Cloud security posture management (CSPM) continuously checks the configuration of your cloud infrastructure, such as accounts, networks and storage. SaaS security posture management (SSPM) applies the same idea to the settings inside software-as-a-service applications such as email and file sharing. The difference is which layer you configure.
What does CSPM mean?
CISA's Cloud Security Technical Reference Architecture says the term is relatively new and defined differently by various parties. For its own document, it defines CSPM as a continuous process of monitoring a cloud environment by identifying, alerting on and mitigating cloud vulnerabilities, reducing risk and improving cloud security.
It lists outcomes that CSPM capabilities should support: governance and compliance, standards and policies, privilege and identity access management, data protections, infrastructure and application protections, system health and resource monitoring, and incident response and recovery. The capabilities include security and risk assessments, continuous monitoring and alerting, identity, credential and access management, DevSecOps integration, and AI- and ML-based security capabilities.
Notice that the definition describes a process, not a product. You can do posture management with scripts and reviews, though tools make it continuous.
Where does the split between CSPM and SSPM come from?
The same architecture explains it through service models. In infrastructure as a service, much of the responsibility falls on the customer: networks, identities, storage permissions, machine images. In SaaS, the provider carries most of the responsibility and the customer trusts the provider more. But the customer still controls the tenant settings: who can share files outside the company, which sign-in methods are allowed, which third-party apps can connect.
That is the gap SSPM is aimed at. This article could not fetch a standards body definition of SSPM, so it uses the term in this plain sense and does not treat it as a formally defined category. The need behind it is documented, though. CISA started its Secure Cloud Business Applications (SCuBA) project in 2022 to address cybersecurity and visibility gaps exposed by intrusions and compromises involving SaaS. It publishes secure configuration baselines for Microsoft 365 and Google Workspace, and free assessment tools that compare a tenant's controls against those baselines and produce reports.
How do they compare?
| Question | CSPM | SSPM |
|---|---|---|
| What does it watch? | Cloud accounts, networks, storage, compute, identity roles | Settings inside SaaS tenants |
| Typical finding | A storage bucket open to the public | External file sharing allowed for everyone |
| Who fixes it? | Cloud or platform team | IT or business application owner |
| Baseline source | Provider guidance, cloud security benchmarks | Provider guidance, CISA SCuBA style baselines |
A constructed example
A company runs a customer portal on an infrastructure cloud and uses a SaaS suite for email and documents. The platform team gets a CSPM alert that a storage bucket for log exports is public, and fixes it in an hour. Meanwhile the SaaS suite lets any employee share any document with anyone by link, and legacy sign-in methods are allowed for a group of old accounts. No cloud infrastructure alert covers either problem, because they are tenant settings in the application. The company needed both views.
When do you need which?
- If most of your assets are virtual machines, containers and databases in your own cloud accounts, start with CSPM.
- If most of your sensitive data lives in SaaS tools you do not run, tenant-level configuration review matters as much.
- A small company can use the free provider baselines and manual quarterly reviews before buying a tool.
- Neither replaces identity protection, monitoring or incident response.
How to check or apply this
- List your cloud accounts and your ten most important SaaS applications, with an owner for each.
- For each, find the vendor's security baseline or a public one, such as CISA's for the two suites it covers.
- Export current settings and compare them to the baseline. Record gaps with an owner and a date.
- Decide cadence: continuous for infrastructure, at least monthly for SaaS tenants.
- Route findings to whoever can change the setting, not only to the security team.
- Review admin roles and third-party app connections in each SaaS tenant every quarter.
Quick check
Is SSPM a replacement for CSPM?
No. They cover different layers. CSPM looks at cloud infrastructure configuration, and SSPM at configuration inside SaaS applications. Many organizations need both views.
Do SaaS providers handle all configuration security?
No. CISA's architecture notes that responsibility under SaaS relies heavily on the provider, but the customer still owns tenant settings and must understand the split.
Sources
- CISA, Cloud Security Technical Reference Architecture
- CISA, Secure Cloud Business Applications (SCuBA) Project
Last reviewed: 18 October 2026.
