The words, defined.

Cloud-native application protection platform: one product that checks cloud configuration, scans workloads and raises alerts across your cloud accounts.

In NxSCORE: NxSCORE works alongside the CNAPP you run, read-only: it reads what the CNAPP raises and checks what its enabled policies leave out.

Cloud security posture management: checking cloud configuration against a set of rules, account by account.

In NxSCORE: NxSCORE runs its own posture checks every day, beside your CNAPP’s, and counts a resource failing in both once.

One rule failing on one resource, such as a storage bucket open to the internet.

In NxSCORE: Each finding is kept by account and control, so your decisions about it survive a change of CNAPP.

Findings that share one cause, grouped so they can be fixed together.

In NxSCORE: A backlog of thousands of alerts usually sorts into a short list of issues.

A finding that was fixed and then failed again on the same resource.

In NxSCORE: NxSCORE counts it as back again, not as new, and the cause becomes a candidate for a guardrail.

The date a finding should be closed by, from its severity and the policy or regulation you follow.

In NxSCORE: Every open finding is overdue, due this week, on track or risk accepted. The defaults are 30, 60 and 90 days.

Evidence read from the account, before a fix, that shows whether the resource is in use.

In NxSCORE: On AWS, NxSCORE reads key use in the last 90 days, security group attachments, metadata calls and website hosting, and gives a verdict with the reason.

The commands, scripts or Terraform that make a change, with a check before it and a rollback after it.

In NxSCORE: NxSCORE writes the fix kit; your engineers run it. Access to your cloud stays read-only.

A preventive control in the cloud’s own policy layer that stops a mistake being made, rather than finding it afterwards.

In NxSCORE: NxSCORE proposes guardrails from the causes that keep returning, and tests each one before it goes in.

An AWS Organizations policy that sets the most any identity in an account may do, whatever its own permissions say.

An AWS Organizations policy that sets the most anyone may do to the resources in an account, including people outside it.

Testing a guardrail against what really happened in the account before it is applied.

In NxSCORE: NxSCORE checks a proposed SCP against 90 days of CloudTrail and shows what it would have blocked.

A planned change that stops a cause coming back, such as a guardrail.

In NxSCORE: A plan is agreed, then applied, then verified once 14 days pass without the problem returning.

Stating what must always be true of your cloud, and keeping it true with the cloud’s own controls.

In NxSCORE: NxSCORE works in five stages: understand, translate, predict, enforce safely, and govern and maintain.

A rule that the person who prepares a change or a piece of evidence is not the person who approves it.

In NxSCORE: Anything that changes a verdict, accepts evidence or signs a pack needs a second person.

A decision to accept a risk for a set time instead of fixing it now. Also called risk acceptance.

In NxSCORE: Anyone can ask; only your security team decides, with a reason and an expiry no more than 12 months away.

A different control that meets the aim of a requirement when the one it names is not used.

In NxSCORE: Recorded with its reason and reviewed by your analyst, such as SIEM alerting in place of CloudTrail metric filters.

One document or record that answers requirements in several frameworks at once.

In NxSCORE: An approved information security policy counts for ISO 27001 A.5.1, PCI DSS 12.1.1 and NIST CSF GV.PO-01.

The record an assessor works from: each requirement, how it is met and the evidence behind it.

In NxSCORE: Downloads as an Excel workbook. It is not a report on compliance; only your assessor or auditor issues that.

Permission to see configuration without being able to change it.

In NxSCORE: All NxSCORE asks of your cloud. Every permission is listed, cloud by cloud.

The second version of the EC2 instance metadata service, which needs a session token and so resists request-forgery attacks that version 1 does not.

In NxSCORE: NxSCORE looks for metadata calls made without a token over 14 days before suggesting the switch.

A resource that no longer matches the template or baseline it was built from.