CISA Cloud Security Technical Reference Architecture v2.0 5.3b: Structure provider accounts in a hierarchy with central monitoring and separate development and test accounts

What does 5.3b require?

The agency uses multiple accounts or built-in hierarchy tools to separate entities and restrict access to assets per account, develops criteria for the account structure and for granting access, monitors all accounts from a single account using identity capabilities to audit activity, apply security rules and set expirations, understands that logs cannot move freely between commercial and government realms and that cross-account log delivery and on-premises connections cost money, and plans separate accounts for development and testing, replicating production through infrastructure as code so code can be tested before release.