An AI meeting-intelligence SaaS company

the customer was preparing for a third-party security audit, but its AWS foundation was not ready. It ran a 13-account AWS Organization on a Control Tower landing zone (v4.0) that had become tainted — the landing zone had at one point been deleted, leaving accounts in an inconsistent governance state. A hands-on assessment (2026-03-02) surfaced gaps across the org: incomplete org-wide security monitoring, CloudTrail logging gaps, drifted account enrollments, and inconsistent guardrails. the customer needed a partner to remediate and rebuild its governance baseline so it could pass a governance and compliance audit cleanly and lay a foundation for later SOC 2 / PCI-DSS / HIPAA work.

A Phase 1 Control Tower Audit-Readiness engagement across three workstreams, preceded by a Well-Architected Review. (1) Security and compliance remediation — enabled AWS Security Hub organization-wide against AWS Foundational Security Best Practices (FSBP) and CIS, remediated CloudTrail logging coverage, reconciled IAM Identity Center, and hardened guardrails and Service Control Policies (SCPs) across the Organization. (2) Infrastructure validation and governance — cleaned up the Organizational Unit structure, validated all 13 member-account enrollments in Control Tower, verified AWS Config recording in every member account, deployed organization-wide AWS Backup policies, and checked StackSet drift; where the existing landing zone was too compromised to repair in place, accounts were migrated onto a fresh, untainted management root and Control Tower was rebuilt. (3) Compliance documentation and knowledge transfer — architecture diagrams, a compliance control mapping, an access-governance matrix, a Security Hub posture baseline, and a knowledge-transfer session.