compliance
15 articles tagged with #compliance
The Difference Between Compliance Tools and True CSPM
Vanta, Drata, and Secureframe automate compliance evidence. CSPM finds actual security issues. Here's why you probably need both — and what each actually does.
EU NIS2: Engineering Leader's Guide to Cloud Compliance
NIS2 is the EU's updated cybersecurity directive. Here's what it means for engineering teams managing cloud infrastructure — technical requirements, deadlines, and how CSPM helps.
CIS Benchmarks: Prescriptive Security Configuration Standards
CIS Benchmarks are consensus-based security configuration guides for AWS, GCP, Azure, and Kubernetes used by CSPM tools to evaluate cloud security posture.
Compliance as Code: Automating Security and Regulatory Checks
Compliance as Code encodes regulatory and security requirements as automated checks that run in CI/CD pipelines and CSPM tools, replacing manual audits with continuous validation.
Data Residency: Keeping Cloud Data Within Geographic Boundaries
Data residency requires organizations to store and process data within specific geographic regions to comply with laws like GDPR, NIS2, and national sovereignty regulations.
Policy as Code: Programmatic Security and Compliance Enforcement
Policy as Code defines and enforces security and compliance policies programmatically using tools like OPA, Sentinel, and Kyverno, enabling shift-left prevention and runtime detection.
Shared Responsibility Model: Who Secures What in the Cloud
The shared responsibility model defines the security boundary between cloud providers (security OF the cloud) and customers (security IN the cloud) — and why CSPM exists in this gap.
What is Sovereign CSPM? Self-Hosted Cloud Security Explained
Sovereign CSPM runs on your infrastructure — scans execute from your VMs, results stay in your database, and no cloud inventory data leaves your network.
What is CSPM? Cloud Security Posture Management Explained
CSPM continuously monitors cloud infrastructure for misconfigurations, compliance violations, and security risks across AWS, GCP, Azure, and Kubernetes.
The Importance of Regular Audits: How to Spot Misconfigs Before They Become Threats
Learn how regular security audits can help identify and fix cloud misconfigurations before they become security threats. A comprehensive guide covering audit strategies, compliance requirements, and best practices for maintaining a secure cloud environment.
How to conduct assessment with aws-foundations-cis-baseline tool
This post covers the scan report assessment and interpret the results.
How to set up aws-foundations-cis-baseline tool for conducting CIS assessment
This post covers an introduction and instructions to set up the aws-foundations-cis-baseline tool for learning.
How to set up GCP CIS 1.2.0 Benchmark Inspec Profile tool for conducting CIS assessment
This post covers an introduction and instructions to set up the Inspec tool for learning.
Using Prowler for AWS assessment against CIS Foundations benchmark - Part 2 Conducting assessment
Prowler is an Open Source security tool used for AWS security best practices assessments, incident response, audits, continuous monitoring, hardening, and forensics readiness.
Using Prowler for AWS assessment against CIS Foundations benchmark - Part 1 Introduction and setup
Prowler is an Open Source security tool used for AWS security best practices assessments, incident response, audits, continuous monitoring, hardening, and forensics readiness. This post covers an introduction and instructions to set up the tool for learning.