For the complete documentation index, see llms.txt. This page is also available as Markdown.

Frameworks, Coverage & FAQ

Compliance frameworks supported by Sec1 CSPM, what gets scanned, reporting and exports, and frequently asked questions on data handling, read-only assurance, and scan cadence.

A concise reference to what Sec1 CSPM covers, the compliance frameworks it maps to, how reporting works, and answers to common evaluation questions.


Supported compliance frameworks

Sec1 CSPM ships with roughly a dozen frameworks out of the box and maps each finding to the relevant control IDs:

Framework
Notes

CIS Benchmarks

CIS GCP, CIS Azure, and CIS Kubernetes Benchmarks

PCI DSS

Payment Card Industry Data Security Standard

ISO/IEC 27001

Information security management

SOC 2

Trust Services Criteria

NIST CSF

Cybersecurity Framework

NIST 800-53

Security and privacy controls

CSA CCM

Cloud Security Alliance Cloud Controls Matrix

FedRAMP

US federal cloud authorization baseline

CIS Controls

Prioritised safeguards

Findings are mapped to specific control IDs, scored per account and per resource, and tracked as point-in-time snapshots so you can see compliance trends over time.


What gets scanned

Area
Coverage

Asset inventory

Auto-discovery of resources across connected GCP, Azure, AWS, and Kubernetes accounts

Misconfiguration detection

Out-of-the-box rules for common misconfigurations, with severity, contextual remediation, suppression (with audit trail), and drift tracking

Identity risk

IAM / role and permission analysis, over-privilege, and identity exposure

Exposure analysis

Internet-facing and externally reachable resources

Attack path analysis

Chained risks from exposure to critical assets, with blast radius and optimal break points

Kubernetes

GKE and AKS — RBAC over-permission, privileged pods, exposed dashboards, network/pod security policy gaps, CIS Kubernetes Benchmark

Prioritisation

Risk-based scoring using exposure, asset criticality, and exploit/threat context


Reporting & exports

  • PDF reports — compliance and findings reports for auditors and stakeholders.

  • CSV exports — findings and inventory data for your own analysis or pipelines.

  • Jira ticketing — raise and track remediation tickets directly from findings.

  • Assignment & team-based access — assign findings to owners; connectors and findings are scoped per team.

  • AI-assisted remediation & Ask-AI — guided fixes and a natural-language assistant for investigating findings.


FAQ

Is Sec1 CSPM really read-only? Yes. Every credential Sec1 asks for grants read-only access. Sec1 inventories and evaluates your resources but never creates, modifies, or deletes them. Kubernetes Secret access is limited to metadata (names and types) — never secret values.

Is it agent-based or agentless? CSPM is fully agentless. It reads your cloud control plane (and optionally cluster state) through the read-only scanning identity. No agents are installed in your environment.

Which clouds are supported? GCP, Azure, AWS, and Kubernetes (GKE / AKS / EKS).

How often do scans run? On demand or on a schedule you configure per connector. Each scan is retained as a point-in-time snapshot for trend analysis.

Where is my data stored (SaaS vs hybrid)? In SaaS, resource configuration metadata and finding evidence are stored in your Sec1 tenant on the platform. In hybrid / on-prem, data stays within your boundary — only license validation and (optional) feed sync egress. See Prerequisites §5.

Can it work in an air-gapped environment? Yes, in a hybrid deployment. Posture scanning needs no internet; only threat-intel / CVE / framework enrichment feeds do, and those can be synced through your proxy or imported offline on a cadence.

Do I need to expose my private clusters or registries to the internet? No. Either authorise the scanner on the cluster's control-plane authorized networks (or use Connect Gateway on GKE), or run Sec1 in a hybrid deployment that reaches private control planes and registries over your internal network.

Can I limit which team sees a connector? Yes. Connectors and their findings are scoped to the team that owns them, with team-based access control.

Can I automate scans and pull findings programmatically? Yes, using a scoped, team-based Sec1 API token created in the console.

How do I start with the least access? Grant the minimum roles (for example, GCP roles/viewer + roles/iam.securityReviewer, or Azure Reader + Security Reader), run a scan, and expand to Kubernetes and more accounts later. See Required Permissions.


Last updated