources.
Inventory organizational senders and compare activity with reports and policy before changing delivery rules.
Reviewing and tuning email authentication settings.
Show activity within the covered scope and associate events with an asset or session during review.
Activate the rejection or isolation of illegal messages.
Isolate the item or access path when policy conditions are met; define review and release to limit unintended impact.
How the technology works
Discovery
The system relies on sensitive data detection, file and mail content analysis, link and file scan, SAST, DAST and SCA tests to detect flaws in applications and their components.
Protection
The system applies side-to-side encryption, mail protection, sandboxing, web applications and APIs protection, terminal devices protection, malware blocking and catching.
Isolation
The secure container on mobile devices is used to separate business data from personal data, and supports hardware management and BYOD policies to limit unsafe use.
Access control
Multi-factor authentication and binary authentication are used to protect access to sensitive apps, mail and services and reduce the risk of password stealing.
Monitoring
Monitoring includes classification of documents and mail, sensitive data monitoring, mail reputation and domain monitoring, and the follow-up of prohibition rules.
Response and Prevention
Workflow rules support the prevention of data loss to prevent leakage, and catch simulation helps reduce users’ susceptibility to attacks before they occur.
Reports and compliance
Archive, eDiscovery, information classification, mail records, and e-mail governance support review and compliance needs.
How the assessment works
- Inventory in-scope workloads, identities, integrations, and data paths.
- Map each control to an owner under the service model.
- Rank gaps by impact and recommend verifiable next steps.
Service scope and deliverables
We review agreed workloads, environments, and integrations. Outputs are a responsibility map, prioritized gaps, and implementation steps, not a security guarantee for every workload.
Challenges this solution addresses
- Weak protection of internal messages, calls and communications.
- The leak of documents or uncoded mail.
- A low awareness of the information classification.
- Loss of data via mail, device or network.
- Weak control of personal devices BYOD.
- The spread of malicious software on the terminal devices.
- phishing attacks by email.
- Links and malicious files within the mail.
- Email domain spoofing
- Failure to verify the user’s identity.
- theft of passwords.
- Attacks of Social Engineering.
- Weak protection of web applications and APIs.
- Robots and unknown attacks.
- The DDoS attacks.
- The absence of application security testing during the development cycle.
- Difficulty archiving and searching the mail for governance and compliance purposes.
- Weak protection of sensitive data during rest and movement.
- Difference between business data and personal data on mobile devices.
Regulatory alignment
Illustrative ways to support control implementation. An area may have more than one example; each row is not necessarily a separate official control.
NCA · ECC 2:2024For entities within the scope of the Essential Cybersecurity Controls.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Identity and access management | Supports multi-factor authentication and reduces the risks of unauthorized access Related capability: MFA / 2FA | Applied |
| Protection of systems and processing facilities | Supporting the blocking of malicious software and catching on terminal devices Related capability: Endpoint management | Applied |
| Email protection | Supports email analysis, sandboxing, file protection and links, and mail archiving Related capability: Post Security Portal, Post Archive | Applied |
| Verification of the mail fields. | Use SPF, DKIM, and DMARC to reduce sender spoofing. Related capability: Email and domain reputation protection | Applied |
| Network Security Management | Supports protection against DDoS, robots and unwanted attacks on applications Related capability: Protection of Web Applications and API | Applied |
| mobile device security. | Supports BYOD, secure containers, mobile device management, and business data separation Related capability: Management of safe equipment and containers | Applied |
| Protection of data and information | Support the classification of documents and mail, detection, monitoring and protection of sensitive data Related capability: Classification of information and DLP | Applied |
| Cryptography | Supports encryption from side to side for communications Related capability: The safe message. | Applied |
| Management of deficiencies | Supports application failures detection through SAST, DAST and SCA Related capability: Application Security Testing | Applied |
| The hacking test. | Application security testing supports applications that help detect technical weaknesses in applications Related capability: SAST / DAST | Applied |
| records and monitoring. | Supports DLP monitoring, mail archiving, and DMARC settings monitoring Related capability: DLP, Post Archive, DMARC | Applied |
| Incident and threat management | Supports the reduction of threats related to catch, malicious files and malicious links Related capability: Mail protection and phishing simulation | Applied |
| Security of web applications. | Supports WAF, API protection, protection from robots and DDoS, and 2FA support Related capability: Protection of Web Applications and API | Applied |
| Flexibility and continuity of business. | DDoS protection, data leakings and email threats help reduce the impact of interruptions and operating risks Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: WAF, DLP, Mail Protection | Applied |
| Cyber Security for Cloud Computing and Hosting | Support cloud security services and local hosted environments within the institutional protection scope Related capability: Cloud Security Services | Applied |
SAMA · CSFFor financial institutions within the Saudi Central Bank framework, subject to the control's applicability.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Security Governance | The technology supports the application of centralized security controls through hardware management, mail protection, application protection, information classification, and data loss prevention, helping to implement protection requirements within an organized corporate environment. Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Central Management of Security Equipment and Policy | Applied |
| Identity and access management | Technology supports multi-factor authentication and binary authentication to reduce the risk of unauthorized access to sensitive systems and services Related capability: multi-factor authentication and binary approval | Applied |
| Management of Privileges and Powers | Technology supports restriction of access to sensitive applications and services using powerful verification mechanisms that reduce the risk of credentials abuse Related capability: Multi-factor access control and approval | Applied |
| Management of assets | Technology supports the management of office, mobile and personal devices within centralized policies including devices, applications, networks and data Related capability: Endpoint management | Applied |
| Risk Management | This technology supports reducing the risk of catch, malicious software, data leakings, email scam, and application attacks through multiple protective layers. Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Protecting email, preventing data loss and applications | Applied |
| Management of deficiencies | Technology supports fixed and dynamic application security testing and software components analysis to detect flaws during the development cycle Related capability: Application Security Testing | Applied |
| Security Monitoring | Technology supports sensitive data monitoring, e-mail monitoring, domain reputation monitoring, and the tracking of capture attempts, files and malicious links Related capability: Prevention of data loss and e-mail protection | Applied |
| Events and records. | The technology supports e-mail archiving and text search within the archives, which supports tracking, review and investigation of mail-related events Related capability: Email archiving | Applied |
| Protection of data | This technology supports detection, monitoring and protection of sensitive data while staying and moving through the network, devices, mail and cloud storage. Related capability: Prevention of data loss and information classification | Applied |
| Classification of information | The technology supports the classification of documents and mail before sending according to specific classification levels, enhancing control over handling sensitive information. Related capability: Document and email classification | Applied |
| Management of Networks | The technology supports the protection of web applications and APIs from unwanted attacks, robots, and distributed denial-of-service (DDoS) attacks Related capability: Web application and API protection | Applied |
| Protecting the systems | This technology supports the protection of terminal devices from malware, catch and data loss through central policies. Related capability: Endpoint management | Applied |
| Protection of Infrastructure | The technology supports the protection of the technical infrastructure components associated with applications, mail, hardware and data through security layers including malware protection, phishing and application attacks Related capability: Application, email, and endpoint protection | Applied |
| Protection of Web Applications | This technology supports the protection of critical applications and APIs from attacks, unwanted visitors, robots and denial-of-service attacks. Related capability: Web application and API protection | Applied |
| Security of applications | The technology supports integration of application security tests into the development, testing and production stages, helping to detect security defects before running. Related capability: Application Security Testing | Applied |
| Email protection | The technology supports corporate email protection from capture, malicious messages, files and suspicious links using isolation and analysis Related capability: Email protection | Applied |
| Fighting the phishing. | The technology supports staff training through the simulation of catch messages and analysis of users’ ability to interact with suspicious links. Related capability: Simulation of phishing. | Applied |
| Email domain protection | The technology supports verification of legitimate mail sources and prevents domain scattering through email validation policies. Related capability: Email and domain reputation protection | Applied |
| mobile device security. | Technology supports mobile device management, separates business data from personal data and applies access and encryption policies on devices Related capability: Secure mobile container | Applied |
| Safety of personal equipment. | Technology supports the management of personal devices used for business purposes through centralized policies for hardware, applications, networks and data Related capability: Management of Personal Equipment | Applied |
| Cryptography | Technology supports one-to-one encryption for communications, audio calls, video calls and group conversations Related capability: Secure communications and encryption | Applied |
| Incident response | Technology supports subsequent investigation of mail-related events and data through archiving, monitoring and detection of threats Related capability: Post Archive and Security Monitoring | Applied |
| Continuity of business | Supports the impact of interruptions and operating risks resulting from email attacks, data leakings, and application attacks Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: Protecting email, preventing data loss and applications | Applied |
| Security of third parties | The technology supports the control of corporate information when used through hardware, services, cloud storage and mail, helping to reduce the risk of dealing with external or hosting environments. Related capability: Prevention of data loss and cloud storage protection | Applied |
| Security of cloud environments | Technology supports the protection, monitoring and prevention of sensitive data within cloud storage. Related capability: Prevent data loss in cloud storage | Applied |
| Protection of Critical Environments | Supports the protection of critical applications, corporate mail and sensitive data from threats that may affect the availability of services or information confidentiality Related capability: Protect critical applications and sensitive data | Applied |
| compliance and audit | Supports archiving technology, information classification, sensitive data monitoring and e-mail governance supporting review and compliance requirements Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Post Archive and Category Information | Applied |
| Operational Security | Technology supports hardware management, mail protection, data monitoring, application protection, and imitation of phishing within continuous security processes that reduce operational risks Related capability: Hardware management, mail protection and data loss prevention | Applied |
| Protection of sensitive financial systems | The technology supports the protection of sensitive data, enhances access to multi-factor authentication, and protects mail and applications that may be used to process or exchange financial information. Related capability: Data protection and multi-factor authentication | Applied |
NCA · OTCC-1:2022For operational technology and industrial control environments to which the controls apply.
Evaluate these examples against the facility level and assets in scope. They do not authorize IT/OT connectivity or component installation on operational assets without assessment.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Visibility and monitoring | Supports sensitive data monitoring, mail archiving, and email domain authentication monitoring Related capability: DLP, Post Archive, DMARC | Applied |
| Access control | Supports multi-factor authentication, 2FA, and access protection to applications and mail Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: MFA / 2FA | Applied |
| Monitoring of assets | Supporting terminal and mobile devices management and monitoring of hardware policies Related capability: Endpoint management | Applied |
| Discover threats. | Support hacking detection, malicious files and links, malware, and sensitive data Related capability: Mail Protection, DLP, UEM | Applied |
| Incident response | The archiving, monitoring and discovery outcomes provide support for the investigation and analysis of events Verify asset compatibility and test operational impact before deploying an agent or taking response action in an OT environment. Related capability: Archive and Monitoring | Applied |
| Protect mobile devices in sensitive environments | Supports the limitation and management of mobile devices, encryption of their data and business data separation Verify asset compatibility and test operational impact before deploying an agent or taking response action in an OT environment. Related capability: Safety container and equipment management | Applied |
| Protection of data | Supports the protection of data classified during sleep, movement and using DLP Related capability: DLP and information classification | Applied |
| Management and Testing | Supports SAST, DAST and SCA for applications Related capability: Application Security Testing | Applied |
| Visibility and monitoring | Support sensitive data monitoring, mail archiving and domain validation monitoring Related capability: Prevention of data loss and mail archiving | Applied |
| Access control | Multi-factor authentication and bilateral approval support for access protection Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: Multi-factor authentication | Applied |
| Monitoring of assets | Support for terminal and portable equipment management Related capability: Endpoint management | Applied |
| Discover threats. | Support the detection of hacking, malicious files, malicious links and malware Related capability: Protecting and preventing data loss | Applied |
| Incident response | Support for archiving, monitoring and investigation related to security events Verify asset compatibility and test operational impact before deploying an agent or taking response action in an OT environment. Related capability: Post Archive and Monitoring | Applied |
| Protecting mobile devices in sensitive environments | Support for mobile device management and business data separation Verify asset compatibility and test operational impact before deploying an agent or taking response action in an OT environment. Related capability: Safety container and equipment management | Applied |
| Protection of data | Support for the protection of sensitive data during rest and movement Related capability: Prevention of data loss and information classification | Applied |
| Management and Testing | Support Application Security Testing and Software Components Analysis Related capability: Application Security Testing | Applied |
“Applied” describes the capability in the illustrative example, not an implementation or compliance status for the customer.
Decision questions
Questions before you start
How do we know this solution is right for us?
Start with the risk signals on this page. If they match your environment, they can be turned into a short assessment that defines scope, priority, and a practical implementation approach.
How do we start without adding operational complexity?
Start with a focused risk and scope assessment, then define implementation priorities, technical requirements, and phased rollout steps.
Related solutions
WAAP
Web Application and API Protection
Extend application protection to APIs, bots, and abuse scenarios.
Explore solutionMicrogateway
Microgateway Security
Apply protection controls close to microservices and sensitive internal integrations.
Explore solutionCKM
Certificate and Key Management
Govern certificates and keys to prevent surprise expiry and cryptographic material mismanagement.
Explore solutionCompliance
Cybersecurity Compliance Advisory
Translate control requirements into gaps, policies, priorities, and a measurable implementation roadmap.
Explore solutionReady for the next step?
Turn this need into a practical assessment and clear implementation plan.
Share your assessment goal and the teams involved so we can define the scope and deliverables.