Data security posture management, or DSPM, is a market term for the work of finding where sensitive data lives across cloud and SaaS stores, classifying it, and checking who can reach it and whether it is protected. NIST CSF 2.0 does not use the term, but its data inventory and data protection outcomes describe the same work.
Is DSPM a standard?
No. The acronym does not appear in the NIST Cybersecurity Framework 2.0, and a search of the document confirms it. That matters when you buy or build: nobody can certify you as "DSPM compliant," and tools that carry the label differ in what they cover.
What exists are outcomes you can measure yourself, and CSF 2.0 states them clearly.
Which CSF outcomes cover it?
Under Identify, the asset management category includes ID.AM-07: inventories of data and corresponding metadata for designated data types are maintained. Under Protect, the data security category covers:
- PR.DS-01: confidentiality, integrity and availability of data at rest are protected.
- PR.DS-02: the same for data in transit.
- PR.DS-10: the same for data in use.
- PR.DS-11: backups of data are created, protected, maintained and tested.
Access sits next door in PR.AA-05: permissions are defined in policy, managed, enforced and reviewed, and reflect least privilege and separation of duties.
Read together, that is the loop: know what data you have, know who can reach it, protect it, and keep checking.
What does the loop find in practice?
Constructed example. A growth team exports a customer table to a CSV for analysis and drops it in a cloud storage bucket. Six months later the export is still there. The bucket's role allows read access to forty engineers and two partner accounts. Nobody would call that a breach, and nobody listed it either.
An inventory (ID.AM-07) would show a copy of customer data in a place nobody designated. An access review (PR.AA-05) would show the broad role. A protection check (PR.DS-01) would show whether the file is encrypted and whether the bucket is public. Three findings from one forgotten file.
What should a posture check look at?
- Where. Databases, object stores, data warehouses, SaaS exports, logs, backups, developer laptops and test environments. Test copies of production data are the usual surprise.
- What. Classification at a level people can act on: public, internal, confidential, regulated. Start small.
- Who. Human and non-human identities that can read or write.
- How exposed. Public links, cross-account sharing, missing encryption.
- How old. Data past its retention period is risk without value.
Why does ownership decide whether findings get fixed?
A scan that lists four hundred exposed objects is useless if nobody owns them. The practical unit is the data store with a named owner and a due date. When the growth team in the example learns it owns the bucket, the fix takes an afternoon: delete the export, narrow the role, add a retention rule. When ownership is vague, the same finding sits in a queue for a quarter.
How to check or apply this
- Name the data types that would hurt most if leaked, such as customer records, credentials and source code.
- List the places they are supposed to live. Then look for places they are not.
- Record an owner per data store. Without an owner, no one fixes findings.
- Review access on the stores that hold the most sensitive types, and shrink broad roles.
- Confirm encryption and backup settings, and test one restore.
- Set retention rules and delete what you do not need.
- Repeat on a schedule. Data sprawls as fast as teams ship.
If you evaluate a tool that calls itself DSPM, ask which stores it scans, how it classifies, whether it reads data or only metadata, and where scan results are kept. Those answers matter more than the label.
Quick check
Is DSPM the same as data loss prevention?
Usually not. Vendors use both terms loosely, but DSPM typically focuses on finding data and assessing its exposure at rest, mostly in cloud stores. Data loss prevention typically focuses on blocking data from leaving through channels like email or endpoints.
Do I need a tool to start?
No. A spreadsheet of data stores, owners and access lists covers the first pass. A tool helps once the number of stores grows beyond what people can track.
Sources
Last reviewed: 18 October 2026.
