Translate the service into responsibilities
Cloud service models divide responsibilities differently. Establish what the provider operates and what your organisation must configure, monitor and maintain. Capture the boundary for each important service, including its data, identities, integrations and support arrangements. A short responsibility matrix is often more useful than a generic assurance statement.
Pay attention to identity
Identify administrators, service accounts and machine identities. Review strong authentication, privileged access, account lifecycle processes and emergency access arrangements. Ask who can change the environment and who can see those changes. Do not assume that protections are active simply because a platform offers them.
Make configuration review repeatable
Agree secure configuration baselines for the services you actually use. Check network exposure, storage permissions, secrets handling and logging coverage. Record exceptions with owners and review dates. Repeat checks after material changes; a configuration assessment describes a point in time and needs an ongoing operating process.
Connect recovery to the business
Confirm backup responsibilities, restore procedures and dependencies on cloud accounts, networks and suppliers. Test whether recovery works under the conditions that would matter during an incident. Understand which data and configurations are included, and which would need to be reconstructed separately.
Begin with a bounded review
Select a critical application or landing zone and review the architecture, identity model, configuration and monitoring evidence together. Prioritise findings by business impact and agree who will remediate them. This produces a manageable plan and a reusable approach for the next cloud workload.
This article provides general guidance. Scope and applicable obligations should be confirmed for your organisation.