Data Security Posture Management (DSPM)

Overview

Data Security Posture Management (DSPM) is the continuous discovery, classification, risk assessment, and protection of sensitive data across cloud, analytics, storage, software, and data-service environments. The control exists to discover and reduce security exposure across cloud services, configurations, identities, data, access paths, and externally reachable resources. It differs from CSPM because the primary focus is the data, its copies, access paths, and exposure rather than cloud configuration generally. It should be interpreted alongside Data Loss Prevention (DLP) because the concepts can affect the same decision without representing the same control, event, or risk.

The workflow collects data through cloud APIs, logs, network observation, repositories, and service integrations, then normalizes resources and assigns ownership. Findings should be prioritized by sensitivity, privilege, reachability, exploitability, business criticality, and compensating controls rather than severity labels alone. In this context, effective use requires data ownership, lineage, identity context, permission analysis, encryption status, residency, retention, duplicate and shadow-data discovery, prioritized remediation, and verification that sensitive exposure is reduced.

It should connect the term to Cloud Security Posture Management (CSPM) where that relationship changes access, transaction treatment, investigation, communication, or recovery.

Records should retain resource identifiers, account and region, configuration, identities, data classification, exposure path, detector version, first and last seen dates, owner, exception, remediation, and verification. Coverage gaps and unsupported services should remain visible.

Useful measures include environment coverage, unknown assets, public exposure, excessive privilege, sensitive-data findings, remediation time, drift, recurring misconfiguration, exception age, and verified risk reduction.

The relationship with Data Subject Access Request (DSAR) should be documented where it affects residual risk or control ownership.