KCSA — Compliance & Security Frameworks
Compliance & Security Frameworks
The Compliance and Security Frameworks domain accounts for 10% of the KCSA exam. This domain tests your knowledge of industry standards, benchmarks, audit processes, and regulatory requirements that apply to Kubernetes environments.
Security without compliance is incomplete — organizations must prove their security posture meets recognized standards, not just claim it.
What You Will Learn
This chapter covers the five core areas of compliance and security frameworks that the KCSA exam expects you to understand.
| # | Topic | Description |
|---|---|---|
| 1 | CIS Kubernetes Benchmark | Security configuration standards, kube-bench |
| 2 | NIST & Industry Standards | NIST SP 800-190, 800-53, ISO 27001 overview |
| 3 | Kubernetes Security Audit | Internal audit process, tools, reporting |
| 4 | Compliance Automation | Policy-as-code, continuous compliance, drift detection |
| 5 | Regulatory & Data Protection | GDPR, HIPAA, PCI DSS, SOC 2 in Kubernetes context |
After completing all five sub-topics, test yourself with the Practice Questions.
Why This Domain Matters
Running a secure Kubernetes cluster is necessary but not sufficient. Organizations operating in regulated industries — finance, healthcare, government, e-commerce — must demonstrate that their clusters meet specific security standards.
Compliance and security frameworks provide:
- Baselines — minimum security configurations every cluster should meet (CIS Benchmarks)
- Controls — structured security requirements mapped to organizational risk (NIST, ISO 27001)
- Audit processes — systematic methods to verify that controls are in place and effective
- Automation — tools and practices that make compliance continuous, not periodic
- Regulatory alignment — mapping Kubernetes capabilities to legal requirements (GDPR, HIPAA, PCI DSS)
The KCSA exam asks conceptual questions about these areas — you need to know what each framework covers, why it matters, and how Kubernetes features map to compliance requirements.
Prerequisites
Before starting this chapter, ensure you have completed:
- Chapter 1 — Introduction (KCSA exam structure and domains)
- Chapter 2 — Cloud Native Security (4Cs, security principles)
- Chapter 3 — Cluster Component Security (API server, etcd, kubelet)
- Chapter 4 — Authentication & Authorization (RBAC, service accounts)
- Chapter 5 — Pod & Network Security (Pod Security Standards, Network Policies)
- Chapter 6 — Threat Modeling (STRIDE, attack vectors)
- Chapter 7 — Platform Security (node hardening, admission controllers, image assurance)
Compliance frameworks build on top of the technical controls covered in earlier chapters. Understanding those controls first makes this chapter significantly easier.
Exam Tips for This Domain
- Know which framework does what — don’t confuse CIS Benchmarks (configuration baselines) with NIST 800-190 (container security guidance) or GDPR (data protection law)
- Understand tool categories — kube-bench checks CIS compliance, kube-hunter does penetration testing, OPA/Gatekeeper enforces policy
- Focus on concepts — the KCSA does not ask you to run tools, but you must know what each tool does and when to use it
- Know the difference between scored and not-scored — CIS Benchmarks have both types of recommendations
