SaaS security posture management (SSPM) is the practice of checking the configuration of your SaaS tools, such as sharing settings, sign-in rules and connected apps, against a secure baseline, and flagging drift. It is about settings you control, not about the vendor's own infrastructure.
The problem it addresses
SaaS vendors run the servers. You still choose the settings: who can share files outside the company, whether multi-factor authentication is required, which apps are connected, and who is an administrator. Defaults are chosen for ease of onboarding and may not match your risk.
A baseline example
CISA's SCuBA project, launched in 2022, provides tailored cloud guidance and secure configuration baselines for Microsoft 365 and Google Workspace. CISA says the baselines offer recommendations that organisations can adapt to their own requirements and risk tolerance, and that they include automation to help federal agencies assess their M365 and Google Workspace services.
That is the shape of the idea: a written baseline, a way to compare, and a record of exceptions.
Typical settings that get checked
- Multi-factor authentication and legacy sign-in methods
- External sharing and public links
- Administrator roles and how many people hold them
- Third-party app access and consent
- Mail forwarding and auto-forward rules
- Logging and retention
- Guest and contractor accounts
What it does not do
SSPM checks configuration. It does not by itself find unknown apps, test the vendor's code, review contracts, or replace identity governance. Many organisations pair it with an app inventory and an access review.
Doing it by hand
For one or two critical platforms, you can start without a product:
- Pick a published baseline for the platform.
- Walk through each setting in the admin console and record the current value.
- Mark differences as accepted exceptions or fixes.
- Repeat quarterly, and after any admin change.
For a first pass on Microsoft 365 or Google Workspace, SCuBA is a reasonable baseline to read.
When tooling helps
When you have many platforms, frequent admin changes, or a need to show auditors continuous evidence, automated checks save time. Look for coverage of the platforms you actually use, clear mapping to a baseline, and exportable evidence.
A note on drift. Settings change when admins add exceptions for a project and forget to remove them. Even a clean baseline check decays, so record each exception with an owner and an end date, and review the list at every cycle. That habit matters more than any single setting.
Where Safeguard fits
Safeguard is not an SSPM product and does not claim to be. It offers compliance and evidence automation, policies and asset discovery for software and related controls.
Quick check
Is SSPM the same as CSPM?
No. CSPM checks cloud infrastructure accounts, such as storage and network rules. SSPM checks the settings inside SaaS applications.
Sources
Last reviewed: 19 October 2026.
