← Cloud projects

Cloud · Architecture Concept

Cloud Security Posture Management (CSPM)

Turn cloud posture management into a continuous operating process that prioritizes meaningful exposure, routes remediation to owners, and prevents repeat configuration drift.

PlatformCloud
DomainSecurity
LevelIntermediate
Last reviewed2026-09-19
Use whenCreate a continuous cloud-security posture process rather than relying on one-time hardening reviews.
Key decisionPrioritize exposure, not raw finding count
Key conceptsAsset inventory · Security standards · Posture assessment
Cost focusPaid posture-management plans
PathSecurity Architecture Path · 2/7
On this page

Building blocks

Asset inventorySecurity standardsPosture assessmentRisk prioritizationPolicy guardrailsRemediation workflow

Design goal

Move beyond one-time hardening reviews by continuously identifying, prioritizing, assigning, and reducing cloud configuration risk across governed scopes.

Success criteria

  • Inventory cloud resources and scope
  • Evaluate configuration against security standards
  • Prioritize findings by exposure and business context
  • Drive remediation and reduce configuration drift

Architecture

Aggregate cloud inventory and posture findings, normalize them against organizational standards, prioritize material exposures, route remediation to owners, and use policy to prevent repeat issues.

Architecture flow

  • Cloud estate
  • Posture assessment
  • Risk context
  • Prioritized findings
  • Remediation owners
  • Policy feedback loop
Cloud EstatePosture AssessmentRisk ContextRemediationPolicy Feedback
Cloud Estate
Posture Assessment
Risk Context
Remediation
Policy Feedback

Architecture decisions

Decision

Prioritize exposure, not raw finding count

Why

A posture program should distinguish exploitable or business-critical exposure from low-impact configuration noise so remediation capacity goes to the highest-value work.

Trade-off

Risk-based prioritization focuses teams on material issues, but depends on accurate asset context and can be distorted by weak business classification.

Decision

Central policy with delegated ownership

Why

Security teams can centralize standards and reporting while workload owners remain responsible for remediation in the services they operate.

Trade-off

Central standards improve consistency, but remediation speed still depends on workload teams accepting and acting on findings.

Security

Protect the control and data paths deliberately. CSPM is itself part of the security control plane; protect delegated administration, finding access, exception processes, and automation credentials with least privilege.

Cost drivers

  • Paid posture-management plans
  • Number and type of protected resources
  • Log and finding retention
  • Automation and ticketing integrations
  • Security operations staffing

Design assumptions

  • Cloud resources can be inventoried across the intended organizational scope
  • There is an accountable remediation owner for each workload or platform domain

Implementation plan

  1. Define the governed cloud scopes, security standards, asset criticality, and control owners before enabling posture checks.
  2. Connect the intended accounts, subscriptions, and projects and verify the CSPM platform can see the resources and configuration data it is expected to assess.
  3. Tune priorities using exposure, exploitability, business criticality, and compensating controls rather than raw finding count.
  4. Create time-bound exception and remediation workflows that route findings to accountable workload owners.
  5. Use preventive policy for recurring high-risk misconfigurations where safe, then track aging, recurrence, and risk reduction over time.

Validate the design

  • Confirm every intended cloud scope is connected and new resources appear within the expected discovery interval.
  • Compare sample findings with actual resource configuration to verify the posture signal is accurate.
  • Create and expire a test exception and confirm ownership, approval, and expiry controls work.
  • Measure finding age, recurrence, and remediation rate so the program demonstrates risk reduction rather than finding volume.

Architecture basis

Continue a learning path

Learning path · Step 2 of 7Security Architecture PathView path →
Previous · Security Architecture Path← Zero Trust Architecture PrinciplesNext · Security Architecture PathSecure Azure App Service PaaS Architecture →

Related architectures

Azureadvanced

Azure Arc + Defender for Restricted-Network Servers

Extend Azure governance and Defender controls to restricted-network servers through controlled outbound connectivity instead of unrestricted internet access.

SecurityOpen guide →
Cloudfoundation

Zero Trust Architecture Principles

Design access around explicit verification, least privilege, segmentation, strong identity, context, and continuous telemetry instead of trusting network location.

SecurityOpen guide →
Azureadvanced

Microsoft Sentinel SOC Architecture

Build a Microsoft Sentinel operating model that ingests high-value telemetry, turns detections into incidents, automates repeatable response, and controls retention cost.

SecurityOpen guide →
AWSadvanced

AWS Centralized Security Operations

Centralize security visibility across AWS accounts without collapsing workload isolation, using delegated administration, protected audit data, and organization-wide findings.

SecurityOpen guide →