# What is Cloud Security Posture Management (CSPM)?

> Cloud security posture management (CSPM) is an industry category for continuously discovering cloud resources and assessing their configuration against security policies, architecture rules, and compliance requirements.

- Canonical URL: https://yellowcube.eu/glossary/cloud-security-posture-management/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

CSPM usually reads control-plane data through cloud-provider APIs, builds an inventory, and identifies conditions such as publicly reachable storage, disabled logging, overly broad network access, weak encryption settings, or drift from an approved baseline.

The word “posture” matters: CSPM primarily evaluates how cloud infrastructure and managed services are configured and interrelated. A mature process adds ownership, risk context, exceptions, and verified remediation instead of treating every failed check as equally urgent. Tools may also graph possible attack paths or include entitlement analysis, but those additions are not consistent enough to redefine the category.

### Key points

- **Discover and normalize:** Inventory accounts, subscriptions, projects, regions, services, resources, tags, and important relationships across the supported environment.
- **Evaluate continuously:** Compare observed settings with organizational policy, provider guidance, and selected control frameworks; detect new resources and configuration drift.
- **Prioritize and assign:** Add exposure, data sensitivity, exploitability, identity reach, and business ownership so teams can act on the findings that matter most.
- **Remediate safely:** Provide instructions or controlled automation, record exceptions, test changes, and confirm that a correction persists.
- **Important limitation:** CSPM visibility is bounded by API permissions, supported services, scan timing, and policy quality. A passing configuration check does not establish that application code or activity inside a workload is secure.

### Related terms

[Cloud security](<https://yellowcube.eu/glossary/cloud-security/>) · [Cloud-native application protection platform (CNAPP)](<https://yellowcube.eu/glossary/cloud-native-application-protection-platform/>) · [Cloud workload protection platform (CWPP)](<https://yellowcube.eu/glossary/cloud-workload-protection-platform/>) · [Cloud infrastructure entitlement management (CIEM)](<https://yellowcube.eu/glossary/cloud-infrastructure-entitlement-management/>)

### Sources

[CISA Cloud Security Technical Reference Architecture](https://www.cisa.gov/sites/default/files/publications/Cloud%20Security%20Technical%20Reference%20Architecture.pdf) · [CSA Cloud Controls Matrix v4.1](https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4-1) · [NIST SP 800-210: General Access Control Guidance for Cloud Systems](https://csrc.nist.gov/pubs/sp/800/210/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.