Most frameworks expect endpoint antivirus or equivalent malware protection on company devices. Built-in options often meet the baseline requirement.

SOC 2 does not require a VPN. Many teams are moving from traditional VPNs toward Zero Trust networking. Review Zero Trust and see whether it fits your environment before you invest in a classic VPN.

Cloudflare resources on VPN and Zero Trust:

If you still want a VPN and you run on AWS, most teams set it up in AWS itself. See AWS Getting started with Client VPN.

For intrusion detection (IDS) and intrusion prevention (IPS), start with the native option from your cloud provider. If that does not fit, check third-party tools in your provider marketplace.

If you are serverless and fully in AWS, we recommend Amazon GuardDuty.

Use Azure Firewall for alerts and to block traffic to and from malicious IP addresses and domains sourced from the Microsoft Threat Intelligence feed.

When payload inspection is required, use Azure Firewall Premium IDPS, or pick a third-party IDS/IPS from the Azure Marketplace with payload inspection.

You can also use a host-based IDS/IPS or endpoint detection and response (EDR) solution alongside or instead of network-based tools.

Cloud IDS provides cloud-native network threat detection for GCP.

Scan systems that handle customer data on a regular cadence. Track findings in line with your change management policy, and remediate critical and high issues promptly.

For building an external scanning program (scope, cadence, evidence), see External Vulnerability Scanning.

External scans target internet-facing systems such as web apps, APIs, websites, email servers, and firewalls. They help you find weaknesses an outside attacker could reach.

Browse open source and commercial scanners in the OWASP Vulnerability Scanning Tools list. For dynamic application security testing (DAST) options, see Open-source DAST or SAST tools.

Internal scans look for issues inside your network, including risks from insider access or malware that already got past the perimeter. They often cover servers, workstations, and other connected devices, and can also cover product code.

Cloud providers offer native options such as Amazon Inspector (AWS), Microsoft Defender (Azure), and Web Security Scanner (GCP). Other tools teams use include SonarCloud, Snyk, Acunetix, Burp Suite, and ZAP.

Also scan in-scope production code. Common starting points by platform:

Use both external and internal scanning so you cover threats from outside the network and issues already inside it.