)
Last updated: October 15, 2026
What are the most important cloud security best practices in 2026? Secure identities first, protect data with encryption and tested backups, segment networks, log what matters, and govern everything against a recognized framework. This guide gives 25 practices, each tied to a named control, including five for AI agents and LLM workloads that most checklists skip.
TL;DR: Key Takeaways
- The Cloud Security Alliance's Cloud Controls Matrix v4.1 holds 197 control objectives in 17 domains, so use it as your master map (CSA).
- NSA published ten cloud mitigation strategies in March 2024, and CISA joined on six of them (NSA, 2024).
- NIST Cybersecurity Framework 2.0 has six functions, with Govern added as the sixth (NIST, 2024).
- In all four columns of Microsoft's responsibility matrix (on-premises, IaaS, PaaS, SaaS), customer data, configurations and identities stay with you (Microsoft Learn).
- The CSA AI Controls Matrix adds 243 control objectives across 18 domains for AI workloads (CSA).
25 cloud security best practices at a glance
| # | Practice | Priority | Effort |
|---|---|---|---|
| 1 | Map shared responsibility per service | Critical | Low |
| 2 | Keep a live asset inventory | High | Medium |
| 3 | Baseline configurations to CIS Benchmarks | High | Medium |
| 4 | Enforce phishing-resistant MFA | Critical | Low |
| 5 | Use federation and temporary credentials | Critical | Medium |
| 6 | Apply and review least privilege | Critical | High |
| 7 | Protect privileged accounts | High | Medium |
| 8 | Keep secrets out of code | Critical | Medium |
| 9 | Classify data | High | Medium |
| 10 | Encrypt at rest and in transit | Critical | Low |
| 11 | Choose a key management model | High | Medium |
| 12 | Keep immutable, tested backups | High | Medium |
| 13 | Segment networks, default deny | High | High |
| 14 | Limit public exposure | Critical | Medium |
| 15 | Patch and scan continuously | High | Medium |
| 16 | Secure CI/CD and infrastructure as code | High | High |
| 17 | Centralize and protect logs | Critical | Medium |
| 18 | Monitor posture and threats | High | Medium |
| 19 | Rehearse incident response | High | Medium |
| 20 | Verify providers, automate compliance evidence | Medium | Medium |
| 21 | Give each AI agent a scoped identity | Critical | Medium |
| 22 | Protect model and API keys | Critical | Low |
| 23 | Detect prompt injection and data leakage | High | Medium |
| 24 | Control agent egress and tool access | High | Medium |
| 25 | Log every agent tool call | High | Medium |
Priority and effort are our editorial judgment, not framework ratings.
Cloud security best practices: who owns what
Cloud security best practices begin with ownership. The provider secures the infrastructure, and you secure what you put on it: data, identities, configurations and workloads. How much of the stack you own depends on whether you buy IaaS, PaaS or SaaS.
| Layer | IaaS | PaaS | SaaS |
|---|---|---|---|
| Physical and host infrastructure | Provider | Provider | Provider |
| Operating system and patching | Customer | Provider | Provider |
| Your application code | Customer | Customer | Provider |
| Configurations and settings | Customer | Customer | Customer |
| Identities and access | Customer | Customer | Customer |
| Data | Customer | Customer | Customer |
Simplified from Microsoft Learn's responsibility matrix and service definitions. Check each service's own documentation, because exact splits vary.
How we built this list
We read five top-ranking guides for this keyword and found that none of their numbered practices covers AI agents. We mapped each practice to the closest NIST SP 800-53 control, CSA CCM domain or primary source. The mapping is our judgment, so verify control IDs against the catalogs before an audit.
1) Map shared responsibility for every service
Write down, per service, who patches, who configures and who monitors. NSA lists upholding the shared responsibility model as its first strategy. Anchors: NIST CSF GV.RR, CCM GRC.
2) Keep a live asset inventory
You cannot protect what you have not found. Build the inventory from cloud APIs so it updates itself, and include non-human identities and AI services. Anchors: NIST CSF ID.AM, SP 800-53 CM-8.
3) Baseline configurations to CIS Benchmarks
CIS publishes more than 100 free benchmark PDFs across 25+ vendor product families, and its Foundations Benchmarks cover account-level settings for AWS, Azure and Google Cloud, among others (CIS). Enforce Level 1 as code. Anchors: SP 800-53 CM-6, CCM CCC.
Identity and access best practices
Identity is the control plane of the cloud: an attacker holding one valid credential inherits its permissions. NSA's guidance asks for phishing-resistant MFA, temporary credentials, least privilege and separation of duties.
4) Enforce phishing-resistant MFA
Require FIDO2 or WebAuthn for every human account, starting with administrators and root. NSA's IAM guidance notes that many common MFA types can be defeated by phishing. Anchors: SP 800-53 IA-2, NIST CSF PR.AA.
5) Use federation and temporary credentials
Federate people through your identity provider and give workloads roles that issue short-lived credentials. Where long-lived keys are unavoidable, rotate them and delete the unused ones. Anchors: SP 800-53 IA-5, CCM IAM.
6) Apply and review least privilege
Grant only what each task needs, then remove unused permissions on a schedule. Add organization-level guardrails so no single account can exceed policy. Anchors: SP 800-53 AC-6, CCM IAM.
7) Protect privileged accounts
Treat root, break-glass and admin accounts as high-value targets. Require two-person approval for sensitive actions. Anchors: SP 800-53 AC-5, CCM IAM.
8) Keep secrets out of code
Store credentials in a secrets manager, never in plain text, source code or images. Rotate them automatically and scan repositories for leaks. Anchors: SP 800-53 IA-5, SC-12.
Data protection best practices
Data is the one asset you keep responsibility for in every service model. Classify it, encrypt it, control the keys, and back it up so that an attacker with admin rights cannot erase the copies.
9) Classify data
Label data by sensitivity and record where it sits, including copies in logs, analytics stores and vector databases. Controls follow the label. Anchors: NIST CSF ID.AM, CCM DSP.
10) Encrypt at rest and in transit
Encrypt storage by default and encrypt traffic between every tier, not only at the edge. NSA and CISA recommend TLS 1.2 or later for application protocols. Anchors: SP 800-53 SC-8, SC-28; CCM CEK.
11) Choose a key management model
Decide between provider-managed, customer-managed and customer-held keys based on risk tolerance and who must be able to revoke access. Keep key administrators separate from key users. Anchors: SP 800-53 SC-12, CCM CEK.
12) Keep immutable, tested backups
Keep immutable backups with documented recovery plans, and test restores. Backups protect against ransomware and against your own deletion mistakes. Anchors: SP 800-53 CP-9, CCM BCR.
)
Network and workload best practices
Assume a workload will be compromised and limit what it can reach. NSA recommends Zero Trust principles and microsegmentation so that only necessary communication paths exist.
13) Segment networks, default deny
Separate teams, environments and admin planes first, then apply default-deny rules between workloads and disable unneeded services such as SSH. Anchors: SP 800-53 SC-7, CCM IVS.
14) Limit public exposure
Inventory every public endpoint, remove public IPs from data stores and use private endpoints where offered. Anchors: SP 800-53 SC-7, CSF PR.IR.
15) Patch and scan continuously
Scan images, hosts and dependencies on every build and on a schedule, and patch by exploitability rather than age. In IaaS you own the operating system and application patching. Anchors: SP 800-53 RA-5, SI-2; CCM TVM.
16) Secure CI/CD and infrastructure as code
Pipelines hold deploy credentials, so treat them as production. NSA recommends strong IAM, patched tooling, audit logs and careful secrets handling, plus scanned infrastructure as code templates to cut misconfigurations. Anchors: SP 800-53 CM-3, SA-11; CCM CCC.
Logging, detection and response best practices
You can only investigate what you recorded. NSA notes that "Default logging policies vary greatly between cloud services," so verify what each service emits, centralize it and protect it from tampering.
17) Centralize and protect logs
Send control-plane, identity, network and application logs to one protected store with defined retention, and give log administration to a separate role. Anchors: SP 800-53 AU-2, AU-9; CCM LOG.
18) Monitor posture and threats
Combine drift and misconfiguration monitoring with threat detection on logs, and route alerts to a staffed on-call rota. Anchors: NIST CSF DE.CM, SP 800-53 SI-4, CA-7.
19) Rehearse incident response
Write cloud playbooks for a leaked key, a public bucket, a compromised workload and a rogue agent. Rehearse them, including token revocation and account isolation. Anchors: SP 800-53 IR-3, IR-4; CCM SEF.
20) Verify providers, automate compliance evidence
Collect provider attestations and audit managed service partners' privileged accounts, as NSA advises. Generate audit evidence from configuration data. Regulated teams can map this to sector rules, as in our guide for banks. Anchors: SP 800-53 SR-6, CA-7; CCM STA.
Security and governance: cloud security best practices for AI agents and LLMs
AI agents turn cloud workloads into actors that choose actions. A prompt injection can steer an over-permissioned agent into reading storage or calling tools it was never meant to use. Your cloud controls still apply, but five practices need an agent-specific layer.
OWASP names three root causes of Excessive Agency: excessive functionality, excessive permissions and excessive autonomy. Its advice is to "Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not" (OWASP, 2025). Our guide to excessive agency covers the patterns.
The cloud case is concrete. Palo Alto Networks' Unit 42 reported on March 31, 2026 that a deployed agent on Google Cloud's Vertex AI Agent Engine had excessive default permissions, and that its researchers extracted the service agent's credentials through the metadata service and read Cloud Storage data. Google revised its documentation and recommended a dedicated service account (Unit 42, 2026). This is vendor-reported research. The lesson is general: agents inherit whatever identity the platform assigns.
AWS's Agentic AI Security Scoping Matrix (November 2025) sorts agent systems into four scopes and names six security dimensions, including identity context and audit and logging (AWS, 2025).
| # | Practice | What goes wrong without it |
|---|---|---|
| 21 | Scoped agent identity | Agents run with broad default or shared service accounts |
| 22 | Model and API key protection | Keys leak through prompts, notebooks and repositories |
| 23 | Runtime detection | Hidden instructions steer the agent or expose data |
| 24 | Egress and tool control | Agents send data to arbitrary hosts or call unapproved tools |
| 25 | Tool-call logging | No evidence of what an agent did or who approved it |
21) Give each AI agent a scoped identity
Create one identity per agent with narrow roles, no shared service accounts and no inherited platform defaults. See RBAC for AI agents. Anchors: SP 800-53 AC-6, CCM IAM, CSA AICM.
22) Protect model and API keys
Keep model provider keys and tool tokens in a secrets manager, issue them per agent, and set spend and rate limits so a stolen key has a ceiling. Anchors: SP 800-53 IA-5, SC-12.
23) Detect prompt injection and data leakage
Treat external content as untrusted, validate outputs and detect injection and leakage at runtime rather than trusting the model to refuse. See our indirect prompt injection guide. Anchors: OWASP LLM01, LLM02.
24) Control agent egress and tool access
Default-deny outbound traffic from agent runtimes, allow only approved tools and MCP servers, and require human approval for high-impact actions. This extends practice 13. Anchors: SP 800-53 SC-7, AC-4; OWASP LLM06.
25) Log every agent tool call
Record which agent called which tool, with what parameters, what came back and who approved it, in the same central store as your cloud logs. Anchors: SP 800-53 AU-2, AU-12; AWS audit and logging dimension.
NeuralTrust is an AI agent security company, not a CSPM or CNAPP platform, and it complements those tools by covering the agent layer they do not model. Agent Gateway (TrustGate) sits between agents, workflows, models and MCP tools, enforces per-agent permissions and limits, and offers 200+ pre-built MCP servers. Agent Runtime Security (TrustGuard) detects prompt injection and data leakage at runtime. Agent Posture Management (TrustLens) inventories agents and their connections, and AI Red Teaming (TrustTest) tests agents before launch. The Runtime Security Mesh platform deploys in your own infrastructure or on-premises, with a managed service in the EU or US. For governance patterns, see AI gateway enterprise governance.
A 30-day rollout plan
You do not need all 25 practices on day one. Work in the order below, finish each block before starting the next, and record anything you defer in an exception register.
How to roll out the 25 practices in 30 days
- Days 1 to 5: map and inventory. Document shared responsibility per service, build the asset inventory and choose a framework as your reference (practices 1 to 3).
- Days 6 to 10: fix identity. Enforce phishing-resistant MFA, move to temporary credentials, remove unused permissions and move secrets into a manager (practices 4 to 8).
- Days 11 to 15: protect data. Classify data, confirm encryption, set the key model and run one restore test (practices 9 to 12).
- Days 16 to 20: shrink the attack surface. Close public exposure, add default-deny segments, scan for vulnerabilities and secure the pipeline (practices 13 to 16).
- Days 21 to 25: see and respond. Centralize logs, turn on posture and threat alerts, run one incident drill and review provider assurance (practices 17 to 20).
- Days 26 to 30: govern the agent layer. Give each agent its own identity, protect keys, add runtime detection, restrict egress and tool access, and log tool calls (practices 21 to 25).
Where to start: priorities by team size and maturity
Start with the practices that remove common causes of cloud compromise: weak identity, public exposure and missing logs. The table maps four situations to a first set of practices.
| Your situation | Start with practices | Why |
|---|---|---|
| Small team, one cloud account | 4, 5, 6, 10, 17 | Identity, encryption and logs cover most risk at low effort |
| Growing team, many accounts | 1, 2, 13, 16, 18 | Ownership, inventory and guardrails keep sprawl in check |
| Regulated enterprise | 11, 12, 19, 20 | Keys, recovery, response and evidence support audits |
| Platform team shipping AI agents | 21 to 25 | Agent identity, egress and tool logs close the agent gap |
Conclusion
The strongest cloud security best practices are not exotic: identity discipline, encrypted and recoverable data, segmented networks, useful logs and clear ownership, mapped to frameworks you can audit against. What has changed is that agents now act inside your cloud with real credentials. Adopt the 25 practices in order, give every agent its own identity and enforce tool access outside the model.
Secure Your Cloud AI Agents in Production with NeuralTrust
Add per-agent permissions, runtime detection and tool control on top of the cloud security you already run.
)
Related Comparisons
FAQs about Cloud Security Best Practices
1. What are the most important cloud security best practices?
Enforce phishing-resistant MFA, use temporary credentials and least privilege, encrypt data and test backups, limit public exposure, centralize logs and rehearse incident response. Then add AI agent controls: scoped identities, key protection, egress control and tool-call logs.
2. What is the shared responsibility model in cloud security?
It splits security duties between provider and customer. The provider secures the underlying infrastructure, while you secure your data, identities, configurations and, depending on the service model, operating systems and applications. Microsoft says you always retain data, endpoints, accounts and access management.
3. What are the five pillars of cloud security?
There is no single official list. Common groupings are identity, data, network, workload and detection with response. NIST CSF 2.0 organizes security into six functions instead: Govern, Identify, Protect, Detect, Respond and Recover. Pick one structure and map your controls to it.
4. Which framework should I use to audit cloud security?
Use the CSA Cloud Controls Matrix for cloud-specific controls, NIST CSF 2.0 for program governance and SP 800-53 for control wording, plus CIS Benchmarks for configuration settings. For AI workloads, add the CSA AI Controls Matrix.
5. How do you secure AI agents running in the cloud?
Give each agent its own narrow identity, store model and API keys in a secrets manager, detect prompt injection and data leakage at runtime, restrict outbound traffic and approved tools, and log every tool call. Enforce authorization outside the model, as OWASP advises.
6. How should a small team start with cloud security?
Begin with phishing-resistant MFA, temporary credentials, least privilege, default encryption and centralized logs. These need little tooling. Then follow the 30-day plan above to add inventory, network controls and incident response.
7. Does an AI agent security tool replace CSPM or CNAPP?
No. Posture and workload platforms cover cloud resources and configurations. An AI agent security layer covers what agents do: which tools they call, what data they send and whether injected instructions steer them. The two approaches complement each other.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- Cloud Security Alliance, "Cloud Controls Matrix" (v4.1): https://cloudsecurityalliance.org/research/cloud-controls-matrix
- Cloud Security Alliance, "AI Controls Matrix" (v1, updated Oct 30, 2025): https://cloudsecurityalliance.org/artifacts/ai-controls-matrix/
- NIST, "NIST Releases Version 2.0 of Landmark Cybersecurity Framework," Feb 26, 2024: https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework
- NSA, "NSA Releases Top Ten Cloud Security Mitigation Strategies," Mar 7, 2024: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3699169/nsa-releases-top-ten-cloud-security-mitigation-strategies/
- Microsoft Learn, "Shared responsibility in the cloud": https://learn.microsoft.com/en-in/azure/security/fundamentals/shared-responsibility
- CIS, "Foundational Cloud Security with CIS Benchmarks": https://www.cisecurity.org/insights/blog/foundational-cloud-security-with-cis-benchmarks
- OWASP GenAI, "LLM06:2025 Excessive Agency": https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
- Palo Alto Networks Unit 42, "Double Agents: Exposing Security Blind Spots in GCP Vertex AI," Mar 31, 2026: https://unit42.paloaltonetworks.com/double-agents-vertex-ai/
- AWS Security Blog, "The Agentic AI Security Scoping Matrix," Nov 21, 2025: https://aws.amazon.com/blogs/security/the-agentic-ai-security-scoping-matrix-a-framework-for-securing-autonomous-ai-systems
- NIST, "SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations": https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
)
)
)
)