> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/compliance-cloud-permissions.md).
# Compliance - Cloud permissions
Configure access to Cloud compliance, which allows organizations to track adherence against regulatory frameworks (e.g., CIS, NIST, PCI DSS), monitor cloud compliance violations, and manage compliance assessment schedules
Requires Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.
System-provided (OOTB) standards and controls are immutable. They cannot be edited or deleted by any user, regardless of whether they hold View/Edit permissions
Compliance permissions include Catalog and assessment Profiles, and Reports. Users access Assessment/Reports by going to Posture Management → Compliance.
**Catalog and Assessment Profiles**
Controls access to the building blocks of Compliance (Posture Management → Compliance):
* Standards Catalog: A library of compliance frameworks (for example, CIS Benchmarks, NIST 800-53, PCI DSS, SOC 2). Standards can be pre-built (OOTB/system) or custom-created.
* Controls Catalog: The individual security checks and requirements that make up a standard.
* Assessment profiles: Configurations that define how compliance is assessed.
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to the Standards, Controls, or Assessment Profiles pages. | |
| View | The user can navigate to the Standards Catalog, Controls Catalog, and Assessment Profiles pages. They can view the list of standards, browse controls and their details (severity, category, linked rules), and see assessment profile configurations (name, standard, schedule, targets). | - SOC Tier 1, 2, and 3 Analysts: Should not modify compliance configurations. May need visibility into compliance posture.
- Threat Hunter: Needs read-only access to compliance data to correlate compliance gaps with threat activity. Should not modify compliance configurations.
|
| View/Edit | The user has full access. In addition to all View capabilities, they can create, edit, and delete custom standards, custom controls, and custom profiles. | Security Engineer: Responsible for defining and maintaining compliance standards, controls, and assessment profiles. Needs full access to configure the compliance framework. |
**Reports**
Reports provide the results and outputs of compliance assessments.
* Assessment: The live compliance posture view shows the latest evaluation results for each assessment profile, including scores, control status breakdowns, failed controls by severity, and drill-downs into rules, controls, and assets.
* Reports: Historical compliance reports that have been generated and stored. These can be viewed, exported (PDF/CSV), or deleted.
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | The user cannot access the Assessment or Reports pages. Navigation menu items for these sections are hidden. | |
| View | The user can navigate to the Assessment and Reports pages. They can view the compliance posture dashboard with scores, control status breakdowns, and failed control severity widgets. They can drill down into profile results to see controls, rules, and asset results. They can view historical reports and export reports to PDF or CSV. They cannot delete reports. | - SOC Tier 1, 2, and 3 Analysts: Need to view/analyze compliance reports and export them for escalation or documentation during triage.
- Threat Hunter: Needs read-only access to compliance reports to identify compliance gaps that may indicate attack surfaces or ongoing threats.
- Security Engineer: Needs to review compliance reports to validate that configured standards and controls are producing expected results. Does not typically need to delete reports.
|
| View/Edit | The user has full access. In addition to all View capabilities, they can delete reports. | |
Required and recommended permissions
To effectively prioritize compliance violations and validate that custom standards are working, administrators and analysts require visibility into active security issues and broader vulnerability data.
| Permission | Permission Level | Reason |
| ------------------------ | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cases & Issues | View | Recommended for reports. Compliance findings surfaced in reports may generate issues or be linked to cases. Granting this permission allows users to correlate compliance violations shown in reports with active security cases, providing a more complete picture of the organization's security posture. |
| Vulnerability Management | View | Recommended. Compliance report results often overlap with vulnerability findings (for example, CIS benchmarks checking for unpatched software). Granting this permission enables users to cross-reference compliance report results with vulnerability data, helping prioritize remediation efforts based on both compliance requirements and actual vulnerability exposure. |
| Reports | View | Strongly recommended for the Catalog and Assessment Profile. Users who manage the compliance catalog (standards, controls, profiles) need to verify that their configurations produce correct assessment results. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/compliance-cloud-permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.