Cloud Security Posture Management (CSPM)

CSPM tooling automates visibility, continuous monitoring, threat detection, and remediation workflows to find misconfigurations across cloud environments and infrastructure. CISA notes that the term developed relatively recently and is defined differently by various entities, with definitions similar enough to overlap but distinct enough to leave some ambiguity about its meaning.

CISA's Cloud Security Technical Reference Architecture ties CSPM to seven outcomes: governance and compliance, standards and policies, privilege and identity access management, data protections, infrastructure and application protections, system health and resource monitoring, and incident response and recovery. The supporting capabilities are security and risk assessments, continuous monitoring and alerting, identity, credential, and access management (ICAM), DevSecOps integration, and security capabilities based on artificial intelligence and machine learning.

Organizations that move data and applications to the cloud give up physical access to those resources and change how they manage governance and compliance. Cloud deployments also grow more complex as they mature and often involve several vendors and tools. CISA describes CSPM as supporting continuous improvement of security posture, so that organizations can keep up with emerging threats, protect against misconfigurations, and reduce the risk of a security incident or data breach.