> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/compliance-cloud-permissions.md).
# Compliance - Cloud permissions
Configure permissions for cloud compliance.
Configure access to Cloud compliance, which allows organizations to track adherence against regulatory frameworks (e.g., CIS, NIST, PCI DSS), monitor cloud compliance violations, and manage compliance assessment schedules
{% hint style="info" %}
Requires Cloud Posture Security or Cloud Runtime Security license.
{% endhint %}
System-provided (OOTB) standards and controls are immutable. They cannot be edited or deleted by any user, regardless of whether they hold View/Edit permissions
Compliance permissions include Catalog and assessment Profiles, and Reports. Users access Assessment/Reports by going to Posture Management → Compliance.
**Catalog and Assessment Profiles**
Controls access to the building blocks of Compliance (Posture Management → Compliance):
* Standards Catalog: A library of compliance frameworks (for example, CIS Benchmarks, NIST 800-53, PCI DSS, SOC 2). Standards can be pre-built (OOTB/system) or custom-created.
* Controls Catalog: The individual security checks and requirements that make up a standard.
* Assessment profiles: Configurations that define how compliance is assessed.
For more information, see [Monitor and track compliance adherence](/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/monitor-and-track-compliance-adherence.md).
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to the Standards, Controls, or Assessment Profiles pages. | |
| View | The user can navigate to the Standards Catalog, Controls Catalog, and Assessment Profiles pages. They can view the list of standards, browse controls and their details (severity, category, linked rules), and see assessment profile configurations (name, standard, schedule, targets). | - SOC Tier 1, 2, and 3 Analysts: Should not modify compliance configurations. May need visibility into compliance posture.
- Threat Hunter: Needs read-only access to compliance data to correlate compliance gaps with threat activity. Should not modify compliance configurations.
|
| View/Edit | The user has full access. In addition to all View capabilities, they can create, edit, and delete custom standards, custom controls, and custom profiles. | Security Engineer: Responsible for defining and maintaining compliance standards, controls, and assessment profiles. Needs full access to configure the compliance framework. |
**Reports**
Reports provide the results and outputs of compliance assessments.
* Assessment: The live compliance posture view shows the latest evaluation results for each assessment profile, including scores, control status breakdowns, failed controls by severity, and drill-downs into rules, controls, and assets.
* Reports: Historical compliance reports that have been generated and stored. These can be viewed, exported (PDF/CSV), or deleted.
For more information, see [View and manage compliance assessments and reports](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports.md).
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | The user cannot access the Assessment or Reports pages. Navigation menu items for these sections are hidden. | |
| View | The user can navigate to the Assessment and Reports pages. They can view the compliance posture dashboard with scores, control status breakdowns, and failed control severity widgets. They can drill down into profile results to see controls, rules, and asset results. They can view historical reports and export reports to PDF or CSV. They cannot delete reports. | - SOC Tier 1, 2, and 3 Analysts: Need to view/analyze compliance reports and export them for escalation or documentation during triage.
- Threat Hunter: Needs read-only access to compliance reports to identify compliance gaps that may indicate attack surfaces or ongoing threats.
- Security Engineer: Needs to review compliance reports to validate that configured standards and controls are producing expected results. Does not typically need to delete reports.
|
| View/Edit | The user has full access. In addition to all View capabilities, they can delete reports. | |
Required and recommended permissions
To effectively prioritize compliance violations and validate that custom standards are working, administrators and analysts require visibility into active security issues and broader vulnerability data.
| Permission | Permission Level | Reason |
| ------------------------ | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cases & Issues | View | Recommended for reports. Compliance findings surfaced in reports may generate issues or be linked to cases. Granting this permission allows users to correlate compliance violations shown in reports with active security cases, providing a more complete picture of the organization's security posture. |
| Vulnerability Management | View | Recommended. Compliance report results often overlap with vulnerability findings (for example, CIS benchmarks checking for unpatched software). Granting this permission enables users to cross-reference compliance report results with vulnerability data, helping prioritize remediation efforts based on both compliance requirements and actual vulnerability exposure. |
| Reports | View | Strongly recommended for the Catalog and Assessment Profile. Users who manage the compliance catalog (standards, controls, profiles) need to verify that their configurations produce correct assessment results. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/compliance-cloud-permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.