Cloud security best practices come down to eight controls: know what you own, lock down identities, and encrypt with your own keys. Then catch misconfigurations early, log everything, segment networks, keep immutable backups, and secure machine identities. IBM’s 2026 Cost of a Data Breach report puts the global average breach at $4.99 million, up 12% from 2025. Verizon’s 2026 Data Breach Investigations Report found 37% of organizations had an admin account with MFA off on an IaaS platform. Most fixes below are settings you can change this week.

Cloud Security Best Practices for 2026: Controls That Stop Breaches

Cloud Security Best Practices Start With Shared Responsibility

Under the shared responsibility model, cloud providers such as AWS secure the infrastructure, and you secure your data, identities, and settings.

AWS’s shared responsibility documentation splits duties by service type. On an EC2 virtual machine, you patch the guest operating system and set the firewall rules. On S3 or DynamoDB, AWS runs the operating system, and you manage encryption options, data classification, and IAM permissions.

Security task	IaaS (EC2, Azure VMs)	PaaS (RDS, Azure App Service)	SaaS (Microsoft 365, Salesforce)
Guest OS patching	You	Provider	Provider
Application code and patches	You	You	Provider
IAM and MFA configuration	You	You	You
Data classification and encryption choices	You	You	You

The split follows AWS’s EC2 and S3 examples. NSA’s Top Ten Cloud Security Mitigation Strategies, published March 7, 2024, lists shared responsibility first.

Patching shows why this matters. Verizon’s 2026 report found that exploited software flaws opened 31% of breaches in 2025, up from 20% in 2024. Patching is now the top way in. Verizon also found that only 26% of known-exploited flaws in CISA’s catalog were fully fixed in 2025. If you run virtual machines, our guide to operating system integration with cloud computing covers patch automation and multi-cloud setups.

Check which column your three largest workloads sit in before you apply any of these cloud security best practices. That column decides who gets paged when a patch slips.

Lock Down Identity and Access Management First

Verizon’s 2026 Data Breach Investigations Report found that only 23% of third-party organizations fully fixed missing or weak MFA on cloud accounts.

Verizon’s 2026 report also found a slow fix rate for third-party cloud accounts: weak passwords and excess permissions took almost eight months to reach 50% resolved. Identity cleanup is slow everywhere. Put it first in your cloud security best practices, before an incident forces the issue.

• Require phishing-resistant MFA, such as FIDO2 passkeys or hardware keys, for every admin and root account.
• Swap standing admin rights for just-in-time access that expires in hours.
• Keep two break-glass accounts offline and alert on every sign-in.
• Run AWS IAM Access Analyzer or Google Cloud IAM Recommender monthly, and remove permissions unused for 90 days.
• Review privileged roles every quarter.

That eight-month median is the best argument for a quarterly review over an annual one.

Encrypt Data and Control Your Own Keys

Encrypting cloud data at rest and in transit is the baseline, and NSA’s March 2024 guidance lists key management third among its ten strategies.

AWS has encrypted every new S3 object by default since January 2023, using keys AWS manages. That protects the disk. It will not stop a stolen credential with read access. S3 decrypts data for any caller it authorizes.

Cloud security best practices for encryption start with that default and add control over keys. In AWS KMS, a customer-managed key adds a second permission check. Readers also need kms:Decrypt on it. In Azure and Google Cloud, disabling a customer-managed key cuts off data access, a fast containment step in an incident. Turn on automatic rotation. Keep key admins separate from key users. Store keys in a different account or project than the data.

Ask whether your storage admins can also use your keys. If they can, the second check protects nothing.

Find Cloud Misconfigurations Before Attackers Do

IBM’s 2026 Cost of a Data Breach report lists cloud misconfigurations among the frequent root causes of AI-related breaches. Compromised APIs and vulnerable applications are on the same list.

Cloud security posture management (CSPM) tools compare your live settings with a benchmark such as the CIS Foundations Benchmarks. They flag drift. AWS Config, Microsoft Defender for Cloud, and Google Security Command Center include built-in posture checks. These checks turn cloud security best practices into rules a machine enforces on every change.

Preventive rules stop a bad setting before it exists. Restrict five at the organization level: public storage, security groups open to 0.0.0.0/0 on ports 22 and 3389, unencrypted volumes, long-lived access keys, and disabled logging.

Run the same checks in your pipeline. NSA’s March 2024 list includes infrastructure as code. A Terraform plan that fails on a public bucket never reaches production. Scanners also produce long lists. A continuous threat exposure management program ranks them by how an attacker could reach each item.

Start with public storage. One organization-level policy removes that exposure from every account at once.

Log Everything You Will Need During an Incident

NSA’s March 2024 guidance lists log management for threat hunting as one of ten cloud strategies. Logs help only if you enabled them before the incident.

Start with three sources: control-plane audit logs (AWS CloudTrail, Azure Activity Log, Google Cloud Audit Logs), network flow logs, and your identity provider’s sign-in logs.

If you run AWS CloudTrail with default settings, you will see management events only. S3 object-level and Lambda events stay off until you enable data events. A mass download then leaves no per-object trail.

Ship every log to a dedicated archive account. Set write-once retention for 12 months. Alert on five events: root sign-in, MFA removal, new access-key creation, logging turned off, and policy changes that grant full admin. Logs let you prove your other cloud security best practices worked. A long, quiet intrusion by an advanced persistent threat shows up only in the logs you kept.

A 12-month archive lets you answer whether an intruder was inside before your first alert fired.

Segment Networks and Shrink Public Exposure

Network segmentation limits lateral movement with separate virtual networks and deny-by-default rules, and NSA and CISA list it fourth among their March 2024 cloud strategies.

Segmentation is one of the cloud security best practices that limit damage after a credential leaks. Give production, staging, and development separate accounts or projects, each with its own virtual network. Block inbound SSH (port 22) and RDP (port 3389) from the internet. Use AWS Systems Manager Session Manager, Azure Bastion, or Google Cloud Identity-Aware Proxy for admin access.

Put databases in private subnets with no public IP address.

How many of your security groups still allow 0.0.0.0/0 on port 22?

Back Up Data Where Ransomware Cannot Delete It

Ransomware appeared in 48% of breaches in Verizon’s 2026 Data Breach Investigations Report. Immutable backups in a separate account make restoring possible.

Backups are the cloud security best practice you use after other controls fail. Use S3 Object Lock in compliance mode, Azure immutable blob storage, or Google Cloud Storage bucket lock. Keep the backup vault in an account that production admins cannot reach. In compliance mode, nobody, including the root user, can shorten the retention period.

Time a full restore of your largest database every quarter. That time is your real recovery time, and no vendor SLA changes it.

Machine Identities: The Cloud Security Gap in IBM’s 2026 Breach Data

IBM’s 2026 Cost of a Data Breach report found that fewer than half of organizations actively secure non-human identities. These are service accounts, API keys, tokens, and AI agents.

IBM’s 2026 report also found that 92% of organizations with an AI-related breach lacked proper AI access controls. IBM adds that only 40% of organizations use access controls on AI models and data in 2026. Verizon’s 2026 report also ties many third-party cloud incidents to missing MFA, poor key rotation, or weak least privilege on service accounts.

Example: in the Salesloft Drift campaign, which Verizon’s 2026 report describes from public disclosures, attackers stole OAuth tokens from the Drift application. They then used those tokens against Salesforce to take customer data.

Four steps bring machine identities under control. Inventory every service account, access key, OAuth app, and CI/CD token. Swap long-lived keys for short-lived credentials from IAM roles, managed identities, or workload identity federation. Give each identity an owner and an expiry date. Alert when a key is used from a new network or region.

Add a machine-identity line to your cloud security best practices checklist. Then find the oldest access key in your account and ask who owns it. If nobody answers, that key is your first cleanup task.

Cloud Security Best Practices for Small Teams: When Standard Advice Backfires

Small teams usually get more from five native provider controls than from a paid cloud-native application protection platform (CNAPP). Findings with no owner never get fixed.

Verizon’s 2026 report ties falling fix rates to volume. Its data grew from 68.7 million vulnerability records in 2022 to 527.3 million in 2025. Every scanner you add produces more findings, and a three-person team has the same hours to fix them.

The cloud security best practices above all apply to small teams, but the order changes. Start with phishing-resistant MFA on root and admin accounts, an account-wide public-access block on storage, budget and anomaly alerts, a log archive account, and immutable backups. If you sell to regulated customers, you will also need paperwork. Our guide to cybersecurity compliance for small businesses covers PCI DSS, CIS Controls, and vendor questionnaires.

Advanced Cloud Security Best Practices: A 30-Day Plan for Practitioners

Practitioners with two or more years in cloud operations can close the highest-risk gaps in 30 days. Work in four weekly passes: identities, exposure, logging, and recovery.

1. Week 1, identities: Inventory every non-human identity. Rotate or delete access keys older than 90 days. Enforce phishing-resistant MFA on every admin role.
2. Week 2, exposure: Write organization-level policies that block public storage, open SSH and RDP, and any change that turns logging off. Run them in audit mode for 3 to 5 days first, because strict policies break deployments.
3. Week 3, logging: Move logs to an archive account with 12-month write-once retention. Then add the five alerts listed above.
4. Week 4, recovery: Run a timed restore test and a tabletop exercise for one stolen-access-key scenario. Record time to detect and time to revoke.

Repeat the plan each quarter.

People Also Ask

What are the best practices for cloud security?

Cloud security best practices include enforcing MFA and least privilege, encrypting data with customer-managed keys, and scanning for misconfigurations. They also include archiving logs in a separate account, segmenting networks, keeping immutable backups, and inventorying machine identities. NSA’s March 2024 guidance lists ten strategies and starts with shared responsibility, then identity management.

What are the 5 pillars of cloud security?

Security firm we45 names five pillars of cloud security: identity and access management, data protection, infrastructure security, threat detection and response, and compliance and risk management. Other vendors group them differently. Use the list as a planning frame, and check it against NSA’s ten March 2024 strategies.

What is a cloud security best practices checklist?

A cloud security best practices checklist is a repeatable review of your cloud controls by area: identities, settings, workloads, data, monitoring, and compliance. Keep every line testable. For example, confirm MFA on every admin account, zero public storage buckets, 12 months of archived logs, and a restore test done this quarter.

What are cloud security key management best practices?

Cloud key management best practices are using a dedicated key service and turning on automatic rotation. Separate key admins from key users. Store keys in a different account from the data they protect. NSA and CISA’s March 2024 guidance lists secure key management as the third of ten strategies.

What are 3 measures used to protect the cloud?

Three core measures protect a cloud environment. They are identity controls such as MFA and least privilege, encryption of data at rest and in transit, and centralized logging with alerts. Each maps to a strategy in NSA’s March 2024 Top Ten list.

FAQs

How often should you review your cloud security best practices?

Review access every quarter, and let tools check settings continuously. Review the written policy once a year or after any major change to your cloud setup. Verizon’s 2026 report found that weak passwords and excess permissions took almost eight months to reach 50% resolved in third-party cloud environments. An annual access review leaves that gap open. Posture tools flag setting changes as they happen, but only people can decide whether a permission is still needed.

Does multi-cloud make cloud security harder?

Yes, usually, because each provider has its own IAM model, log format, and network defaults. Cloud security best practices never transfer cleanly between them. NSA’s March 2024 guidance gives its eighth strategy to hybrid and multi-cloud complexity. The trade-off is resilience: a second provider covers you if the first one goes down for a day. Before adding a second cloud, standardize on one identity provider and one log destination.

Is encryption enough to protect cloud data?

No. Encryption is one of the cloud security best practices. Alone, it cannot stop a stolen credential, because the storage service decrypts data for any caller it authorizes. AWS has encrypted new S3 objects by default since January 2023. An attacker with valid read permission still gets plaintext. Add customer-managed keys, least-privilege permissions, and logging. Keep encryption on anyway, since it covers lost disks, backups, and compliance rules.

How do you secure AI workloads and agents in the cloud?

Cloud security best practices for AI start with identity. Treat each workload and agent as an identity with its own least-privilege role, keys, and logs. IBM’s 2026 Cost of a Data Breach report found that 92% of organizations with an AI-related breach lacked proper AI access controls. It also lists cloud misconfigurations and compromised APIs among the frequent root causes. Set expiry dates and log every call.

What should a small team do first with cloud security best practices?

Turn on phishing-resistant MFA for root and admin accounts first. Verizon’s 2026 report found 37% of organizations had an admin account with MFA off on an IaaS platform, so that gap is common. Next, block public storage. Then archive logs in a separate account and set up immutable backups. Those four tasks use native provider settings, so they need no new platform to start. Add paid tools only after someone owns the findings.