Cloud landing zone review

Control Design Assessment (CDA)

Procedures evaluating whether the control is designed adequately.

1. 1.Obtain and read the landing zone review procedure; confirm it defines the architecture and security criteria a workload must satisfy before go-live.
2. 2.Confirm the go-live gate is enforced by the deployment pipeline or change process rather than relying on team discipline.

Control Operating Effectiveness (COE)

Procedures evaluating whether the control operated over the testing period.

1. 1.Select 25 workloads that went live in the period and confirm each has a completed landing zone review predating go-live.
2. 2.Confirm no sampled workload went live with open critical findings from its review.
3. 3.For any workload that bypassed the gate, confirm it was identified and remediated.

Linked risks

• Cloud misconfiguration exposuremitigation 2
• Cloud program governance gapsmitigation 2

Framework mappings & latest test