AWS Security Services for SMBs and Startups
Most small-company AWS accounts were set up to ship, not to pass a security review. PlatOps puts a proper baseline in place for businesses with 10–200 employees and funded startups that have no security engineer on staff.
We use AWS's own services, measure progress against the AWS Foundational Security Best Practices standard, and deliver everything as code in your accounts, so the controls stay yours.
What the baseline puts in place
Built with native AWS services, in your accounts
- Separate accounts under AWS Organizations
- IAM Identity Center sign-in with MFA for everyone
- Organization-wide CloudTrail and AWS Config
- GuardDuty and Security Hub CSPM in every account
- KMS encryption defaults and locked backups
- A findings register and runbooks you keep
Running on more than one cloud? See our multi-cloud security overview.
Who AWS security hardening is for
Companies with 10–200 employees and funded startups whose AWS environment grew faster than anyone's time to secure it. AWS secures the infrastructure under its services; under its AWS: Shared responsibility model, identities, permissions, network settings, encryption and logging are yours.
It fits if this sounds familiar
- Everything runs in one AWS account that started as a prototype and became production
- Several people sign in as IAM users with long-lived access keys, or share one administrator login
- Nobody is sure whether CloudTrail, GuardDuty or Security Hub are switched on, or who reads their findings
- A customer security questionnaire, a cyber insurer or a SOC 2 or HIPAA audit is asking about your AWS controls
- Backups exist, but nobody has restored one, and an attacker with admin rights could delete them
- You handle patient, client or financial data in AWS and have no in-house security engineer
Probably not a fit if
- Your workloads are mainly on Azure or Google Cloud. See our Azure and GCP security pages instead.
- You need a penetration test or red-team exercise. That is a separate security assessment.
- You want a dashboard turned on and nothing else. The value is in fixing and owning the findings.
The AWS security baseline we put in place
Seven control areas, built with AWS's own services rather than a third-party platform you would have to license. Each maps to checks in the AWS Foundational Security Best Practices (FSBP) standard, so progress is measurable.
Account structure with AWS Organizations
An AWS account is a hard boundary for access, security and billing. A mistake or a compromise in a test account should not reach production.
- An organization with separate accounts for production, non-production, log archive and security tooling
- Service control policies as guardrails, such as blocking unused Regions and stopping anyone from disabling logging
- Centralized root access: root credentials removed from member accounts, with privileged tasks run from the management account
- Hardware or phishing-resistant MFA on the management account root user
FSBP checks include IAM.4 (no root access keys) and IAM.6 (hardware MFA for root).
Identity: IAM Identity Center and MFA
One sign-in per person, with MFA, mapped to permission sets by job, instead of IAM users scattered across accounts.
- IAM Identity Center connected to Microsoft Entra ID, Google Workspace or Okta, or its own directory if you have none
- MFA required for every person, and short-lived credentials for the AWS CLI
- Permission sets for real job functions, with administrator access kept to a named few
- Long-lived IAM user access keys removed, or rotated and scoped where a tool truly needs them
- IAM Access Analyzer reviewing what is shared outside your organization
FSBP checks include IAM.1, IAM.3, IAM.5 and IAM.8.
Audit logging: CloudTrail and AWS Config
If something goes wrong, you need to know who did what, when, and what the resource looked like before.
- A multi-Region organization trail in CloudTrail, which member accounts cannot switch off or edit
- Logs delivered to the log archive account, encrypted, with log file validation and retention set to your policy
- AWS Config recording resource configuration history in every account and Region you use
- Alerts on high-risk events such as root sign-in, logging changes and new access keys
FSBP checks include CloudTrail.1, CloudTrail.2, CloudTrail.4 and Config.1.
Threat detection and posture: GuardDuty and Security Hub CSPM
GuardDuty watches for active threats; Security Hub CSPM checks configuration against a standard. You need both, and someone who reads them.
- GuardDuty enabled organization-wide, analyzing CloudTrail management events, VPC flow logs and DNS logs
- Protection plans such as S3 and RDS Protection chosen by what you actually run
- Security Hub CSPM with the AWS Foundational Security Best Practices standard across all accounts, aggregated to one Region
- Findings routed to a channel or ticket queue a person owns, with severity-based response
FSBP checks include GuardDuty.1 and the GuardDuty protection-plan controls.
Encryption: KMS and safe defaults
Encryption at rest that is on by default, with keys whose use you can audit.
- EBS default encryption on in every Region you use
- S3 Block Public Access at the account level, with exceptions documented
- Customer managed KMS keys where you need key-level access control, with rotation enabled
- Key policies that stop broad decrypt permissions and accidental key deletion
FSBP checks include EC2.7, S3.1, KMS.1, KMS.2 and KMS.3.
Backup and recovery: AWS Backup
Ransomware and a stolen admin credential both go after backups first. Backups need to survive the account they protect.
- AWS Backup plans for databases, volumes and file systems, set by business need
- Copies to a separate account, and Vault Lock so recovery points can't be deleted early
- Restore tests on a schedule, with results recorded as audit evidence
FSBP checks include Backup.1, RDS.11 and EFS.2.
Network exposure
The fewest possible things reachable from the internet, and a record of the traffic.
- Security groups reviewed for SSH, RDP and database ports open to the world
- Session Manager instead of SSH bastions where possible
- IMDSv2 required on EC2 instances
- VPC flow logs on, and databases kept off public subnets
FSBP checks include EC2.2, EC2.8, EC2.19, EC2.6 and RDS.2.
Sources: AWS: Foundational Security Best Practices standard in Security Hub CSPM; AWS: Creating a CloudTrail trail for an organization; AWS: Centralize root access for member accounts; AWS: What is IAM Identity Center?; AWS: What is Amazon GuardDuty?; AWS: AWS Backup Vault Lock.
How we use the Security Hub score
Security Hub CSPM gives each enabled standard a score from 0 to 100%: the share of enabled controls that pass. It is a useful progress measure and an easy one to game, because suppressing a failed finding turns the control green without changing anything in your account.
So we treat the score as a target, never as the goal:
- We record your FSBP score on day one as the baseline.
- We agree a target score with you, based on which controls matter for what you run.
- Controls we deliberately leave failing go in the findings register with a reason and an owner, rather than being suppressed.
- In an organization, a control failing in one member account fails for the whole organization, so the score reflects your weakest account.
Sources: AWS: Calculating security scores; AWS: Introduction to Security Hub CSPM.
What a hardening engagement delivers
Three stages. How long it takes depends on how many accounts you have and how much of today's setup was built by hand, which the assessment tells us.
Assess
Read-only access first. We switch on the detective services if they are off and look at what they report.
- Account, identity, logging and network review
- Security Hub CSPM and GuardDuty enabled, with the current FSBP score recorded as your baseline
- Findings ranked by real exposure, not by count
Harden
Changes go through infrastructure as code and are agreed with you, so nothing breaks production by surprise.
- Account structure, IAM Identity Center and MFA
- Organization trail, Config, GuardDuty and Security Hub CSPM across all accounts
- Encryption defaults, backup vaults and network fixes
Hand over
You leave with the controls running and a clear record of what is left.
- Terraform or CloudFormation in your repository
- A findings register: fixed, accepted with a reason, or scheduled
- Runbooks for the alerts you will actually get
What you have at the end
- AWS Organizations structure with service control policies
- IAM Identity Center with MFA and job-based permission sets
- Organization CloudTrail trail and AWS Config recording
- GuardDuty and Security Hub CSPM across every account, aggregated in one place
- Encryption, S3 public access and backup protections applied
- A findings register and FSBP score baseline, with a target score agreed with you
- Infrastructure as code and runbooks in your repository
- A control mapping for SOC 2 or HIPAA, if you need one
Where it meets HIPAA, SOC 2 and PCI DSS
The baseline covers technical safeguards and produces evidence. Compliance also needs policies, risk analysis and training, which our compliance services cover.
HIPAA
Accept the AWS Business Associate Addendum in AWS Artifact, keep PHI in HIPAA-eligible services, and use CloudTrail, Config and access reviews as evidence for the Security Rule's audit and access controls.
HIPAA Risk Analysis SprintSOC 2
Auditors ask for access reviews, change history, logging and incident handling. The baseline produces most of that evidence as a by-product.
SOC 2 Readiness SprintPCI DSS and CIS
Security Hub CSPM also offers CIS AWS Foundations Benchmark and PCI DSS standards. We enable them when an auditor or contract calls for them, not by default.
Compliance certificationSource: AWS: HIPAA compliance. Comparing providers for patient data? Read AWS vs GCP vs Azure for HIPAA.
How to start, and what it costs
The usual first step is the Cloud & DevOps Audit Sprint: a fixed $5,000, 30-day engagement that includes a security posture review of your AWS environment (identity, network exposure, audit logging and patching) and ships three agreed quick wins. Hardening work is scoped from what it finds, so you are not paying for controls you already have.
Keeping the baseline healthy afterwards, including reading GuardDuty and Security Hub findings, patching and access reviews, fits our monthly retainers: Essential at $3,500–$7,500 a month, Professional at $8,000–$15,000 a month with 24/7 human response, and Enterprise priced to scope.
AWS bills its security services to you directly, by usage. GuardDuty and Security Hub CSPM each start with a 30-day free trial, which we use to estimate the steady-state cost before you commit.
AWS security FAQ
What do AWS security services from PlatOps include?
A hardening engagement for your AWS environment: an AWS Organizations account structure, IAM Identity Center with MFA, an organization CloudTrail trail, AWS Config, GuardDuty, Security Hub CSPM with the AWS Foundational Security Best Practices standard, encryption defaults with KMS, and AWS Backup protections. Everything is delivered as infrastructure as code in your accounts, with a findings register and runbooks.
Isn't AWS responsible for security?
Only part of it. Under AWS's shared responsibility model, AWS secures the infrastructure that runs its services, and you are responsible for security in the cloud: identities, permissions, network settings, encryption choices, logging and your data. That customer side is what this service hardens.
What is the AWS Foundational Security Best Practices standard?
It is a set of automated controls in AWS Security Hub CSPM, developed by AWS, that detect when accounts and resources drift from security best practice, such as root access keys, public S3 buckets, unencrypted volumes or missing logging. AWS describes it as applicable to organizations of any sector or size, which is why we use it as the default standard.
What Security Hub score will we get?
We don't promise one. Security Hub CSPM scores the share of enabled controls that pass, and suppressing findings raises the score without making anything safer. We record your starting score, agree a target with you, and document every control we deliberately leave failing, with the reason.
Do we need AWS Organizations if we only have one account?
Usually yes, once you have production data. A separate production account limits the blast radius of mistakes and compromises, an organization trail logs every account centrally, and service control policies let you block risky actions everywhere. Setting it up early is far easier than splitting a crowded account later.
How much do GuardDuty, Security Hub and Config cost to run?
They are billed by AWS based on usage: events and logs analyzed for GuardDuty, security checks and findings for Security Hub CSPM, and configuration items recorded for Config. GuardDuty and Security Hub CSPM each start with a 30-day free trial, and we use that month to estimate your steady-state cost before you commit.
Will hardening break our production workloads?
It shouldn't, because changes are staged. We start read-only, agree each change with you, apply it through infrastructure as code with a rollback path, and leave higher-risk items such as tightening application permissions to scheduled windows.
Does this make us HIPAA or SOC 2 compliant?
No single technical project does. The baseline covers many of the technical safeguards and produces evidence auditors ask for, but HIPAA and SOC 2 also require policies, risk analysis, training and vendor management. We map the AWS controls to your framework and point to what is still open.
How do we start, and what does it cost?
Most clients start with the Cloud & DevOps Audit Sprint: $5,000 and 30 days, including a security posture review of your AWS environment and three quick wins shipped. Hardening work is scoped from its findings. Ongoing monitoring and response fit our retainers, from $3,500 a month on Essential.
Related Articles
Guides and resources to help you go deeper
Related security and cloud services
Security Services
Where to start, by problem
Learn moreAzure Security
The same baseline approach for Microsoft Azure subscriptions and Entra ID.
Learn moreGCP Security
Organization policies, IAM and Security Command Center for Google Cloud.
Learn moreWell-Architected Review
A broader review of reliability, cost and performance as well as security.
Learn moreDisaster Recovery
Recovery targets, cross-region copies and failover tests beyond the backup baseline.
Learn moreCompliance Certification
SOC 2, HIPAA and ISO 27001 programs, from readiness to audit.
Learn moreFind out where your AWS account stands
On a 1-hour call we'll ask how your accounts are set up and what is driving the question, whether that is a questionnaire, an audit or a near miss, and suggest the smallest useful next step.