> **For AI agents:** The documentation index is at [https://docs.digitalocean.com/llms.txt](https://docs.digitalocean.com/llms.txt). Markdown versions of pages use the same URL with `index.html.md` in place of the HTML page (for example, append `index.html.md` to the directory path instead of opening the HTML document).

# Workloads and Billing

Cloud Security Posture Management (CSPM) evaluates your DigitalOcean resources for misconfigurations and security risks, surfaces findings by severity, and provides guidance to help you resolve them.

Cloud Security Posture Management (CSPM) evaluates your environment using standard rules and workload rules. Understanding how workloads are defined and billed helps you manage your plan and coverage.

## What Is a Workload

In CSPM, a workload is a supported resource that runs applications, stores active data, or represents compute or database infrastructure. CSPM supports the following workloads:

- Droplets
- Managed Database instances

Workloads are evaluated using workload rules, which provide deeper, resource-specific security analysis.

## Standard Resources vs. Workloads

CSPM evaluates two categories of resources. Standard resources include IAM configurations, Volumes, load balancers, firewalls, VPCs, and DigitalOcean Container Registry (DOCR) repositories. These are evaluated using standard rules and are included in all plans.

Workloads include Droplets and managed databases. These are evaluated using workload rules and are included only in paid plans.

## How Billing Works

CSPM uses a workload-based pricing model. Each supported workload with coverage enabled is billed individually on a monthly basis. Each Droplet counts as one workload, and each managed database cluster counts as one workload. Standard resources are not billed.

You must explicitly enable coverage for each workload you want CSPM to evaluate. Only workloads with coverage enabled are evaluated and billed. Workloads without coverage are not evaluated and are not billed.

For current details about CSPM pricing and what is included in each plan, see [CSPM Pricing](https://docs.digitalocean.com/products/cspm/details/pricing/index.html.md).

## Example

If your account contains 5 Droplets and 2 managed database clusters, and you enable coverage for 3 Droplets and 1 managed database, you are billed for 4 workloads. The remaining workloads are not evaluated and are not billed. Standard resources such as firewalls, VPCs, and IAM configurations are always included and are not counted toward workload billing.