> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/risk-management/monitor-and-manage-code-build/software-composition-analysis/license-compliance-in-sca.md).
# License Compliance in Software Composition Analysis (SCA)
Open source software licenses define the terms under which open source software can be used, modified, and distributed. Therefore, when selecting an open source package, it’s crucial to understand the types of licenses and the associated user restrictions to mitigate any potential compliance issues.
In Prisma Cloud, licenses are scanned as part of the Software Composition Analysis (SCA) vulnerability scan for open source packages. License restrictions for each package are determined either at the root package (direct dependent package) or at the sub-dependent package level.
By default, license policies are disabled. To enable them, refer to [Enable/Disable License Policies](#enable-disable-license) below.
## License Types
Prisma Cloud offers three types of default license policies out of the box, providing comprehensive coverage for managing license compliance within your environment. Within each license type, SPDX identifiers are organized and sorted based on their characteristics and attributes. This sorting method helps effectively categorize and identify software packages distributed under each specific license type, enabling precise management of license compliance.
* **Weak Copyleft Licenses** policies (**Medium** severity): Identifies software packages distributed under weak copyleft licenses. These licenses permit combining code with other licenses, including proprietary licenses, without mandating the entire derivative work to be released under the same copyleft license
* **Strong Copyleft Licenses** policies (**High** severity): Identifies software packages distributed under strong copyleft licenses, such as the GNU General Public License (GPL). These licenses require derivative works to be distributed under the same copyleft license terms as the original work. This ensures broader access and modification rights
* **Non Permissive Licenses** policies (**High** severity): Identifies software packages distributed under non-permissive or restrictive licenses. These licenses restrict how you can use, modify, and distribute the software. They might limit your ability to integrate the software into certain projects or require you to purchase a commercial license for specific uses
For more information on default license policies refer to [License Policies](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/policy-reference/license-policies/license-policies.md).
In addition, you can create custom license policies to suit your organization’s requirements. See [Create Custom License Policies](#custom-policies) below for more information.
## Permissions
For permissions required to view, create, modify policies, and more, refer to [Prisma Cloud Administrator Permissions](/content-collections/administration/prisma-cloud-admin-permissions.md).
## GRBAC for License Policy Permissions
GRBAC (Granular Role-Based Access Control) is used to manage permissions for License policies, as well as all Build policies. You can define the policy permissions as required for each Permission Group.
1. In **Application Security**, select **Settings** > **Access Control** in the left side-bar menu.
The **Permission Groups** tab is selected by default.
2. Create or edit a Permission Group according to requirements.
Refer to the [Create Custom Permission Groups](/content-collections/administration/create-custom-permission-groups.md) documentation for more information.
3. In the 'Assign Permissions' step of the 'Add Permission Group' wizard, select your required permissions in the **Policies** menu under the **Assign Permission** step > complete the Group Permission setup.
## View License Policies
Access the **Governance** page to review license policies. To narrow a search, select **Config** under **Policy Type** and **Build** under **Policy Subtype** filters. Apply additional filters from the **Add Filter** menu to further narrow your search.
To view custom license policies, select the **Custom** tab on the Governance page, and then use filters to narrow your search.
## Manage License Policies
You can edit, clone, view Alert rules, delete license policies and more to suit your organizations requirements.
1. Locate your License policies - see [View License Policies](#view-license-policies]) above.
2. Select the **edit** icon under the **Actions** column of a license policy, and edit the values that are displayed in the wizard.
For more information on custom policies, refer to [Create Custom License Policies](#custom-policies) below.
### Enable/Disable License Policies
Enable/disable individual license policies based on your organization’s specific needs to maintain flexibility in compliance management.
1. On the **Governance** page, select a policy > toggle the button under the **Status** column **ON/OFF** .
### Enforcement
Enforce license violations by severity and policy labels, ensuring developers are promptly notified during pull requests if they introduce a package with an unapproved license. For further details on Enforcement rules, refer to [Enforcement](/content-collections/application-security/risk-management/monitor-and-manage-code-build/enforcement.md).
## Create Custom License Policies
Create custom License policies to align compliance measures with your organization’s unique requirements.
1. On Prisma Cloud console, select **Governance** > **Add Policy** > **Config**.
The **Add Details** step of the 'Create New Config Policy' wizard is displayed.
2. Fill in the provided fields.
* **Policy Name** (Required): The name of the custom license policy
* **Description** (Optional): A description of the custom policy
* **Policy Subtype**: Select **Build** to enable scanning code repositories
* **Severity** (Required): The policy severity level. Values: 'Critical', 'High', 'Medium', 'Low', 'Informational'
* **Labels** (Optional): Assigning labels to your policies is an optional but highly recommended practice. Labels act like tags, allowing you to easily filter and find specific policies later. This can save you significant time when managing a large number of policies. You can choose from existing labels by clicking on the 'Labels' field or create a custom label by typing a value in this field.
3. Select **Next**.
The **Create Query** step of the wizard is displayed.
4. Create a query.
1. Select **License Policy** from the menu.
The **License Policy** fields are displayed.
2. Select a license/ multiple licenses from the menu in the **License Type** field (Required).
These licenses are the SDPX licenses supported by Prisma Cloud.
3. Click **Next**.
The **Compliance Standards** step of the wizard is displayed.
5. Configure a **Compliance** standard (Optional).
Compliance standards ensure your policies align with established security or industry regulations. Additionally, compliance standards serve as a filtering criterion, allowing you to easily filter your policies based on the assigned standard.
1. Select the required compliance **Standard**, **Requirement**, and **Section** values from their respective fields.
2. Click **(+)** to add additional standards as required.
3. Select **Next**.
The **Remediation** step of the wizard is displayed.
6. Provide steps to remediate the license violation (optional) > **Submit**.
The custom license is created and can be viewed on the **Governance** page.
## View and Remediate Non-Compliant License Findings
View and mitigate non-compliance license findings through the **Projects** page.
1. In **Application Security**, select **Home** > **Projects** > **Licenses** tab.
2. Use filters to locate and prioritize findings.
1. (Optional) To filter by **License type**: Select **Add Filter** > **License type** > Select a license policy type from the list, which includes both default and custom License policy types.
You can select multiple policy types.
3. Select a package from the list in the table containing a non-compliant license.
4. Select the **Details** and **Issues** tab in the sidecar that is displayed to view additional details about the license and non-compliance issues.
For more information on mitigating license policy issues, refer to [Monitor and Manage Code Build Issues](/content-collections/application-security/risk-management/monitor-and-manage-code-build/monitor-code-build-issues.md).
## Suppress License Violations
You can suppress license violations to exclude the license from the scope of future scans on a global scale. All license compliance issues associated with this package and version will no longer be considered in future scans across your entire environment.
1. On the **Projects** page, select a non-compliant license policy> click to open the sidecar.
2. Under the **Issues** tab, select **Suppress**.
3. Create a **Suppression** rule in the popup that is displayed > **Save**.
For more information on Suppression, refer to the [Suppress Code Issues](/content-collections/application-security/risk-management/monitor-and-manage-code-build/suppress-code-issues.md) documentation.
## License scans in Checkov CLI
License scans are supported in Checkov CLI.
Checkov License policies use the following YAML query syntax:
```yaml
metadata:
id: "POLICY ID"
name: "My policy name"
category: "license"
definition:
```
For more information on Checkov CLI License scans, refer to the [Checkov CLI](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html) documentation.
## License Scans in IDE Environments
License scans are supported in IDE environments. For more information on License scans through IDEs, refer to the [IDE](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/ides/ides.md) documentation.
## Integrations
You can view License non-compliance scan results for packages in your VCS repositories.
## Pull Request Comment Support for License Policies
Prisma Cloud supports Pull Request (PR) comment notifications for license policy violations. These violations are detected during scans of PRs. If violations are found, the system generates comments on the PR to notify the developer about the detected issues.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/risk-management/monitor-and-manage-code-build/software-composition-analysis/license-compliance-in-sca.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.