Security · 1 min · Jun 25, 2026
A HIPAA cloud baseline that auditors accept
Concrete AWS and Azure settings, not abstract control numbers.
By franklin
Auditors do not care about your slide deck. They care about specific settings.
AWS
- All buckets default-encrypted with SSE-S3 or KMS
- CloudTrail multi-region with log-file validation
- GuardDuty enabled across regions
- IAM access analyzer monitored weekly
- VPC flow logs to S3 with 1-year retention
Azure
- Defender for Cloud on all subscriptions
- Diagnostic settings to Log Analytics with 1-year retention
- Conditional access requires compliant device
- Private endpoints for storage and Key Vault