CSPM (cloud security posture management) is the continuous checking of the configuration of cloud accounts and resources, to find misconfigurations (settings that are wrong or unsafe) and flag them for fixing. Under the cloud shared responsibility model, this configuration is the customer's job. This article explains how CSPM and cloud security posture checking work, which benchmarks they check against, and where their limits are.

What a misconfiguration is

A misconfiguration is a setting that leaves a cloud resource too open or under-protected. The provider supplies the platform, but the customer sets it up. These examples come from the CIS AWS Foundations Benchmark (CIS is the Center for Internet Security, which publishes secure configuration guidance) checks listed in AWS Security Hub documentation:

  • Publicly reachable storage: S3 block public access (AWS file storage) is not enabled
  • Wide-open administration ports: a security group (a traffic filter for virtual machines) allows traffic from anywhere (0.0.0.0/0) to administration ports such as 22 and 3389
  • Unprotected top-level account: the root user (the highest-privilege identity of an AWS account) has no MFA, or has an access key
  • No activity logging: CloudTrail (the AWS account activity log service) is not enabled
  • Unencrypted disks by default: EBS default encryption is not enabled

Our own observation, not from the cited sources: such settings are easy to get wrong because the cloud creates resources quickly across many accounts and regions, so a tool is needed instead of opening each item by hand. The NSA's (the US National Security Agency) shared responsibility sheet (per secondary summaries; we could not read the full document) also names misconfiguration and missing controls as significant cloud risks.

What CSPM does

Providers and vendors build CSPM differently. We do not cite a single official definition from any body, so this summary is drawn from the documentation of Microsoft Defender for Cloud and AWS Security Hub CSPM, which agree on these five core jobs:

  • Build an asset inventory: find which accounts, machines, databases and storage exist
  • Check against benchmarks: compare settings with standards such as a CIS Benchmark
  • Raise recommendations: say which resources fail and how to fix them
  • Prioritize risk: point out which issues to fix first
  • Help remediate and hand off: route issues to owners, or fix some automatically
INFOGRAPHIC
The five jobs of a CSPM
1
Build inventory
know what exists
2
Check benchmarks
for example a CIS Benchmark
3
Raise recommendations
failed items and fixes
4
Prioritize risk
what to fix first
5
Remediate and hand off
to owners, or automatic fix

Capabilities differ by product and plan. For example, Microsoft's documentation separates Foundational CSPM (no cost) from Defender CSPM (paid), with attack path analysis (seeing how an attacker could chain several weaknesses to reach an important resource) and risk prioritization in the paid plan (per the documentation we read on 27 October 2026). Compare capabilities before choosing.

The benchmarks used as the yardstick

A CSPM needs a yardstick for what counts as a good setting. CIS describes its CIS Benchmarks as vendor-neutral configuration guides produced by expert consensus, and each comes with two profile levels. Level 1 is a base recommendation that can be implemented fairly promptly. Level 2 is defense in depth for environments where security is paramount, and CIS warns that it can cause problems if applied carelessly.

Commonly used benchmarks include:

  • CIS Foundations Benchmarks for each cloud: the CIS page we read lists AWS Foundations 7.1.0, Azure Foundations 6.0.0 and Google Cloud Platform Foundation 5.0.0 as current, and also covers Oracle and Alibaba Cloud
  • CSA Cloud Controls Matrix (CCM): the CSA's cloud security control framework; version 4.1 has 197 control objectives in 17 domains, defines roles for providers and customers, and maps to standards such as ISO, NIST and PCI
  • The provider's own benchmark: for example the Microsoft Cloud Security Benchmark that Defender for Cloud checks against

Do not assume a tool checks every item. AWS Security Hub CSPM documentation says it does not support every CIS requirement in every version, and many can only be evaluated by manual review. It supports CIS AWS Foundations Benchmark versions 5.0.0, 3.0.0, 1.4.0 and 1.2.0, which are older than the 7.1.0 shown on the CIS page, so check which benchmark version your tool supports.

Scope and limits of CSPM

  • It checks configuration, not attackers in action: a CSPM tells you the door is open, not that someone has walked in (our own observation). Watching for incidents needs activity logs and a separate detection layer
  • It covers only what the benchmarks and the tool support: all-green results do not mean everything is safe, because some items need manual checks
  • It does not replace owners: the tool raises issues, but the customer decides and fixes, since configuration is the customer's share

CSPM is not the only cloud tool. How it compares with workload and platform protection is covered in CNAPP vs CSPM vs CWPP, collecting logs for detection is in Cloud Logging: What to Log for Detection, and the same benchmark idea for computers is in Endpoint Hardening and CIS Benchmarks.

The misconfiguration fix cycle

When a CSPM finds a problem, run a clear cycle like this:

  • Find: the tool reports resources that fail a benchmark
  • Prioritize: order by severity, for example publicly reachable storage before minor items
  • Assign an owner: name who must fix it and by when
  • Recheck: confirm the fix, and record exceptions with a review date
INFOGRAPHIC
The misconfiguration fix cycle
01
Find
tool reports failures
02
Prioritize
order by severity
03
Assign owner
name person and date
04
Recheck
confirm the fix

Common mistakes

  • Believing that installing a CSPM makes you safe: the tool flags issues; it does not fix everything
  • Switching it on with no owner for the findings: reports pile up with nobody fixing
  • Connecting only some accounts: unconnected parts are never checked
  • Treating a green result as proof of safety: some benchmark items need manual checks
  • Fixing everything at once with no prioritization: the workload overwhelms and serious issues are missed
  • Not checking which benchmark version the tool uses: it may check against an older version than the latest CIS release
INFOGRAPHIC
Mistakes versus better practice

Mistake

  • Switching on with no owner
  • Connecting only some accounts
  • Treating green as safe

Better practice

  • Every account has an owner and review
  • Complete the account list first
  • Know which items need manual checks

Start today

  • List every cloud account and project: a CSPM can only check what is connected
  • See whether your accounts already have a built-in posture feature: for example AWS Security Hub CSPM or Foundational CSPM in Microsoft Defender for Cloud, and check terms and costs before enabling
  • Read the CIS Benchmark for the cloud you use: start with the Level 1 profile
  • Fix the high-risk items first: publicly reachable storage, administration ports open to the whole internet, and admin accounts without MFA
  • Assign owners and a review cycle: every account has someone who receives the findings

To see how well your organization's cloud controls cover the ground, try the self-assessment.

References and further reading