As enterprises move workloads and sensitive data to the cloud, SaaS Security Posture Management (SSPM) is essential for evaluating SaaS security posture, identifying risks, and addressing issues related to permissions, access, and overall security.
Netskope SaaS Security Posture Management provides organizations with the tools to assess risk exposure, detect and remediate misconfigurations, enforce compliance standards, and protect against insider threats effectively.
Key Features in SSPM
Once your SaaS environment is configured for monitoring, SSPM offers several robust features that provide enhanced security and posture monitoring:
-
Security Posture Monitoring: Continuously tracks your SaaS environment to identify and alert on security posture risks, giving you clear visibility into potential risks that arise due to misconfigurations or risky 3rd Party Apps.
-
Guided Remediation: SSPM offers step-by-step guidance to help remediate posture issues. With actionable insights and recommendations, you can efficiently resolve identified risks, reducing the likelihood of exploitation.
-
Compliance Monitoring: Ensures that your SaaS environment remains compliant with industry-specific regulations. Continuous monitoring & reporting helps stay compliant with regulatory requirements and maintain a strong security posture.
Getting started with SSPM
2
- Create Policies to monitor security posture.
- Review posture summary and explore findings, including 3rd Party Apps.
- Analyze resource inventory.
Understanding the Scope
SSPM offers support for a broad range of SaaS Application and Compliance standards. Refer to the SSPM compatibility matrix to view the feature availability across supported apps.
| SaaS App | Documentation link |
|---|---|
| Atlassian Organization | Onboard Atlassian Organization |
| Atlassian Confluence | Onboard Atlassian Confluence Cloud |
| Atlassian Jira | Onboard Atlassian Jira Cloud |
| Box | Onboard Box |
| GitHub | Onboard GitHub |
| Google Workspace | Onboard Google Workspace |
| Microsoft Entra ID (formerly known as Azure AD) | Onboard Microsoft 365 |
| Microsoft Defender | Onboard Microsoft 365 |
| Microsoft Exchange | Onboard Microsoft 365 |
| Microsoft Intune | Onboard Microsoft 365 |
| Microsoft 365 Suite | Onboard Microsoft 365 |
| Microsoft 365 SharePoint | Onboard Microsoft 365 |
| Microsoft 365 Teams | Onboard Microsoft 365 |
| Microsoft Copilot (Gen AI) | Onboard Microsoft Copilot |
| Okta | Onboard Okta |
| Salesforce | Onboard Salesforce |
| ServiceNow | Onboard ServiceNow |
| Slack Enterprise | Onboard Slack Enterprise |
| Workday | Onboard Workday |
| Zoom | Onboard Zoom |
| Compliance Standard | Purpose |
|---|---|
| CIS Microsoft 365 Foundations Benchmark 5.0.0 CIS Microsoft 365 Foundations Benchmark 6.0.0 | Center for Internet Security (CIS) Benchmark, which provides security hardening guidelines for Microsoft 365 deployments to enhance security. |
| CIS GitHub Benchmark 1.1.0 | Center for Internet Security (CIS) Benchmark, which offers security hardening guidelines for GitHub deployments to harden GitHub environments and improve the security posture. |
| CIS Zoom Benchmark 1.1.0 | Center for Internet Security (CIS) Benchmark, which offers security hardening guidelines for Zoom deployments to improve security. |
| CISA M365 Secure Configuration Baseline for Teams 1.8 CISA M365 Secure Configuration Baseline for SharePoint and OneDrive 1.8 CISA M365 Secure Configuration Baseline for Exchange Online 1.8 CISA M365 Secure Configuration Baseline for EntraID 1.8 CISA M365 Secure Configuration Baseline for Defender 1.8 | CISA Secure Configuration Baselines (SCuBA) are United States Federal guidances to secure cloud business applications required for protecting federal information. |
| AICPA TSC 2017 | Accounting industry standard which evaluates and reports on controls for security, availability, processing integrity, confidentiality, and privacy in SOC2 audits. |
| APRA CPS 234 | Australian government standard to ensure entities are resilient against information security incidents and cyberattacks. |
| CSA CCM 4.0 | Cloud Security Alliance cybersecurity control framework for cloud computing aligned with their best practices, mainly for public cloud data security. |
| GDPR 2016 | European Union regulation on personal data processing and free movement of data. |
| HIPAA 1996 | U.S. government guidelines for data processing in healthcare and insurance settings. |
| ISO 27002:2022 | International standard providing guidance on establishing, implementing, and improving an Information Security Management System (ISMS). |
| NIST SP 800-53 | U.S. government catalog of security and privacy controls for protecting organizational assets and operations. |
| NIST CSF 1.1 | U.S. Government guidance on managing cybersecurity risks across various organizations. |
| PCI-DSS 4.0 | Payment card industry data protection standard for handling credit card and payment processing data. |