> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/cicd-compliance.md). # CI/CD Compliance Cortex Cloud CI/CD compliance focuses on the security posture of your delivery pipelines and version control systems. It detects misconfigurations, such as insecure branch protections or permissive runner access, that violate software supply chain security benchmarks **Supported standards**: Cortex Cloud supports compliance checks against the **CIS GitLab Benchmark** v1.0.1, **CIS GitHub Benchmark** v1.0.0, and the **OWASP Top 10 CI/CD Risks** v2025. **Scope of checks**: * **Pipeline risks**: Poisoned Pipeline Execution (PPE), insecure configurations * **VCS security**: Repository permissions, branch protection, access controls * **Build security**: Supply chain risks, credential management. **Create CI/CD compliance reports** The following steps describe the workflow for creating CI/CD compliance reports. | Step | Description | | ----------------------------------------- | ----------------------------------------------------------------------------------------------------- | | Step 1. Create an **Asset Group**. | [Create an Asset Group](#UUID-78d685a4-8956-a6df-a0f1-a2d17e1d8bdd_section-idm235027138887615) | | Step 2. Create an **Assessment Profile**. | [Create an Assessment Profile](#UUID-78d685a4-8956-a6df-a0f1-a2d17e1d8bdd_section-idm235027173098281) | | Step 3. View reports. | [View and access reports](#UUID-78d685a4-8956-a6df-a0f1-a2d17e1d8bdd_section-idm235027214800378) | **Create an Asset Group** Create an asset group to define a logical collection of your CI/CD assets (such as specific repositories or pipelines within a provider like GitHub). This step scopes your security assessments, ensuring that subsequent compliance checks and scans performed by an assessment profile are applied to the relevant resources. 1. Navigate to **Inventory** → **Groups** → **+ Add Group**. 2. On the **Create New Assets Group** screen: 1. Provide a group name (required) and description. 2. From the Filter menu in the Assets table, select **Provider** → **\[Type of provider]**.

Note

The CI/CD module supports GitHub and GitLab provider types.

3. Select Create Dynamic Group, or select assets from the list that is displayed, and click Create Static Group.

Note

For more information about about Asset Groups, refer to Asset groups.

**Create an Assessment Profile** Create an assessment profile, which configures the specific security standards and initiates the scans against the assets defined in your asset group. 1. Navigate to **Posture Management** → **Compliance** → **Assessment Profiles** → **Create New Assessment**. 2. On the **General** step of the wizard. 1. Provide a profile name (required) and description (optional), and select **Generate a scheduled report**. 2. Specify the email recipients for the report. 3. Set the **Evaluation frequency** (required). 4. Click Next. 3. On the **Standards and Asset Group** step of the wizard. 1. Select a standard.

Note

CIS GitLab Benchmark, CIS GitHub Benchmark, and the OWASP Top 10 CI/CD Risks standards are supported.

2. Select your asset group from the list and click Next. 4. Review the details on the **Summary** step of the wizard and click Create. {% hint style="info" %} ### Note For more information about assessment profiles, refer to [Use an assessment profile to run compliance checks on your assets](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/monitor-and-track-compliance-adherence/use-an-assessment-profile-to-run-compliance-checks-on-your-assets). {% endhint %} **View and access reports** The email recipients defined in the assessment profile will receive the compliance report. To view the compliance scan results: * Navigate to **Posture Management** → **Compliance** → **Reports**. For more information about compliance assessment reports, refer to [View and manage compliance assessments and reports](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/cicd-compliance.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.