The AWS Security Baseline for the 50-Seat SMB — What to Turn On First
AWS ships 200+ security features. For a 50-seat SMB, six of them cover 80% of your risk. Here's the order to enable them and what each one actually protects.
Most SMBs land in AWS because a developer spun up an account, a vendor required it, or the CFO liked the pricing model. Very few land there with a security baseline in mind. Then a year later the security discussion starts, and the conversation is either paralysis (“there are hundreds of services — where do we begin?”) or over-engineering (“let’s implement Landing Zone Accelerator”). Neither serves a 50-seat business.
This is the baseline I stand up in the first two weeks of an AWS-anchored fractional-CISO engagement. It is intentionally short. It solves for what an SMB auditor, cyber insurance carrier, or ransomware operator will actually hit.
The six controls, in order
| # | Control | AWS service | What it stops |
|---|---|---|---|
| 1 | Root account lockdown + MFA | IAM | Account takeover of the most powerful identity you own |
| 2 | Centralized identity via IAM Identity Center | IAM Identity Center + Entra ID/Okta | Long-lived IAM users, orphaned access keys, MFA fatigue |
| 3 | Guardrails via Control Tower or a slim OU structure | AWS Organizations | Rogue regions, disabled logging, public S3 buckets |
| 4 | Enable Security Hub with CIS/AWS Foundational Best Practices | Security Hub | Silent misconfiguration drift across services |
| 5 | GuardDuty across all regions | GuardDuty | Credential exfiltration, cryptomining, C2 traffic |
| 6 | Centralized CloudTrail + Config, immutable | CloudTrail + Config + S3 Object Lock | Attacker deleting their tracks; audit evidence gaps |
Enable them in that order. Each one closes a door before the next control assumes the door is closed.
Sprint 1 — Identity (days 1–4)
Root account. Move the root credentials to a hardware key you keep in a safe. Rotate the password on every use. Never generate access keys for root. Set up billing alerts and delegated billing so no one has an operational reason to touch it.
IAM Identity Center. Federate to whatever the business already uses — Entra ID, Okta, Google Workspace. Kill every long-lived IAM user in the account (except the emergency break-glass, which is documented and rotated). Assign permission sets by role, not by person: Billing, ReadOnlyAudit, NetworkAdmin, AppOwner. Ten to twelve permission sets covers a 50-seat SMB.
Sprint 2 — Guardrails (days 5–9)
Control Tower is the fastest path if you have 3+ accounts. Otherwise, a hand-rolled OU structure with SCPs (Service Control Policies) works: Production, Sandbox, Suspended. The three SCPs that pay for themselves immediately:
- Deny disabling of CloudTrail, GuardDuty, Config, Security Hub
- Deny use of unapproved regions (usually just
us-east-1+ one alternate) - Deny public S3 bucket ACLs and public snapshots
Two hours of SCP writing prevents most of the “someone accidentally exposed data” incidents I see in SMBs.
Sprint 3 — Detection (days 10–12)
Security Hub with the CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices standards enabled. For an SMB, don’t try to remediate every finding — instead, set a monthly cadence to review new critical/high findings and either fix or accept with documentation.
GuardDuty across every region you don’t SCP-block. The false-positive rate is low; the signal on credential misuse is high. Send findings to Security Hub for one pane.
Sprint 4 — Evidence (days 13–14)
CloudTrail organization-wide, delivering to an S3 bucket in a dedicated Log Archive account with Object Lock enabled. Retention: minimum 400 days for cyber-insurance purposes; 7 years if you touch PHI or PCI data.
AWS Config enabled with the recording of all resource types. This is what your auditor will use to prove “the control was on when we said it was on.”
What you have not done — on purpose
- WAF, Shield Advanced, Network Firewall, Macie — necessary when scale or data classification demands them, not on day one for a 50-seat SMB.
- Fine-grained SCP libraries — start with the three SCPs above; expand only when a specific incident or audit finding drives the addition.
- CIEM tools — Security Hub and IAM Access Analyzer cover the 80% for this size company.
When you graduate from this baseline
The signals that it’s time to layer more:
- You touch PHI, CJIS, or FedRAMP-adjacent data → add Macie, KMS with strict CMKs, and a formal data classification
- You cross 200 employees or 5+ accounts → add Landing Zone Accelerator and dedicated network and identity accounts
- You have a public-facing web application → add WAF and Shield Advanced
Until then, the six-control baseline gets you through your first NYDFS, HIPAA, or SOC 2 review and cuts your cyber insurance renewal questions in half.