Cloud Foundation & Security

Compliant cloud foundations.
Built in. Not bolted on.

ZAP deploys CIS-aligned landing zones with governance, networking, security controls and compliance monitoring built in from the first resource. Compliance is enforced before deployment — not discovered at audit.

Azure · AWS · GCP 215 Azure CIS controls IPAM-first Golden images Zero data egress
Book a session 30 min · No commitment
30m
Compliant LZ deployed
vs 6–12 months traditional
215
Azure CIS controls
Enforced from first deployment
Zero
IP conflicts — ever
IPAM-first architecture
3
Clouds governed
Azure · AWS · GCP
Capabilities

Everything you need to build
and secure your cloud foundation.

Compliant Landing Zones
CIS-aligned Hub & Spoke · 30 minutes

ZAP deploys CIS-compliant Hub & Spoke landing zones across Azure, AWS and GCP. IPAM-first design, mandatory governance tags, automated NSG/firewall rules, logging and monitoring configured from first resource. 30 minutes from request to live.

  • CIS Azure 2.0 — 215 controls enforced
  • CIS AWS 2.0 — 20 controls enforced
  • CIS GCP 1.3 — 25 controls enforced
  • Hub & Spoke topology default
  • Mandatory tagging enforced at creation
  • CMDB updated on deployment
ZAP IPAM
Zero IP conflicts · All clouds unified

ZAP IPAM scans every VNet, subnet and VLAN across all connected cloud accounts before assigning any CIDR range. Conflict-free addressing guaranteed on every deployment. One IP registry across Azure, AWS and GCP.

  • Full registry across Azure, AWS and GCP
  • Conflict-free CIDR on every deployment
  • Auto-suggested CIDRs per region
  • Historical allocation preserved
  • Cross-account subnet discovery
  • Cannot deploy with a conflicting IP range Blocked
ZAP Compliant Scan
7-point pre-flight · 5-gate pipeline

7 pre-flight checks before any IaC is generated — IaC module, SCM connection, IPAM registration, CIDR conflict, cloud permissions, region and state storage. Then 5 automated gates — format, secrets, SAST, compliance scan and plan. All must pass before Platform Lead review.

  • 7 pre-flight checks — all must pass
  • Gate 2: no credentials in Terraform code
  • Gate 3: SAST security analysis
  • Gate 4: CIS benchmark compliance scan
  • Gate 5: Terraform plan validation
  • Critical findings block the gate Blocked
Golden Images
CIS Level 2 hardened · CVE-scanned

CIS Level 2 hardened VM and container base images for all supported operating systems. Every image CVE-scanned with Trivy before publication. Platform Lead approval required to publish to registry.

  • Windows Server 2022 · 2019 · 2016
  • Ubuntu 22.04 LTS · 20.04 LTS
  • Red Hat Enterprise Linux 8 · 9
  • Amazon Linux 2023
  • Container base images — CIS Docker 1.6.0
  • Trivy CVE scanning — published only if clean
OIDC Zero Trust Connectivity
No standing credentials

ZAP configures OIDC federation for all cloud-to-cloud connectivity and developer access. No standing access credentials. Every connection identity-verified. No VPN dependency for governed operations.

  • Azure AD OIDC federation
  • AWS IAM OIDC federation
  • GCP Workload Identity federation
  • No stored cloud credentials in CI/CD
  • Short-lived tokens only
  • Access expires — cannot persist
Multi-Cloud Compliance Reporting
One dashboard · Three clouds · Always live

One compliance dashboard across Azure, AWS and GCP. Overall governance score. Framework scores for every monitored control. Finding trend. FinOps summary. Board-ready report generated from live data.

  • Single governance score — all clouds
  • Per-cloud and per-framework breakdown
  • Finding trend — week on week
  • FinOps spend and waste summary
  • Evidence pack generation — any framework
  • PDF export or API integration
The difference

Traditional cloud foundation
vs ZAP.

Without ZAP
6–12 months to deliver compliant foundation
SI engagement required — £500k–£2M
IP conflicts discovered at deployment
CIS compliance checked at audit — not at creation
No mandatory tagging — cost attribution impossible
Three clouds managed separately — no unified view
Manual golden image maintenance — no CVE scanning
Evidence assembled manually for each audit
With ZAP
30 minutes per landing zone — same day
Platform team self-service — no SI required
Zero IP conflicts — IPAM-first, every time
CIS controls enforced before deployment — blocked, not fixed
Mandatory tagging on every resource from day one
Azure + AWS + GCP — one dashboard, one score
CIS Level 2 golden images — Trivy-scanned before publish
Evidence pack in seconds — always current
Customer outcomes

What regulated enterprises achieve
with ZAP Cloud Foundation.

Microsoft Azure
Financial Services · Greenfield
Day 1
FCA-compliant foundation live

FCA PS21/3-compliant Azure foundation live on day one. DORA evidence ready before the first workload deployed. SI engagement avoided — estimated saving £600k.

Amazon AWS
Healthcare · Brownfield
6 weeks
400 findings remediated

400 findings across inherited AWS estate. All findings surfaced and remediated in 6 weeks. DSPT evidence pack available from week one. No migration — governance applied in place.

Google GCP
Government · Multi-cloud
One view
Three clouds, one score

Azure + AWS + GCP governed from one ZAP instance. One compliance score. One evidence pack. CE+ assessment passed. Crown Commercial contract renewed.

Frequently asked questions

Cloud Foundation & Security
questions answered.

Most tools scan after deployment and report findings. Compliant by design means ZAP enforces governance before infrastructure is created — non-compliant configurations are blocked in pre-flight validation and the 5-gate pipeline. The resource either meets CIS controls when it's created, or it isn't created at all.
Yes. ZAP deploys CIS-aligned landing zones across Azure (215 controls), AWS (20 controls) and GCP (25 controls) from a single platform. All three visible in one compliance dashboard.
Yes. ZAP Compliant Scan runs against any existing resource regardless of how it was deployed. ZAP AI generates remediation for findings. Brownfield estates are brought to compliance iteratively — no big bang migration required.
ZAP IPAM maintains a registry of every network across all connected cloud accounts. Conflict-free CIDR assigned automatically on every request. Zero IP conflicts from the first landing zone.
CIS Level 2 hardened images for Windows Server, Ubuntu, Red Hat, Amazon Linux and container base images. All CVE-scanned with Trivy before publication. Platform Lead approval required to publish.
No. ZAP governs whatever architecture you choose to deploy. Most regulated enterprises deploy Hub & Spoke (ZAP default for Azure). You can configure custom topologies. ZAP's governance layer works on top of your architecture.
Free · 30 minutes · No commitment

See a compliant landing zone
deploy in 30 minutes.

We show you ZAP live — IPAM, pipeline, compliance scan, PR approval and deployment.

Book a session
No commitment · 30 minutes · [email protected]