> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/compliance/compliance-standards.md). # Built-in Compliance Standards Prisma Cloud Compliance provides a snapshot of your overall compliance posture across various compliance standards. Use **Compliance > Standards** to oversee the risk across all the supported cloud platforms and gauge the effectiveness of the security processes and controls you have implemented to keep your enterprise secure. In addition to the built-in standards, if you want to create a custom standard, combine the out-of-the-box policies along with any custom policies to implement your internal cloud security and compliance standards and policies. This custom standard is also displayed on this Compliance Standards page and the **Created By** is attributed to you. Review the list of all the built-in and custom standards that you may have defined to monitor and audit your organization’s performance. Each row in the table includes a description of a standard and the total number of policies that map to the standard. It also includes the total number of unique resources monitored for that standard, the pass and fail count of the resources that passed the compliance checks. For each failed check, the severity of the issue affects where it is counted. For example, if a resource fails a high severity policy, it is not counted towards a medium or low failure even if it fails a medium or low severity policy rule. To learn about each compliance standard, the requirements/sections that it comprises and the policies that map to each requirement, use the links in the compliance standard name in each row. You can also search by the name to filter the data and view information about the selected compliance standard only. * Prisma Cloud provides policies for risk assessment that map to compliance standards, and a larger set of policies that enable prevention or detection of security risks to which your cloud assets are exposed. Anomaly policies are an example of policies that are typically not a part of compliance standards, and these policies inform you of actions performed on your cloud assets by entities that are users, services, or IAM roles that have authorization to access and modify your cloud assets, but the entities are not cloud assets. * Unlike the Asset Inventory that aggregates all your resources and displays the pass and fail count for all monitored resources, the Compliance standards only display the results for monitored resources that match the policies included within a compliance standard. For example, even if you have 30 AWS Redshift instances, if none of the compliance standards include policies that check the configuration or compliance and security standards for Redshift instances, the 30 Redshift instances are not included in the resource count. The results on the table therefore, help you focus your attention on the gaps in compliance for a standard or regulation that is important to you. The built-in regulatory compliance standards that Prisma Cloud supports are listed in the following table. | Cloud Type | Compliance Standards Supported | | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | AWS | APRA CPS 234, Brazilian Data Protection Law (LGPD), CIS AWS 3 Tier Arch v1.0, CCPA 2018, CIS v1.2, CIS v1.3, CIS AWS v.1.4, CSA CCM v3.0.1, CSA CCM v4.0.1, CMMC, GDPR, HITRUST v9.3, HITRUST v9.4.2, HIPAA, ISO 27001:2013, MAS TRM 2021, MITRE ATT\&CKv6.3, MITRE ATT\&CKv8.2, MPAA Content Protection Best Practice v4.08, Multi-Level Protection Scheme (MLPS) v2.0, NIST 800.53 Rev4, NIST 800-53 Rev5, NIST 800-171 Rev1, NIST SP 800-171 Rev2, NIST SP 800-172, NIST 800-53 Rev5, NIST CSF v1.1, PCI DSS v3.2, PIPEDA, Monetary Authority of Singapore (MAS) Technology Risk Management (TRM), Risk Management in Technology (RMiT), SOC 2, AWS well architected framework, CyberSecurity Law of the People’s Republic of China, CIS AWS 3 Tier Arch v1.0, ISO/IEC 27002:2013, ISO/IEC 27018:2019, ISO/IEC 27017:2015, MITRE ATT\&CK v10.0, New Zealand Information Security Manual (NZISM) v3.4, Australian Energy Sector Cyber Security Framework (AESCSF), Australian Cyber Security Centre (ACSC) Information Security Manual (ISM), Australian Cyber Security Centre (ACSC) Essential Eight, CIS Critical Security Controls (CIS CSC) V7.1, CIS CSC V8, Federal Financial Institutions Examination Council (FFIEC), Payment Card Industry Data Security Standard (PCI DSS v4.0), New York Department of Financial Services (NYDFS) 23 Codes, Rules and Regulations (Part 500), Cybersecurity Maturity Model Certification (CMMC) v.2.0 (Level 1), HITRUST CSF v.9.6.0, Korea–Information Security Management System (K-ISMS), FedRAMP Moderate and Low Baselines (800-53 R4), CIS Amazon Web Services Foundations Benchmark (v1.5.0), SCF 2022.2.1, MLPS 2.0 (Level 2), Sarbanes Oxley Act (SOX), AWS Foundational Security Best Practices, CSA CCM v.4.0.6, ISO 27002:2022, ISO 27001:2022, CRI Profile v.1.2.1, Mitre Att\&ck v12, Otoritas Jasa Keuangan (OJK) 38/POJK.03/2016, MLPS 2.0 (Level 3), CIS AWS Foundations Benchmark v2.0.0, Cybersecurity Maturity Model Certification (CMMC) v.2.0 (Level 2) | | Azure | Azure Security Benchmark (ASB) v2, Azure Security Benchmark (ASB) v3, APRA CPS 234, Brazilian Data Protection Law (LGPD), CCPA 2018, CIS v1.1, CIS v1.2, CIS v1.3, CIS v1.3.1, CIS v1.4.0, CMMC, CSA CCM v3.0.1, CSA CCM v4.0.1, GDPR, HITRUST v9.3, HITRUST v9.4, HIPAA, ISO 27001:2013, MITRE ATT\&CKv6.3, MITRE ATT\&CKv8.2, MPAA Content Protection Best Practice v4.08, Multi-Level Protection Scheme (MLPS) v2.0, NIST 800.53 R4, NIST 800-53 Rev5, NIST CSF v1.1, NIST SP 800-171 Rev2, NIST SP 800-172, PCI DSS v3.2, PIPEDA, SOC 2, CyberSecurity Law of the People’s Republic of China, ISO/IEC 27002:2013, ISO/IEC 27018:2019, ISO/IEC 27017:2015, MITRE ATT\&CK v10.0, New Zealand Information Security Manual (NZISM) v3.4, Australian Energy Sector Cyber Security Framework (AESCSF), Australian Cyber Security Centre (ACSC) Information Security Manual (ISM), Australian Cyber Security Centre (ACSC) Essential Eight< CIS Critical Security Controls (CIS CSC) V7.1, CIS CSC V8, Federal Financial Institutions Examination Council (FFIEC), Payment Card Industry Data Security Standard (PCI DSS v4.0), FedRAMP Moderate and Low Baselines (800-53 R4), CIS Microsoft Azure Foundations Benchmark (v1.5.0), SCF 2022.2.1, MLPS 2.0 (Level 2), Sarbanes Oxley Act (SOX), CSA CCM v.4.0.6, ISO 27002:2022, ISO 27001:2022, CIS v2.0.0 (Azure) Level 1 and Level 2, CRI Profile v.1.2.1, Mitre Att\&ck v12, Cybersecurity Maturity Model Certification (CMMC) v.2.0 (Level 2) | | GCP | APRA CPS 234, Brazilian Data Protection Law (LGPD), CCPA 2018, CIS v1.0, CIS v.1.1, CIS v.1.2, CIS GKE v1.1, CSA CCM v3.0.1, CSA CCM v4.0.1, CMMC, GDPR, HITRUST v9.3, HITRUST v9.4, HIPAA, ISO 27001:2013, MITRE ATT\&CKv6.3, MITRE ATT\&CKv8.2, MPAA Content Protection Best Practice v4.08, NIST 800.53 R4, NIST 800-53 Rev5, NIST CSF v1.1, NIST SP 800-171 Rev2, NIST SP 800-172, PCI DSS v3.2, PIPEDA, SOC 2, ISO/IEC 27002:2013, ISO/IEC 27018:2019, ISO/IEC 27017:2015, MITRE ATT\&CK v10.0, New Zealand Information Security Manual (NZISM) v3.4, Australian Energy Sector Cyber Security Framework (AESCSF), Australian Cyber Security Centre (ACSC) Information Security Manual (ISM), Australian Cyber Security Centre (ACSC) Essential Eight, CIS Critical Security Controls (CIS CSC) V7.1, CIS CSC V8, Federal Financial Institutions Examination Council (FFIEC), Payment Card Industry Data Security Standard (PCI DSS v4.0), CIS Google Cloud Platform Foundation Benchmark v1.3.0, CIS Google Kubernetes Engine (GKE) v1.2.0 and v1.3.0, FedRAMP Moderate and Low Baselines (800-53 R4), SCF 2022.2.1, CIS Google Cloud Platform Foundation Benchmark v2.0.2, CSA CCM v.4.0.6, ISO 27002:2022, ISO 27001:2022, CRI Profile v.1.2.1, Mitre Att\&ck v12, CIS Google Kubernetes Engine (GKE) v1.4.0 - (Level 1 and Level 2), Cybersecurity Maturity Model Certification (CMMC) v.2.0 (Level 2), CIS GCP Foundation benchmark 3.0 | | Alibaba | Brazilian Data Protection Law (LGPD), CIS v1.0.0, CMMC, CSA CCM v4.0.1, HITRUST v9.3, MAS TRM 2021, MPAA Content Protection Best Practice v4.08, Multi-Level Protection Scheme (MLPS) v2.0, MITRE ATT\&CKv8.2, NIST 800.53 Rev4, NIST 800-53 Rev5, NIST CSF v1.1, NIST SP 800-171 Rev2, NIST SP 800-172, PCI DSS v3.2, MAS TRM, RMiT, CyberSecurity Law of the People’s Republic of China, ISO/IEC 27002:2013, ISO/IEC 27018:2019, ISO/IEC 27017:2015, MITRE ATT\&CK v10.0, New Zealand Information Security Manual (NZISM) v3.4, Australian Energy Sector Cyber Security Framework (AESCSF), Australian Cyber Security Centre (ACSC) Information Security Manual (ISM), Australian Cyber Security Centre (ACSC) Essential Eight, CIS Critical Security Controls (CIS CSC) V7.1, CIS CSC V8, Federal Financial Institutions Examination Council (FFIEC), Payment Card Industry Data Security Standard (PCI DSS v4.0), FedRAMP Moderate and Low Baselines (800-53 R4), SCF 2022.2.1, MLPS 2.0 (Level 2), Sarbanes Oxley Act (SOX), CSA CCM v.4.0.6, ISO 27002:2022, ISO 27001:2022, CRI Profile v.1.2.1, Mitre Att\&ck v12, Cybersecurity Maturity Model Certification (CMMC) v.2.0 (Level 2) | | Oracle Cloud Infrastructure | CIS v1.0, CIS v1.1, CSA CCM v4.0.1, HITRUST v9.4, MITRE ATT\&CKv8.2, MPAA Content Protection Best Practice v4.08, NIST SP 800-171 Rev2, NIST SP 800-172, NIST CSF v1.1, PCI DSS v3.2, ISO/IEC 27002:2013, ISO/IEC 27018:2019, ISO/IEC 27017:2015, MITRE ATT\&CK v10.0, New Zealand Information Security Manual (NZISM) v3.4, Australian Energy Sector Cyber Security Framework (AESCSF), Australian Cyber Security Centre (ACSC) Information Security Manual (ISM), Australian Cyber Security Centre (ACSC) Essential Eight, CIS Critical Security Controls (CIS CSC) V7.1, CIS CSC V8, Federal Financial Institutions Examination Council (FFIEC), Payment Card Industry Data Security Standard (PCI DSS v4.0), CIS Oracle Cloud Infrastructure Foundations Benchmark v1.2.0, SCF 2022.2.1, MLPS 2.0 (Level 2), Sarbanes Oxley Act (SOX), CSA CCM v.4.0.6, ISO 27002:2022, ISO 27001:2022., CRI Profile v.1.2.1, Mitre Att\&ck v12, Cybersecurity Maturity Model Certification (CMMC) v.2.0 (Level 2) | To help you easily identify the gaps and measure how you’re doing against the compliance standards, create a custom [dashboard](/content-collections/dashboards/create-and-manage-dashboards.md) with the compliance widgets. You can also [create compliance reports](/content-collections/compliance/new-compliance-report.md) and run them immediately, or schedule them on a recurring basis to measure your compliance over time. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/compliance/compliance-standards.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.