> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/11-cspm/4-frameworks-and-coverage.md).

# Frameworks, Coverage & FAQ

A concise reference to what Sec1 CSPM covers, the compliance frameworks it maps to, how reporting works, and answers to common evaluation questions.

***

## Supported compliance frameworks

Sec1 CSPM ships with roughly a dozen frameworks out of the box and maps each finding to the relevant control IDs:

| Framework          | Notes                                             |
| ------------------ | ------------------------------------------------- |
| **CIS Benchmarks** | CIS GCP, CIS Azure, and CIS Kubernetes Benchmarks |
| **PCI DSS**        | Payment Card Industry Data Security Standard      |
| **ISO/IEC 27001**  | Information security management                   |
| **SOC 2**          | Trust Services Criteria                           |
| **NIST CSF**       | Cybersecurity Framework                           |
| **NIST 800-53**    | Security and privacy controls                     |
| **CSA CCM**        | Cloud Security Alliance Cloud Controls Matrix     |
| **FedRAMP**        | US federal cloud authorization baseline           |
| **CIS Controls**   | Prioritised safeguards                            |

Findings are mapped to specific **control IDs**, scored **per account and per resource**, and tracked as point-in-time snapshots so you can see compliance **trends over time**.

***

## What gets scanned

| Area                           | Coverage                                                                                                                                     |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
| **Asset inventory**            | Auto-discovery of resources across connected GCP, Azure, AWS, and Kubernetes accounts                                                        |
| **Misconfiguration detection** | Out-of-the-box rules for common misconfigurations, with severity, contextual remediation, suppression (with audit trail), and drift tracking |
| **Identity risk**              | IAM / role and permission analysis, over-privilege, and identity exposure                                                                    |
| **Exposure analysis**          | Internet-facing and externally reachable resources                                                                                           |
| **Attack path analysis**       | Chained risks from exposure to critical assets, with blast radius and optimal break points                                                   |
| **Kubernetes**                 | GKE and AKS — RBAC over-permission, privileged pods, exposed dashboards, network/pod security policy gaps, CIS Kubernetes Benchmark          |
| **Prioritisation**             | Risk-based scoring using exposure, asset criticality, and exploit/threat context                                                             |

***

## Reporting & exports

* **PDF reports** — compliance and findings reports for auditors and stakeholders.
* **CSV exports** — findings and inventory data for your own analysis or pipelines.
* **Jira ticketing** — raise and track remediation tickets directly from findings.
* **Assignment & team-based access** — assign findings to owners; connectors and findings are scoped per team.
* **AI-assisted remediation & Ask-AI** — guided fixes and a natural-language assistant for investigating findings.

***

## FAQ

**Is Sec1 CSPM really read-only?** Yes. Every credential Sec1 asks for grants read-only access. Sec1 inventories and evaluates your resources but never creates, modifies, or deletes them. Kubernetes Secret access is limited to **metadata** (names and types) — never secret values.

**Is it agent-based or agentless?** CSPM is fully **agentless**. It reads your cloud control plane (and optionally cluster state) through the read-only scanning identity. No agents are installed in your environment.

**Which clouds are supported?** GCP, Azure, AWS, and Kubernetes (GKE / AKS / EKS).

**How often do scans run?** On demand or on a **schedule** you configure per connector. Each scan is retained as a point-in-time snapshot for trend analysis.

**Where is my data stored (SaaS vs hybrid)?** In **SaaS**, resource configuration metadata and finding evidence are stored in your Sec1 tenant on the platform. In **hybrid / on-prem**, data stays within your boundary — only license validation and (optional) feed sync egress. See [Prerequisites §5](/user-docs/11-cspm/1-prerequisites.md#5-saas-vs-hybrid--on-prem).

**Can it work in an air-gapped environment?** Yes, in a hybrid deployment. Posture scanning needs no internet; only threat-intel / CVE / framework enrichment feeds do, and those can be synced through your proxy or imported offline on a cadence.

**Do I need to expose my private clusters or registries to the internet?** No. Either authorise the scanner on the cluster's control-plane authorized networks (or use Connect Gateway on GKE), or run Sec1 in a hybrid deployment that reaches private control planes and registries over your internal network.

**Can I limit which team sees a connector?** Yes. Connectors and their findings are scoped to the **team** that owns them, with team-based access control.

**Can I automate scans and pull findings programmatically?** Yes, using a scoped, team-based **Sec1 API token** created in the console.

**How do I start with the least access?** Grant the minimum roles (for example, GCP `roles/viewer` + `roles/iam.securityReviewer`, or Azure `Reader` + `Security Reader`), run a scan, and expand to Kubernetes and more accounts later. See [Required Permissions](/user-docs/11-cspm/2-permissions.md).

***

## Related pages

* [CSPM Prerequisites](/user-docs/11-cspm/1-prerequisites.md)
* [Required Permissions](/user-docs/11-cspm/2-permissions.md)
* [Onboarding & Your First Scan](/user-docs/11-cspm/3-onboarding.md)