Cloud Security Posture Management (CSPM)

Overview

Cloud Security Posture Management (CSPM) is the continuous discovery and assessment of cloud resources, configurations, identities, policies, and control settings to identify and remediate security exposure. The control exists to discover and reduce security exposure across cloud services, configurations, identities, data, access paths, and externally reachable resources. It differs from CASB and DSPM because its primary unit is cloud infrastructure posture rather than user-to-service access or sensitive-data location. It should be interpreted alongside Cloud Access Security Broker (CASB) because the concepts can affect the same decision without representing the same control, event, or risk.

The workflow collects data through cloud APIs, logs, network observation, repositories, and service integrations, then normalizes resources and assigns ownership. Findings should be prioritized by sensitivity, privilege, reachability, exploitability, business criticality, and compensating controls rather than severity labels alone. In this context, a useful program normalizes multiple cloud environments, prioritizes exploitable and business-critical findings, assigns ownership, validates remediation, suppresses justified exceptions, and monitors configuration drift.

It should connect the term to Data Security Posture Management (DSPM) where that relationship changes access, transaction treatment, investigation, communication, or recovery.

Records should retain resource identifiers, account and region, configuration, identities, data classification, exposure path, detector version, first and last seen dates, owner, exception, remediation, and verification. Coverage gaps and unsupported services should remain visible.

Useful measures include environment coverage, unknown assets, public exposure, excessive privilege, sensitive-data findings, remediation time, drift, recurring misconfiguration, exception age, and verified risk reduction.

The relationship with External Attack Surface Management (EASM) should be documented where it affects residual risk or control ownership.

A production treatment of Cloud Security Posture Management (CSPM) should test Cloud Security Posture Management (CSPM) is the continuous discovery and assessment of cloud resources, configurations, identities, policies, and control settings to identify and remediate security exposure within the relevant asset, decision, or service state. The Cloud Security Posture lifecycle record for configurations, identities, and policies should preserve source data, configuration or policy version, responsible actor, exception, and outcome. Review of Cloud Security Posture Management (CSPM) should determine whether safeguards addressing configurations, identities, and policies changed exposure in practice, not merely whether a document or setting existed.