Configuration & Posture:
CIS benchmark checks, public storage exposure, security group/firewall drift, KMS/HSM settings
CIS benchmark checks, public storage exposure, security group/firewall drift, KMS/HSM settings
IAM role changes, privilege escalation attempts, stale/over-privileged accounts, OAuth/OIDC app grants
Trend KPIs—MTTD/MTTR, detection coverage, control drift, risk reduction.
 Backup success/RPO/RTO, cyber-recovery readiness (immutability, isolation).
Timeline, control gaps, and prioritized fixes; detections updated from lessons learned.
Aligns with IT/BCP to restore services, validate integrity, and re-enable access safely.