Cloud Security Audit Morocco 2026: Cost and CNDP Checklist

A cloud security audit for a Moroccan SME costs between 15,000 and 120,000 MAD excluding VAT depending on scope, and most companies that migrated in the last three years have never had one. The migration ended, the monthly invoices arrive, everything works. Nobody went back to check who has access to what, whether backups actually restore, or which country customer data physically sits in.

The question usually comes from outside. A large customer sends a forty-page security questionnaire. A principal slips a compliance clause into the framework contract. Or an incident (a compromised account, an exposed file, ransomware at a supplier) pushes the topic onto the management committee’s agenda.

This article gives you 2026 price ranges, what an audit really covers, the gaps found in almost every SME, what Law 09-08 says about hosted data, and what you can check yourself before paying anyone.

Why cloud security stays a blind spot once the migration is over

A migration project ends when the applications run. That is the acceptance criterion, that is what the provider invoices, that is what management expects. Security, meanwhile, was configured so the project could move forward: broad rights granted to the migration team, network rules opened “temporarily” for testing, a shared admin account in a spreadsheet. Six months later, all of it is still there.

The second blind spot is the shared responsibility model. The cloud provider, whether a hyperscaler or a Moroccan host, secures its data centres, physical network and core services. Everything above that (configuration, accounts, encryption, backups, patching of virtual servers, application code) remains your job. Many executives believe they “outsourced security” by migrating. They outsourced the building, not the locks.

If you budgeted your project with our guide to cloud migration cost and timeline in Morocco, you will have noticed that the “post-migration hardening” line is listed separately. That is the line an audit verifies.

What a cloud security audit actually covers

A cloud security audit is not an automated scan emailed to you. It is a structured review, by someone who understands your platform, of how your infrastructure is configured, administered and monitored, measured against a recognised baseline (the provider’s CIS Benchmarks, ISO 27001, the CSA matrix) and against your contractual and legal obligations.

The usual scope breaks down into six blocks:

• Identity and access: who owns the root account, who is an administrator, MFA coverage, accounts belonging to former staff or contractors, API keys in circulation, over-broad roles.
• Service configuration: publicly exposed storage, encryption at rest and in transit, system versions, settings left at default.
• Network: ports open to the internet, segmentation between production and test, remote access (VPN, bastion, direct RDP or SSH).
• Backups and recovery: frequency, retention, isolation from production, and above all a real restore test.
• Logging and detection: are logs enabled, retained, and does anyone look at them?
• Compliance and contracts: data location, hosting contract clauses, sub-processors, consistency with your CNDP filings.

A penetration test (external, application-level or both) can be added, but it is a separate service with its own price. The expected deliverable is a report ranked by severity, with evidence (screenshots, configuration exports) and a prioritised remediation plan, plus a verbal debrief to management in non-technical language.

Cloud security audit Morocco: 2026 price ranges

The prices below are orders of magnitude observed on the Moroccan market in 2026, excluding VAT, for an SME of 20 to 250 people. An international firm or a Europe-based team will typically charge double.

• Posture review (3 to 5 days): 15,000 to 40,000 MAD. One cloud account or subscription, review of access, configuration and backups, summary report. Enough to answer a customer questionnaire or get an honest first picture.
• Full audit (8 to 15 days): 40,000 to 90,000 MAD. All six blocks above, interviews with the IT team and the provider, contract review, data mapping, detailed remediation plan.
• Full audit with penetration test: 80,000 to 150,000 MAD. Adds an external pentest and, often, an application test on your main platform. This is the format banks, insurers and large industrial groups ask of their suppliers.

The daily rate of a cloud security consultant in Morocco sits between 3,500 and 8,000 MAD depending on experience and certifications. What moves the invoice: the number of accounts or subscriptions, the number of managed services in use (three virtual machines do not audit like forty cloud-native services), whether a pentest is included, and how formal the report must be if a third party will read it.

Two costs are almost always forgotten. Remediation is not included: budget anything from a few internal days to 20–50% of the audit price if you hand it to a provider. And an audit only has value if it is repeated: an annual review, complemented by automated configuration scans (often free or bundled at hyperscalers) or by managed monitoring at 3,000 to 15,000 MAD per month.

The most common SME gaps: access, backups, default configuration

Audits of Moroccan SMEs bring back the same findings almost every time. Knowing them lets you judge whether your situation is ordinary or worrying.

Access

The root account is tied to the email address of a former contractor or an employee who left. MFA is enabled on some accounts, never on service accounts. Admin credentials are shared between several people. API keys sit in code, configuration files or WhatsApp conversations. The freelance developer who delivered the website in 2023 is still an administrator.

Backups

They exist, but nobody has ever tried to restore a full server. They are stored in the same account and the same region as production: a ransomware attack or an admin mistake encrypts or deletes them at the same time. Retention is seven days, while a compromise often takes weeks to detect.

Default configuration

An SSH or RDP port open to the whole internet “for troubleshooting”. A storage bucket set to public because an export had to be shared once. Encryption disabled on a database because the box was not ticked by default. Audit logs switched off to save a few dozen dirhams a month. None of these gaps is sophisticated. That is precisely why they get exploited.

CNDP and cloud hosting: what Law 09-08 says about sensitive data and transfers

As soon as your cloud hosts data about customers, employees or prospects, you are a data controller under Law 09-08, and your host is a processor. Three points bear directly on the audit.

First, location. Hosting in a region outside Morocco is a transfer of data abroad, which the law regulates and, with some exceptions, subjects to CNDP authorisation. Many SMEs picked a European region by reflex, without asking the question. The audit must produce a clear map: which data, in which service, in which country, including backups and replicas.

Second, security. The law requires the controller to take appropriate technical and organisational measures to protect the data. It does not list specific measures: a dated audit report, with a remediation plan that is actually tracked, is the most concrete way to show you did what was required.

Third, contracts. Your hosting contract must set out the host’s obligations on security, confidentiality and incident notification. A hyperscaler’s standard terms cover these points in a standardised way; a local host’s terms do not always. So-called sensitive data (health, biometrics, opinions and so on) falls under a stricter prior-authorisation regime. Thresholds and procedures change: check the CNDP website before committing, and use our CNDP Law 09-08 compliance checklist for the organisational side, which a cloud audit does not cover.

If you supply a public body or a critical infrastructure operator, Law 05-20 on cybersecurity and the requirements of the DGSSI may also apply down your subcontracting chain. Ask your principal exactly what they expect.

Sovereign cloud or hyperscaler: how it changes the audit scope and cost

The platform choice changes the nature of the audit more than its price. At a hyperscaler (AWS, Azure, Google Cloud, Oracle), the surface to audit is wide: dozens of services, each with its own settings. In return, native security-score tools, published CIS baselines and the provider’s certification reports reduce the auditor’s workload. The “provider” part of the audit often boils down to reading existing attestations.

At a Moroccan host or on a sovereign offer (inwi, local data-centre operators, Moroccan regions announced by some hyperscalers), the infrastructure looks more like classic virtual machines. The audit resembles a traditional infrastructure audit: systems, network, backups. But the auditor must spend more time on the provider itself, because public reports are scarcer: actual certifications, contractual commitments, incident procedures, physical security.

The most expensive case is hybrid: part at a hyperscaler, part at a local host, a legacy server in a cupboard in Casablanca. Each environment has its own baseline, and the links between them are often the weak point. If that choice is still ahead of you, our comparison of sovereign cloud offers in Morocco details what each option implies for data location and compliance.

What you can check yourself before paying for an audit

Two hours with your IT lead or your provider, access to the admin console, and you will already have an honest diagnosis. Run these checks in order:

1. The root account. Which email address is it tied to? Who knows the password? Is MFA enabled? If the answer involves someone who no longer works with you, stop here: this is your priority.
2. The administrator list. Export every user and role. Each name must match a current employee with a real need. Remove the rest.
3. MFA everywhere. Confirm it is enforced, not merely available, for every human account.
4. Public storage. Every console has a “public access” filter. The list should be empty or justified line by line.
5. Open ports. Look for network rules allowing “0.0.0.0/0” or “Any” to admin ports (22, 3389, 3306, 1433, 5432).
6. A real restore. Restore a backup to a test server and time it. If nobody knows how, you do not have backups, you have hope.
7. The region. Note the country of every resource, backups included. Compare it with what you declared to the CNDP.
8. The native security score. Hyperscalers display a free score and a list of recommendations. Read it before the auditor does: it stops you paying for obvious findings.

What this self-check does not replace: analysis of how services interact, contract review, penetration testing, and above all the outside view that a customer or an auditor will demand.

How to choose the right provider and read their audit report

A good provider starts by writing the scope with you: which accounts, which environments, which baseline, which exclusions, which deliverable and for which reader. They work with read-only access, which they ask you to revoke at the end. They cite a source (CIS baseline, provider guidance, legal requirement) for every finding. They separate what is critical from what is cosmetic, and they tell you what can wait.

A few signals that should worry you:

• The audit is free and ends with a quote to migrate to the platform the provider resells.
• The report is the raw export of a scanning tool, with no prioritisation or explanation.
• Findings have no evidence: no screenshot, no resource identifier, no date.
• The person auditing is the one who did the migration, with no outside review. Not a deal-breaker in a small firm, but ask at least for another team member to review.
• The provider refuses to give a verbal debrief to management.

When reading the report, focus on three questions: which findings would an attacker exploit first, which findings would a customer or the CNDP notice first, and what does remediating each one cost. If the answers are not obvious, the report is not finished.

Finally, if the audit shows the problem goes beyond the cloud (processes, business tools, data), widening the exercise is often better value. Our article on digital transformation audit cost in Morocco describes that broader format and what it costs.

What now?

Arrowlancer supports Moroccan SMEs across the whole cloud and infrastructure chain: migration, sovereign or hyperscaler hosting, and hardening of what is already running, with a report your management and your customers can both read. You will find the details of our cloud and infrastructure services on the site.

If you need to answer a customer questionnaire, meet a compliance clause or simply know where you stand, write to us through the contact form: we scope the audit with you and send a quote within a few days.