Sprawl occurs when you lose control of the amount of content on your image store.
Unnecessary images may be created and run. Each additional image running is another potential point of compromise for an attacker.

A baseline is an agreed-upon description of the attributes of a product. at a point in time that serves as a basis for defining change.

Although very closely related with audits-which are a key mechanism to support assure. and demonstrate compliance-there is more to compliance than audits and more to audits than using them to assure regulatory compliance.
Reference: CSA Security Guidelines V.4 (reproduced here for the educational purpose)

Encryption of Data would have minimised the impact of the incident and it would have prevented data being used for scam calls.

The CSA STAR Certification is a rigorous third-party independent assessment of the security of a cloud service provider. The technology-neutral certification leverages the requirements of the ISO/IEC
27001:2013 management system standard together with the CSA Cloud Controls Matrix.