Prisma Public Cloud enables compliance monitoring and reporting by mapping which configurations to compliance standards?

Prisma Public Cloud's compliance feature works by creating a logical mapping between industry or custom compliance standards and its own security policies. A compliance standard (e.g., CIS, PCI DSS) is composed of specific requirements or controls. Each of these requirements is mapped to one or more Prisma Cloud policies. A policy is the actual rule or query that checks for a specific misconfiguration in the cloud environment. When a policy check fails, it indicates a violation of the associated compliance requirement.

A. RQL queries: Policies are built using RQL, but it is the policy object itself (which includes metadata like severity and remediation) that is mapped to the compliance standard, not the raw query.
B. alert rules: Alert rules define actions to take when a policy violation occurs (e.g., send a notification). They are triggered by policies but are not directly mapped to compliance standards.
C. notification templates: These are used by alert rules to format the content of notifications and are not part of the core compliance mapping logic.

1. Palo Alto Networks, Prisma Cloud Administrator's Guide. "Compliance Dashboard". The documentation states, "Prisma Cloud provides predefined compliance standards that are mapped to policies out-of-the-box to help you get started with assessing your deployments."

2. Palo Alto Networks, Prisma Cloud Administrator's Guide. "Manage Compliance Standards and Requirements". This section explains the hierarchy: "A compliance standard is a collection of requirements that a policy can be mapped to." This confirms the direct link between policies and compliance standards.