MBSS Compliance
Minimum Baseline Security Standards — the cloud security control framework enforced by MCM SecOps.
MBSS (Minimum Baseline Security Standards) Compliance defines the minimum required security controls that every system, cloud account, application, or infrastructure must comply with. It functions as a baseline security framework covering IAM, networking, logging, encryption, monitoring, and vulnerability management.
MBSS is similar in spirit to CIS Benchmarks, NIST 800-53, or ISO 27001 Annex A controls — but is typically customised per organisation.
| Control | Description |
|---|
| MFA enabled | All users must have multi-factor authentication active |
| No root-user usage | Root/admin accounts must not be used for day-to-day operations |
| Least privilege | IAM roles and policies must follow the principle of least privilege |
| Strong password policy | Minimum length, complexity, and rotation requirements enforced |
| Control | Description |
|---|
| No open ports | Unnecessary ports must be closed on all security groups / firewalls |
| Restricted inbound/outbound rules | Only explicitly required traffic is permitted |
| Traffic logging enabled | VPC Flow Logs or Azure NSG Flow Logs must be active |
| Control | Description |
|---|
| CloudTrail / Activity Logs enabled | Cloud audit logs must be active for all accounts |
| Centralised log retention | Logs must be retained for a defined period in a central store |
| Alerts for key events | Alerts on IAM changes, root login, policy violations |
| Control | Description |
|---|
| Storage encrypted at rest | S3, EBS, RDS, and equivalent Azure storage must use encryption |
| TLS 1.2+ enforced | All data in transit must use TLS 1.2 or higher |
| Control | Description |
|---|
| Mandatory tags | All resources must have owner and cost-center tags |
| Backups enabled | Backup policies must be active for databases and critical storage |
| Versioning enabled | S3 buckets and equivalent storage must have versioning where applicable |
| Control | Description |
|---|
| Regular scanning | All hosts and containers must be scanned on a defined schedule |
| OS patch compliance | Operating systems must be on a supported and patched version |
| Control | Description |
|---|
| Naming standards | Cloud resources must follow organisational naming conventions |
| Region restrictions | Resources must only be provisioned in approved regions |
| Resource guardrails | Policies prevent creation of non-compliant resource configurations |
MBSS represents the baseline operational and security controls needed to ensure cloud accounts meet a minimum safe configuration. MCM enforces these controls through the combination of Cloud Custodian (cloud-level configuration policies) and Wazuh (host-level and runtime compliance checks).
