> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/standards-catalog.md). # Standards catalog Browse available compliance standards in Cortex XSIAM. The **Standards Catalog** page displays a list of the available standards:
## View controls associated with a specific standard From the **Standards Catalog**, click on the Controls link on the tile corresponding to a specific standard to view the list of all the controls that are part of the standard, All of the columns are sortable and filterable. By default, the table is sorted numerically by the control index number. You can search for specific controls using the filter. For example, you can search for all custom controls with the filter **`Created by != Palo Alto`** The following information is provided for each control: * **Name**: The control name, including the control index number if available. For example, **`2.1.1 Client certificate authentication`** * **Description**: A description of the control. For example, **`Kubernetes provides the option to use client certificates for user authentication.`** * **Standards**: The standards the control is associated with. For example, **`CIS Google Kubernetes Engine (GKE) Benchmark v1.6.0`** * **Category**: The control category, including the category index if available. For example, **`2 Control Plane Configuration`** * **Subcategory**: The control sub category if available, including the sub category index if available. For example, **`2.1 Authentication and Authorization`** * **Rules**: The number of rules associated with the control. * **Creation time**: When the control was created. * **Created by**: Who created the control. For built-in controls, it is **`Palo Alto Networks`**.
Clicking a control opens a side panel that displays all the control details in the **Overview** tab, and the list of rules associated with the control in the **Rules** tab. ## Built-in compliance standards | Compliance Standard | Version | | ---------------------------------------------------------------------------------- | --------------- | | Australian Cyber Security Centre (ACSC) Essential Eight | – | | Australian Cyber Security Centre (ACSC) Essential Eight - Level 1 | – | | Australian Cyber Security Centre (ACSC) Essential Eight - Level 2 | – | | Australian Cyber Security Centre (ACSC) Essential Eight - Level 3 | – | | Australian Cyber Security Centre's (ACSC) Information Security Manual (ISM) | – | | Australian Cyber Security Centre's (ACSC) Information Security Manual (ISM) Latest | – | | Australian Energy Sector Cyber Security Framework (AESCSF) | 1 | | Australian Energy Sector Cyber Security Framework (AESCSF) v2 | 2 | | Australian Energy Sector Cyber Security Framework (AESCSF) v2 - Lite Framework | 2 | | Australian Prudential Regulation Authority (APRA) - CPS 234 Information Security | – | | AWS Foundational Security Best Practices standard | 1.2.0 | | AWS Well-Architected Framework | – | | Azure Security Benchmark | 3 | | Brazilian Data Protection Law (LGPD) | – | | California Consumer Privacy Act (CCPA) | 2018 | | CIS Alibaba Cloud Foundation Benchmark - Level 1 | 2.0.0 | | CIS Alibaba Cloud Foundation Benchmark - Level 2 | 2.0.0 | | CIS Amazon Elastic Kubernetes Service (EKS) Benchmark | 1.4 | | CIS Amazon Elastic Kubernetes Service (EKS) Benchmark | 1.7.0 | | CIS Amazon Elastic Kubernetes Service (EKS) Benchmark | 1.8.0 | | CIS Amazon Linux 2 Benchmark | 1.0.0 | | CIS Amazon Linux 2 STIG Benchmark | 2.0.0 | | CIS Amazon Linux 2023 Benchmark Level 1 and Level 2 Server | 1.0.0 | | CIS Amazon Web Services Foundations Benchmark v3.0.0 - Level 1 | 3.0.0 | | CIS Amazon Web Services Foundations Benchmark v3.0.0 - Level 2 | 3.0.0 | | CIS Amazon Web Services Foundations Benchmark v4.0.0 - Level 1 | 4.0.0 | | CIS Amazon Web Services Foundations Benchmark v4.0.0 - Level 2 | 4.0.0 | | CIS Amazon Web Services Foundations Benchmark v5.0.0 - Level 1 | 5.0.0 | | CIS Amazon Web Services Foundations Benchmark v5.0.0 - Level 2 | 5.0.0 | | CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 1 | 6.0.0 | | CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 2 | 6.0.0 | | CIS Amazon Web Services Foundations Benchmark v7.0.0 - Level 1 | 7.0.0 | | CIS Amazon Web Services Foundations Benchmark v7.0.0 - Level 2 | 7.0.0 | | CIS AWS Storage Services Benchmark | 1.0.0 | | CIS Azure Kubernetes Service (AKS) Benchmark | 1.5 | | CIS Azure Kubernetes Service (AKS) Benchmark v1.8.0 | 1.8.0 | | CIS Critical Security Controls v8 | 8 | | CIS Critical Security Controls v8.1 | 8.1 | | CIS Debian Linux 13 - Server Level 1 | 1.0.0 | | CIS Debian Linux 13 - Server Level 2 | 1.0.0 | | CIS Debian Linux 13 - Workstation Level 1 | 1.0.0 | | CIS Debian Linux 13 - Workstation Level 2 | 1.0.0 | | CIS Distribution Independent Linux | 2.0.0 | | CIS Docker Benchmark | 1.7.0 | | CIS GitHub Benchmark | 1.0.0 | | CIS GitLab Benchmark | 1.0.1 | | CIS Google Cloud Platform Foundation Benchmark v3.0.0 - Level 1 | 3.0.0 | | CIS Google Cloud Platform Foundation Benchmark v3.0.0 - Level 2 | 3.0.0 | | CIS Google Cloud Platform Foundation Benchmark v4.0.0 - Level 1 | 4.0.0 | | CIS Google Cloud Platform Foundation Benchmark v4.0.0 - Level 2 | 4.0.0 | | CIS Google Kubernetes Engine (GKE) Benchmark v1.6.0 | 1.6.0 | | CIS Google Kubernetes Engine (GKE) Benchmark v1.8.0 | 1.8.0 | | CIS Kubernetes Benchmark | 1.11.0 | | CIS Microsoft Azure Foundations Benchmark v3.0.0 - Level 1 | 3.0.0 | | CIS Microsoft Azure Foundations Benchmark v3.0.0 Level 2 | 3.0.0 | | CIS Microsoft Azure Foundations Benchmark v4.0.0 - Level 1 | 4.0.0 | | CIS Microsoft Azure Foundations Benchmark v4.0.0 - Level 2 | 4.0.0 | | CIS Microsoft Azure Foundations Benchmark v5.0.0 - Level 1 | 5.0.0 | | CIS Microsoft Azure Foundations Benchmark v5.0.0 - Level 2 | 5.0.0 | | CIS Microsoft Azure Foundations Benchmark v.6.0.0 - Level 1 | 6.0.0 | | CIS Microsoft Azure Foundations Benchmark v.6.0.0 - Level 2 | 6.0.0 | | CIS Microsoft Azure Storage Services Benchmark | 1.0.0 | | CIS Microsoft Windows 11 Enterprise Benchmark | 4.0.0 | | CIS Microsoft Windows Server 2016 Benchmark | 3.0.0 | | CIS Microsoft Windows Server 2019 Benchmark | 3.0.1 | | CIS Microsoft Windows Server 2022 Benchmark | 3.0.0 | | CIS Oracle Cloud Infrastructure Foundations Benchmark v.2.0.0 - Level 1 | 2.0.0 | | CIS Oracle Cloud Infrastructure Foundations Benchmark v.2.0.0 - Level 2 | 2.0.0 | | CIS Oracle Cloud Infrastructure Foundations Benchmark v.3.0.0 - Level 1 | 3.0.0 | | CIS Oracle Cloud Infrastructure Foundations Benchmark v.3.0.0 - Level 2 | 3.0.0 | | CIS Red Hat OpenShift Container Platform | 1.7.0 | | CIS Red Hat OpenShift Container Platform Benchmark - Level 1 | 1.9.0 | | CIS Red Hat OpenShift Container Platform Benchmark - Level 2 | 1.9.0 | | CIS Ubuntu Linux 24.04 LTS Benchmark - Server Level 1 | 1.0.0 | | CIS Ubuntu Linux 24.04 LTS Benchmark - Server Level 2 | 1.0.0 | | CIS Ubuntu Linux 24.04 LTS Benchmark - Workstation Level 1 | 1.0.0 | | CIS Ubuntu Linux 24.04 LTS Benchmark - Workstation Level 2 | 1.0.0 | | Cloud Security Assurance Program (CSAP) - IaaS | IaaS | | Cloud Security Assurance Program (CSAP) - Low | Low | | Cloud Security Assurance Program (CSAP) - Low SaaS | Low SaaS | | Cloud Security Assurance Program (CSAP) - SaaS Simplified | SaaS Simplified | | Cloud Security Assurance Program (CSAP) - SaaS Standard | SaaS Standard | | CSA Cloud Controls Matrix (CCM) | 4.0.12 | | CSA Cloud Controls Matrix (CCM) v4.0.6 | 4.0.6 | | Cyber Risk Institute (CRI) Profile | 1.2.1 | | Cyber Risk Institute (CRI) Profile | 2.0 | | Cyber Risk Institute (CRI) Profile | 2.1 | | CyberSecurity Law of the People's Republic of China | – | | Cybersecurity Maturity Model Certification (CMMC) | 1.02 | | Cybersecurity Maturity Model Certification (CMMC) Level 1 | 2 | | Cybersecurity Maturity Model Certification (CMMC) Level 2 | 2 | | Digital Operational Resilience Act (DORA) | – | | EU AI Act | – | | Federal Financial Institutions Examination Council (FFIEC) | – | | FedRamp (High) | – | | Fedramp (Low) | – | | Fedramp (Moderate) | – | | Framework for Adoption of Cloud Services by SEBI Regulated Entities (REs) | – | | General Data Protection Regulation (GDPR) | – | | Health Insurance Portability and Accountability Act (HIPAA) | – | | HITRUST CSF | 11.2.0 | | HITRUST CSF | 11.7.0 | | HITRUST CSF | 9.6.0 | | Information Technology Security Guidance (ITSG-33) | – | | Insurance Regulatory And Development Authority Of India | 1 | | ISO/IEC 27001:2022 | 2022 | | ISO/IEC 27002:2022 | 2022 | | ISO/IEC 27017:2015 | 2015 | | ISO/IEC 27018:2019 | 2019 | | ISO/IEC 42001:2023 | 2023 | | Korea – Information Security Management System (ISMS) | – | | Korea – Information Security Management System (ISMS) For Finance | - | | MAS Technology Risk Management (TRM) | 2021 | | Microsoft Cloud Security Benchmark | 1 | | MITRE ATT\&CK Cloud IaaS for Enterprise | 15.1 | | Motion Picture Association (MPA) Content Protection Best Practices | 4.08 | | Multi-Level Protection Scheme (MLPS) v2.0 - Level 1 | 2.0 | | Multi-Level Protection Scheme (MLPS) v2.0 - Level 2 | 2.0 | | Multi-Level Protection Scheme (MLPS) v2.0 - Level 3 | 2.0 | | NCSC - Cloud Security Principles | 2.1 | | NCSC - Cyber Essentials | 3.1 | | NEW YORK STATE DEPARTMENT OF FINANCIAL SERVICES (NYDFS) 23 CRR-NY 500.0 | – | | New Zealand Information Security Manual (NZISM) | 3.4 | | New Zealand Information Security Manual (NZISM) | 3.9 | | NIS 2 Directive (EU) 2022/2555 | – | | NIST AI 600-1 | – | | NIST Cybersecurity Framework (CSF) | 1.1 | | NIST Cybersecurity Framework (CSF) | 2 | | NIST SP 800-171 | Rev 2 | | NIST SP 800-171 | Rev 3 | | NIST SP 800-172 | – | | NIST SP 800-53 | Rev 5 | | NIST SP 800-190 | - | | Otoritas Jasa Keuangan (OJK) | 38/POJK.03/2016 | | OWASP Top 10 for Agentic Applications | 2026 | | OWASP TOP 10 CI/CD Security Risks | 2025 | | OWASP Top 10 for LLM Applications | 2025 | | PCI DSS | 4.0.1 | | Personal Information Protection and Electronic Documents Act (PIPEDA) | – | | RBI Baseline Cyber Security and Resilience Requirements | – | | Risk Management in Technology (RMiT) | – | | Sarbanes Oxley Act (SOX) | – | | SEBI - Consolidated Cybersecurity and Cyber Resilience Framework (CSCRF) | – | | Secure Controls Framework (SCF) | 2024.2 | | Secure Controls Framework (SCF) | 2022.2.1 | | SOC 2 | – | | Telecommunications Security Act (TSA) | – | | Texas Risk and Authorization Management Program (TX-RAMP) - Level 1 | - | | Texas Risk and Authorization Management Program (TX-RAMP) - Level 2 | - | | The Digital Personal Data Protection Act 2023 | – | | Trusted Information Security Assessment Exchange (TISAX) | 6 | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/standards-catalog.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.