SaaS security posture management (SSPM) is the practice of continuously checking the configuration of your software-as-a-service applications against a secure baseline. It looks at sign-in rules, admin roles, sharing settings and connected third-party apps. You can start without buying anything, using public baselines and a short review routine.
Why is SaaS configuration a security problem?
The provider secures the platform. You configure the tenant. Default settings favor convenience, and admins change them for good reasons that outlive the reason. CISA says it established its Secure Cloud Business Applications (SCuBA) project in 2022 to address cybersecurity and visibility gaps exposed by SaaS intrusions and compromises. Its guidance aims to protect information that organizations create, access, share or store in cloud environments.
What do the SCuBA baselines actually cover?
SCuBA provides tailored guidance and secure configuration baselines for Microsoft 365 and Google Workspace. CISA has also released two no-cost assessment tools: ScubaGear for Microsoft 365 tenants and ScubaGoggles for Google Workspace. They evaluate your current tenant controls against the baselines and produce reports that show where posture can improve. CISA says all organizations, not only federal agencies, can use them.
That gives a concrete picture of the job: compare what is set against what should be set, and produce a list of differences. Commercial tools in this category do the same comparison across more applications and on a schedule, and some add alerting. We describe the category here and do not offer such a product ourselves.
What should a review check?
Group the checks by the question each one answers.
Who can get in: is multi-factor authentication required for everyone, are legacy authentication methods off, and are conditional access rules in place for admins?
Who holds power: how many global administrators exist, are admin accounts separate from daily accounts, and are there dormant privileged users?
What leaves: can users share files with anyone through public links, are external forwarding rules allowed, and is data export logged?
What is connected: which third-party applications hold OAuth grants, with which scopes, and who approved them?
What is recorded: is audit logging on, how long is it kept, and does it reach your central log store?
What does drift look like in practice?
Constructed example: during a migration, an administrator turns off a conditional access rule for one service account so a script runs. The rule stays off. A year later the account's password turns up in a leaked paste and has no second factor. A weekly baseline comparison would have flagged the changed rule within days, with the name of the admin who changed it.
Why not just trust the provider's defaults?
Defaults are written for the widest range of customers, so they lean toward easy onboarding. A tenant with a few hundred users, three acquisitions and two identity migrations rarely matches any default. The baseline gives you a written statement of what good looks like for your tenant, which turns a vague worry into a checklist someone can own. It also gives auditors and customers a concrete answer when they ask how SaaS settings are controlled, provided you keep dated evidence of each review.
Where does this meet the rest of your program?
SaaS posture work overlaps with identity management, data loss controls and third-party risk. It does not replace them. A clean configuration does not stop a phished user from approving a malicious app, so pair it with user training and a process for reviewing app grants.
How to check or apply this
- List every SaaS application with business data, an owner and an administrator.
- For Microsoft 365 or Google Workspace, read the matching SCuBA baseline and run its free assessment tool in a test run, reading the code or documentation first.
- For other applications, write a short baseline from the vendor's own security documentation.
- Fix identity first: multi-factor authentication, admin separation, legacy protocols.
- Review OAuth app grants and revoke the ones nobody can explain.
- Re-run checks on a schedule and record changes with the person who made them.
- Send SaaS audit logs to your central logging store.
Quick check
Is SSPM only for large companies?
No. The check itself is simple, and CISA's free SCuBA tools are available to any organization using Microsoft 365 or Google Workspace.
Does a good posture score mean the SaaS app is secure?
It means configuration matches the baseline. You still need strong identity practices, app grant reviews and monitoring of user behavior.
Sources
Last reviewed: 18 October 2026.
