Frameworks, Coverage & FAQ
Compliance frameworks supported by Sec1 CSPM, what gets scanned, reporting and exports, and frequently asked questions on data handling, read-only assurance, and scan cadence.
A concise reference to what Sec1 CSPM covers, the compliance frameworks it maps to, how reporting works, and answers to common evaluation questions.
Supported compliance frameworks
Sec1 CSPM ships with roughly a dozen frameworks out of the box and maps each finding to the relevant control IDs:
CIS Benchmarks
CIS GCP, CIS Azure, and CIS Kubernetes Benchmarks
PCI DSS
Payment Card Industry Data Security Standard
ISO/IEC 27001
Information security management
SOC 2
Trust Services Criteria
NIST CSF
Cybersecurity Framework
NIST 800-53
Security and privacy controls
CSA CCM
Cloud Security Alliance Cloud Controls Matrix
FedRAMP
US federal cloud authorization baseline
CIS Controls
Prioritised safeguards
Findings are mapped to specific control IDs, scored per account and per resource, and tracked as point-in-time snapshots so you can see compliance trends over time.
What gets scanned
Asset inventory
Auto-discovery of resources across connected GCP, Azure, AWS, and Kubernetes accounts
Misconfiguration detection
Out-of-the-box rules for common misconfigurations, with severity, contextual remediation, suppression (with audit trail), and drift tracking
Identity risk
IAM / role and permission analysis, over-privilege, and identity exposure
Exposure analysis
Internet-facing and externally reachable resources
Attack path analysis
Chained risks from exposure to critical assets, with blast radius and optimal break points
Kubernetes
GKE and AKS — RBAC over-permission, privileged pods, exposed dashboards, network/pod security policy gaps, CIS Kubernetes Benchmark
Prioritisation
Risk-based scoring using exposure, asset criticality, and exploit/threat context
Reporting & exports
PDF reports — compliance and findings reports for auditors and stakeholders.
CSV exports — findings and inventory data for your own analysis or pipelines.
Jira ticketing — raise and track remediation tickets directly from findings.
Assignment & team-based access — assign findings to owners; connectors and findings are scoped per team.
AI-assisted remediation & Ask-AI — guided fixes and a natural-language assistant for investigating findings.
FAQ
Is Sec1 CSPM really read-only? Yes. Every credential Sec1 asks for grants read-only access. Sec1 inventories and evaluates your resources but never creates, modifies, or deletes them. Kubernetes Secret access is limited to metadata (names and types) — never secret values.
Is it agent-based or agentless? CSPM is fully agentless. It reads your cloud control plane (and optionally cluster state) through the read-only scanning identity. No agents are installed in your environment.
Which clouds are supported? GCP, Azure, AWS, and Kubernetes (GKE / AKS / EKS).
How often do scans run? On demand or on a schedule you configure per connector. Each scan is retained as a point-in-time snapshot for trend analysis.
Where is my data stored (SaaS vs hybrid)? In SaaS, resource configuration metadata and finding evidence are stored in your Sec1 tenant on the platform. In hybrid / on-prem, data stays within your boundary — only license validation and (optional) feed sync egress. See Prerequisites §5.
Can it work in an air-gapped environment? Yes, in a hybrid deployment. Posture scanning needs no internet; only threat-intel / CVE / framework enrichment feeds do, and those can be synced through your proxy or imported offline on a cadence.
Do I need to expose my private clusters or registries to the internet? No. Either authorise the scanner on the cluster's control-plane authorized networks (or use Connect Gateway on GKE), or run Sec1 in a hybrid deployment that reaches private control planes and registries over your internal network.
Can I limit which team sees a connector? Yes. Connectors and their findings are scoped to the team that owns them, with team-based access control.
Can I automate scans and pull findings programmatically? Yes, using a scoped, team-based Sec1 API token created in the console.
How do I start with the least access? Grant the minimum roles (for example, GCP roles/viewer + roles/iam.securityReviewer, or Azure Reader + Security Reader), run a scan, and expand to Kubernetes and more accounts later. See Required Permissions.
Related pages
Last updated