Identity & Access Engineering
CCM v4.1: IAM
Entra ID security baselines, Conditional Access, phishing-resistant MFA, and privileged access for people, and for the service accounts, workloads, and AI agents acting on their behalf.
Discuss this
Aligned to CSA Cloud Controls Matrix v4.1
Identity Security, Built for the Modern Enterprise
Identity, logging, and compliance engineering mapped to the Cloud Security Alliance Cloud Controls Matrix v4.1, built to hand off cleanly to the SOC or MDR provider you already rely on.
17
CCM v4.1 Domains Mapped
207
Controls in CCM v4.1
2023
Founded
Phoenix
Arizona-Based
Our Services
Hands-on identity and cloud security engineering, mapped to CSA CCM v4.1 domains.
SIEM & Detection Engineering
CCM v4.1: LOG · TVM
Microsoft Sentinel architecture, log-source onboarding, and analytics rules mapped to MITRE ATT&CK, tuned so your SOC gets signal instead of noise.
Discuss thisSOC Integration & Incident Readiness
CCM v4.1: SEF · BCR
We don’t run a SOC. We get you ready for yours: escalation paths, runbooks, playbooks, and forensic-ready evidence handling for your in-house SOC, MSSP, or MDR.
Discuss thisCloud Security Architecture
CCM v4.1: CEK · DSP · IVS
HIPAA-aligned Azure environments built in Terraform, with customer-managed keys, encryption, and endpoint protection designed in from the start.
Discuss thisReadiness & Gap Assessment
CCM v4.1: A&A · GRC
We confirm you’re operationally ready, then map your environment to CCM v4.1, HIPAA, and NIST SP 800-53, with a prioritized gap list and audit-ready evidence.
Discuss thisShared Responsibility & Supply Chain
CCM v4.1: STA
A documented split of who owns what across you, your cloud provider, your SOC, and your vendors, based on CSA’s Shared Security Responsibility Model.
Discuss thisBuilt to Plug Into Your SOC
AuthFoundry is here to assist with verifying and improving your SOC. We engineer and document the identity, logging, and response foundations your SOC or MDR provider depends on, so they can see, triage, and act from day one.
AuthFoundry
Design & build
- Log sources onboarded, normalized, and retained to policy
- Identity alerts and detections mapped to MITRE ATT&CK
- Escalation matrix, runbooks, and playbooks
- Detection tests that confirm alerts actually fire
- Handoff documentation and an analyst walkthrough
Your SOC or MDR
Watch & respond
- 24/7 monitoring and alert triage
- Containment and incident response
- Threat hunting and tuning feedback
- Incident reporting to your team
Your Organization
Own & decide
- Risk acceptance and policy approval
- Access approvals and break-glass ownership
- Evidence retention for auditors
- Contract terms and SLAs with your SOC provider
Where we work in CCM v4.1
LOG
Logging & Monitoring
Centralized, time-synced logs with defined retention, integrity protection, and sanitization that keeps sensitive data out of the SIEM.
SEF
Incident Management & Forensics
An incident response plan, escalation contacts, and evidence-preservation steps your SOC can follow at 2 a.m.
IAM
Identity & Access
Risky sign-ins, privileged-role activations, and break-glass use routed to the SOC, with least-privilege access for the analysts themselves.
TVM
Threat & Vulnerability
Threat models and ATT&CK-mapped detection coverage, with gaps prioritized by risk.
STA
Shared Responsibility
A responsibility matrix between you, your cloud provider, your SOC, and AuthFoundry.
Don’t have a SOC yet? We can help you define requirements and evaluate the best SOC or MDR providers for your environment.
Mapped to All 17 CCM v4.1 Domains
CCM v4.1 contains 207 controls across 17 domains. Domains marked Core are where we design and build. The rest are covered in our readiness and gap assessments.
Why AuthFoundry?
Practical security engineering that meets you where your cloud is.
Readiness First
Frameworks only work once the basics are in place. We check ownership, asset inventory, joiner-mover-leaver processes, and your ability to produce evidence before mapping you to CCM or Zero Trust.
SOC-Ready by Design
Every log source, alert, and runbook we deliver is documented for handoff, so your SOC or MDR provider isn’t left reverse-engineering our work.
Zero Trust Identity
Every person, workload, and AI agent gets its own verifiable identity, so every action in your environment can be traced to who, or what, performed it.
About AuthFoundry
Founded in 2023, AuthFoundry is an independent identity and cloud security consultancy based in Phoenix, Arizona. We started from a simple observation: cloud adoption was outpacing the identity and logging foundations needed to secure it.
We design Entra ID security baselines, Microsoft Sentinel architectures, and HIPAA-aligned Azure environments in Terraform. Each one is mapped to CSA CCM v4.1, HIPAA, and NIST SP 800-53, and documented so your auditors and your SOC can use it from day one.
Our founder holds the CSA CCSK and CCZT and the ISC2 CC certifications.
soc-handoff — example
Get in Touch
Tell us about your environment and how your SOC or MDR provider works today. We reply within one business day.