Vol III Book 04 — Federal Compliance — Cloud-Native Security Posture & Containers
CSPM, CNAPP, and Kubernetes — Closing the Misconfiguration, Exposure, and Runtime Gaps Host Scanning Misses
0.1 Draft Proposal — Subject to Review
This document is a draft proposal developed by the CSI Team (Cloud Services Infrastructure). It is an attempt at a comprehensive Agency-wide technical roadmap and has not been reviewed or approved by the Agency CIO Office, the Office of Information Security (OIS), or organizational leadership. All recommendations, vendor selections, control mappings, and implementation timelines are subject to revision pending formal review by the Agency CIO Office and organizational components.
Date Code: 2026-07-09 08:41 ET
Provisional position. This book was drafted at temporary series slot 22; its intended home is Volume III (Security Operations), alongside the Vulnerability Management and Patch & Systems Management books. Cross-references name other books by title and role, not number.
Series Context — The Vulnerability Management book finds missing patches on hosts; the Patch & Systems Management book applies them (SI-2) across platforms. Neither sees the risks that live in the cloud control plane and the container layer: a world-readable storage bucket, an over-permissive IAM role, an internet-exposed workload, an unscanned container image, a privileged pod. This book closes those — cloud security posture management (CSPM), cloud-native application protection (CNAPP), and Kubernetes security — and routes their findings into the evidence fabric like every other source.
1 What This Document Addresses
A host vulnerability scanner answers “what CVEs are on this VM.” It does not answer “is this storage bucket public,” “can this workload reach the internet,” “does this IAM role grant far more than it uses,” or “was this container image scanned before it ran.” Those are cloud-control-plane and container-layer questions, and on a multi-cloud estate (AWS GovCloud, Azure, GCP, OCI, VMware, plus Kubernetes — AKS/EKS/GKE/OKE/OpenShift) they are where a dominant class of cloud incidents begins: misconfiguration, excessive entitlement, and exposure — not an unpatched kernel.
This book closes that surface with three overlapping disciplines:
- CSPM — continuous detection of cloud resource misconfiguration against a secure baseline, across every CSP (CM-6).
- CNAPP — a unified platform spanning workload vulnerability (CWPP), network exposure / attack-path analysis, entitlements (CIEM), and shift-left IaC/code scanning.
- Kubernetes / container security — image scanning, admission control, hardening (CM-7), and runtime threat detection (SI-3).
2 CSPM — Misconfiguration Is the Cloud’s Dominant Risk (CM-6)
Misconfiguration is a configuration-settings control (CM-6) applied to cloud resources rather than OS baselines: storage exposure, network security-group rules, key/secret handling, logging gaps, IAM policy drift. CSPM detects it continuously across CSPs and emits a baseline_conformance verdict into the evidence fabric’s contract. This is the cloud-plane complement to the Patch & Systems Management book’s OS-level CM-6 — same control, different layer; both contribute.
2.1 The Moderate decision — owned-tool priority across the multi-cloud estate
Under the Microsoft-preference rule (a Microsoft product is the default when it coordinates the multi-vendor surface at FedRAMP Moderate — earned, not automatic), Microsoft Defender for Cloud remains the coordinating default: it does multi-cloud CSPM/CWPP ingestion across Azure, AWS, and GCP and is available within GCC at FedRAMP Moderate — a clean fit for the Moderate-only boundary. But where the agency already owns a platform-native mechanism, that owned tool is primary for its own platform’s posture evidence, and Defender for Cloud’s role there narrows to cross-account correlation rather than sole source:
| Platform | Primary mechanism | Owned today | FedRAMP status | Moderate-boundary treatment |
|---|---|---|---|---|
| Azure | Microsoft Defender for Cloud | Yes | FedRAMP Moderate (GCC) | Native Moderate — coordinating default |
| AWS | AWS Config (conformance packs) + AWS Security Hub | Yes | FedRAMP-authorized, above Moderate (AWS GovCloud Class D) | Exceeds Moderate, boundary treatment documented; owned, so primary for AWS rather than relying on Defender’s AWS ingestion |
| GCP | Google Assured Workloads (boundary/guardrail) + Security Command Center (posture) | No | Assured Workloads: native FedRAMP Moderate control package; Security Command Center: FedRAMP-authorized, above Moderate (Google Cloud’s High P-ATO) | Assured Workloads needs no flag — it is the Moderate control package; Security Command Center exceeds Moderate and needs the boundary treatment documented if adopted. Neither is procured today — Defender for Cloud’s native GCP ingestion is the only mechanism actually in place |
| OCI | OCI Cloud Guard (unified misconfiguration and threat detection across the OCI tenancy) | No | FedRAMP-authorized, above Moderate (DISA IL5 / JAB) | Exceeds Moderate, boundary treatment documented; residual-gap closer only — Defender’s native coverage does not extend to OCI/OKE |
| VMware | VMware Aria Operations for Compliance | Yes | Not a CSP offering — no independent FedRAMP authorization | Inherits the deploying system’s own ATO boundary, same as other customer-operated software in the estate |
GCP and OCI now carry the same named-mechanism depth as the owned platforms above even though neither is procured: Assured Workloads and Cloud Guard are each the specific adoption default for their platform — the tool this book recommends the day the agency actually stands up GCP or OCI — not a claim that either is in place today. Until then, Defender for Cloud’s native GCP ingestion covers GCP and Cloud Guard’s residual-gap role for OCI/OKE is aspirational rather than active, exactly as the “Owned today” column states.
The agency also prefers Palo Alto (Prisma Cloud) as a whole-platform CNAPP alternative to Defender, and Prisma Cloud is among the most feature-complete CNAPPs — but it is FedRAMP High-only, as is Wiz for Government. Under the Moderate-exclusive rule this is the identical flag as the AWS/GCP/OCI rows above: High exceeds Moderate, so either product may be used if the boundary treatment is documented, or Defender for Cloud is selected to stay natively at Moderate. This is an explicit procurement/boundary decision, recorded in the Product Inventory Questionnaire’s flag list.
3 CNAPP — One Platform, Four Overlapping Views
A cloud-native application protection platform unifies what were separate tools:
| CNAPP view | Question it answers | NIST control | This series |
|---|---|---|---|
| CSPM | Is the cloud resource misconfigured? | CM-6 | this book |
| CWPP | Is the workload/image vulnerable? | RA-5 | this book (assessment handoff to Patch for SI-2) |
| Network exposure / attack path | Can this workload be reached, and what can it reach? | SC-7 | this book (cloud-plane SC-7; edge SC-7 is the Network Enforcement book) |
| CIEM | Does this identity have far more access than it uses? | AC-6 | cross-ref Privileged Access Management book (cloud-entitlement layer) |
| Code / IaC (shift-left) | Is the misconfiguration or vuln present before deploy? | SA-11 | this book (SSDF, NIST SP 800-218) |
The attack-path view (SC-7) is the distinctive CNAPP capability: it composes misconfiguration + exposure + vulnerability + entitlement into “this internet-reachable workload has a critical vuln and an over-permissioned role to the data store” — a single prioritized finding no host scanner produces. It is a cloud-plane SC-7 closure, distinct from the customer-edge SC-7 the Network Enforcement Substrate book closes on gear.
4 Kubernetes & Container Security (CM-7, SI-3)
Containers add a layer host tools do not reach:
- Image scanning — vulnerabilities and secrets caught in the registry at build time (CWPP/RA-5), so remediation is a rebuild, not a host patch (this is the container path the Patch & Systems Management book explicitly defers here).
- Admission control (CM-7) — Kubernetes admission policy denies non- compliant workloads at deploy: no privileged pods, no unscanned images, no latest tags. Least functionality enforced at the gate.
- Runtime threat detection (SI-3) — behavioral detection in running containers (unexpected process, drift from image, lateral movement).
5 Feeding the Evidence Fabric
Every finding here — a CSPM misconfiguration verdict, a CWPP vulnerability, an attack-path alert, an admission denial — emits the unified evidence-record contract into the fabric, keyed to authoritative asset identity, and rolls up to CISA CDM and the FedRAMP 20x KSI pipeline (see the Multi-Cloud Evidence Fabric book). Posture is not a standalone dashboard; it is one more source in the one compliance picture.
7 FedRAMP 20x KSI Alignment
Cloud-native posture feeds KSI-CMT (Change Management — configuration-baseline misconfiguration verdicts), KSI-SVC (Service Configuration — hardening, admission control, IaC), and KSI-MLA (vulnerability + runtime findings). As with the rest of the series’ evidence, none is attestable by a single-tenant conformance scan alone — the evidence is the CNAPP’s cross-account, cross-cloud finding set delivered through the evidence fabric.
7.1 Platform Selection Status
Per-platform CSPM selection prioritizes what the agency already owns: AWS Config + Security Hub (AWS) and VMware Aria Operations for Compliance (VMware) are the primary posture mechanisms for their platforms today, ahead of routing that evidence through Defender for Cloud’s ingestion. Microsoft Defender for Cloud remains the coordinating default for Azure and GCP, natively at FedRAMP Moderate. Google Assured Workloads and Security Command Center (GCP) and OCI Cloud Guard (OCI) are documented as each platform’s adoption default — the specific mechanism to stand up the day GCP or OCI is actually procured — not a current-ownership claim; today Defender for Cloud covers GCP and OCI/OKE has no native posture mechanism in place. Where a mechanism (owned, preferred, or documented-default) is FedRAMP High rather than Moderate — AWS Config/Security Hub, Security Command Center, OCI Cloud Guard, and the agency-preferred Palo Alto Prisma Cloud / Wiz for Government — the High-covering-Moderate boundary treatment must be documented; this is not a disqualifier under the Moderate-exclusive rule. Verify all authorization claims on the FedRAMP Marketplace at procurement.
8 References
| Reference | Description |
|---|---|
| NIST SP 800-53 Rev 5 | CM-6, CM-7, SC-7, RA-5, SA-11, SI-3 |
| NIST SP 800-207 | Zero Trust Architecture (workload exposure) |
| NIST SP 800-218 | Secure Software Development Framework (shift-left) |
| CISA SCuBA | Secure Cloud Business Applications baselines — https://www.cisa.gov/scuba |
| CISA BOD 26-04 | Risk-based remediation; KEV listing is one of four variables. Known Exploited Vulnerabilities catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
| Microsoft Defender for Cloud (multi-cloud CSPM/CWPP) | https://learn.microsoft.com/azure/defender-for-cloud/ |
| AWS Config — NIST SP 800-53 Rev 5 conformance pack (AWS, owned) | https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_5.html |
| AWS Security Hub (AWS, owned, FedRAMP-authorized above Moderate in AWS GovCloud) | https://aws.amazon.com/about-aws/whats-new/2021/04/aws-security-hub-achieves-fedramp-high-authorization-to-enable-security-posture-management-for-high-impact-workloads/ |
| Google Assured Workloads (GCP, adoption default, native FedRAMP Moderate control package) | https://cloud.google.com/assured-workloads |
| Google Security Command Center (GCP, adoption default, FedRAMP-authorized above Moderate) | https://cloud.google.com/security-command-center |
| VMware Aria Operations for Compliance (VMware, owned; vSphere/NSX-T/vSAN STIG benchmark content) | https://techdocs.broadcom.com/us/en/vmware-cis/vcf/stig/9-0/vcf-stig-documentation/docs-tutorials-Aria-aria.html |
| Oracle Cloud Guard (OCI, adoption default, residual-gap closer, FedRAMP-authorized above Moderate / DISA IL5) | https://www.oracle.com/security/cloud-security/cloud-guard/ |
| Palo Alto Prisma Cloud (CNAPP, FedRAMP High) | https://www.paloaltonetworks.com/blog/prisma-cloud/fedramp-high-impact-ready/ |
| Wiz for Government (CNAPP, FedRAMP High) | https://www.wiz.io/blog/wiz-achieves-fedramp-high-authorization |