> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/manage-iac-compliance.md).

# Manage IaC compliance

Manage IaC compliance assessments and reports directly in the tenant to generate and download audit-ready compliance evidence. You can view mapped rules, enforce compliance via policies, and filter issues by specific regulatory controls.

**View IaC compliance rules mapped to compliance standards and controls**

You can view and modify compliance standards mapped to specific IaC rules in **AppSec Rules** to control which rules are evaluated for compliance and ensure that findings are correctly attributed to the intended compliance framework.

1. Navigate to **Modules** → **Application Security** → **AppSec Rules**.
2. Filter the table by IaC -supported **Compliance Standards** OR **Compliance Controls** attributes.

   <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><h3>Danger</h3><p>Add these properties to the IaC Rules table through the <strong>Table Settings Menu</strong>, as they are not exposed by default.</p></div>

**Create Cortex Cloud Application Security policies with IaC compliance conditions**

Create policies to include or exclude findings based on specific IaC compliance standards and controls. This provides precise control over automated issue creation and build-blocking.

1. Navigate to **Modules** → **Application Security** → **AppSec Polices** → **Add Policy**.
2. Follow the standard procedure in the policy wizard. The configuration for all steps remains the same, except for the **Conditions** step.
3. On the **Conditions** step of the wizard.
   1. Apply a compliance filter: Select either **Compliance Standard** or **Compliance Control** as the attribute.
   2. Select the required values for the standard or control.

**Manage IaC compliance issues and findings**

IaC Compliance issues and findings are found under the respective IaC Misconfigurations tables. You can filter IaC misconfiguration findings and issues by compliance standards and controls to isolate risks relevant to specific regulatory frameworks. This allows you to prioritize remediation based on your organization's required security controls.

{% hint style="warning" %}

### Danger

Add these properties to the tables table through the **Table Settings Menu**, as they are not exposed by default.
{% endhint %}

1. Navigate to **Modules** → **Application Security** → **IaC Misconfigurations (under Issues)**.
2. * **For IaC Compliance issues**:
     * Filter the table by IaC-supported **Compliance Standards** OR **Compliance Controls** attributes.
     * View **Compliance Standards** and **Compliance Controls** in the Issues table by adding these properties through the **Table Settings Menu**.
     * The IaC issues side card includes a **Compliance Standards** tab with additional details about IaC Compliance Standards and Controls.
   * **For IaC Compliance findings**:
     * Select the **Findings** tab in the IaC issues page.
     * View IaC-supported **Compliance Standards** and **Compliance Controls** in the Findings table by adding these properties through the **Table Settings Menu**.
     * The **Compliance Standards** tab in the IaC findings side panel displays the specific standards and controls mapped to the Cortex Cloud Application Security rules.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/manage-iac-compliance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.