I85PREP
⌘ K
KCSA study materials
KCSA study resources

KCSA: Compliance and Security Frameworks

KCSA · Work through your exam, one topic at a time.

All guide sections

Compliance and Security Frameworks

Compliance and Security Frameworks tests whether you can map Kubernetes controls to recognised standards and produce evidence, not just configure things.

Frameworks to recognise

  • CIS Kubernetes Benchmark - prescriptive controls for control plane, nodes and policies; kube-bench runs the checks and reports pass/fail per control ID and level.
  • NIST SP 800-190 - application container security guidance; its risk categories (image, registry, orchestrator, container, host OS) make a usable checklist.
  • NIST Cybersecurity Framework - identify, protect, detect, respond, recover; organises controls by function.
  • OWASP Kubernetes Top 10 - misconfigurations, supply chain, secrets, RBAC, network, workload isolation.
  • NSA/CISA Kubernetes Hardening Guide - concrete pod, network and authentication recommendations.
  • Regulatory and assurance - PCI DSS, HIPAA, GDPR, SOC 2, ISO/IEC 27001 impose obligations (data residency, access logging, retention) that Kubernetes controls must satisfy, not replace.

Evidence and auditability

Enable API server audit logging with a policy recording at least Metadata and Request for sensitive resources, and ship logs off-cluster so a compromised cluster cannot erase them. Use policy as code (Gatekeeper, Kyverno) so a control is both enforced and reportable, and retain scan results, SBOMs and CIS reports as dated artifacts. Review RBAC and cloud IAM bindings periodically to demonstrate least privilege.

Worked example

An auditor asks how you prove pods cannot run privileged. Evidence chain: namespaces carry pod-security.kubernetes.io/enforce: restricted; a Gatekeeper constraint denies privileged pods cluster-wide; audit logs show rejected creations with the requesting identity; kube-bench output covers the node-level controls. That is a control, an enforcement point and an audit trail - three things auditors assess separately.

Traps

Treating compliance as equivalent to security; citing a framework version you have not checked; forgetting audit logs must be enabled, scoped and exported; assuming CIS level 1 and level 2 are interchangeable.