Checks Compliances Providers Bundles Artifacts Organizations

Compliances

Browse compliance frameworks supported by Prowler Registry. Filter by cloud provider to find relevant standards.

Prowler Registry

The official registry for Prowler security artifacts. Browse, install, and publish checks, providers, compliances and extensions.

Registry

Artifacts Checks Compliances Providers Bundles Organizations Documentation

Prowler

Website GitHub Registry API Prowler Docs Slack Community

© 2026 Prowler. All rights reserved.

CSA Cloud Controls Matrix (CCM) v4.0.13

v4.0

csa_ccm_4.0

45requirements50checks

The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing, composed of 197 control objectives structured in 17 domains covering all key aspects of cloud technology. The CCM can be used as a tool for the systematic assessment of a cloud implementation, and provides guidance on which security controls should be implemented by which actor within the cloud supply chain.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-csa-ccmRun in Prowler Cloud

Cybersecurity Maturity Model Certification (CMMC) 2.0

v2.0

cmmc_2.0

44requirements52checks

Cybersecurity Maturity Model Certification (CMMC) 2.0

v2.0

cmmc_2.0

51requirements90checks

Cybersecurity Maturity Model Certification (CMMC) 2.0

v2.0

cmmc_2.0

46requirements104checks

Cybersecurity Maturity Model Certification (CMMC) 2.0

v2.0

cmmc_2.0

42requirements61checks

Cybersecurity Maturity Model Certification (CMMC) 2.0

v2.0

cmmc_2.0

36requirements67checks

Cybersecurity Maturity Model Certification (CMMC) 2.0

v2.0

cmmc_2.0

32requirements41checks

Digital Operational Resilience Act (Regulation (EU) 2022/2554)

v2022/2554

dora_2022_2554

17requirements63checks

Digital Operational Resilience Act (Regulation (EU) 2022/2554)

v2022/2554

dora_2022_2554

18requirements202checks

Digital Operational Resilience Act (Regulation (EU) 2022/2554)

v2022/2554

dora_2022_2554

18requirements149checks

Digital Operational Resilience Act (Regulation (EU) 2022/2554)

v2022/2554

dora_2022_2554

6requirements25checks

Digital Operational Resilience Act (Regulation (EU) 2022/2554)

v2022/2554

dora_2022_2554

18requirements105checks

DISA Okta Identity as a Service (IDaaS) STIG V1R2

v1R2

okta_idaas_stig_1r2_okta

29requirements29checks

ENS RD 311/2022 - Categoría Alta

vRD2022

ens_rd2022_azure

84requirements106checks

ENS RD 311/2022 - Categoría Alta

vRD2022

ens_rd2022_aws

189requirements127checks

ENS RD 311/2022 - Categoría Alta

vRD2022

ens_rd2022_gcp

92requirements62checks

FedRAMP 20x Class C Rules (FRR) 2026

v2026.09.13.02

fedramp_20x_frr_class_c_2026.09.13.02

17requirements16checks

FedRAMP 20x Class C Rules (FRR) 2026

v2026.09.13.02

fedramp_20x_frr_class_c_2026.09.13.02

7requirements6checks

FedRAMP 20x Class C Rules (FRR) 2026

v2026.09.13.02

fedramp_20x_frr_class_c_2026.09.13.02

5requirements2checks

FedRAMP 20x Key Security Indicators (KSI) 2026

v2026.07.14.01

fedramp_20x_ksi_2026.07.14.01

33requirements443checks

FedRAMP 20x Key Security Indicators (KSI) 2026

v2026.07.14.01

fedramp_20x_ksi_2026.07.14.01

23requirements132checks

FedRAMP 20x Key Security Indicators (KSI) 2026

v2026.07.14.01

fedramp_20x_ksi_2026.07.14.01

19requirements90checks

FedRAMP 20x Key Security Indicators (KSI) 2026

v2026.07.14.01

fedramp_20x_ksi_2026.07.14.01

16requirements73checks

FedRAMP 20x Key Security Indicators (KSI) 2026

v2026.07.14.01

fedramp_20x_ksi_2026.07.14.01

15requirements67checks

Previous
Page 4 of 7 (148 artifacts)
Next

The Cybersecurity Maturity Model Certification (CMMC) 2.0 program, codified in 32 CFR Part 170, is the U.S. Department of Defense mechanism to verify that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It defines three levels: Level 1 (15 basic safeguarding requirements from 48 CFR 52.204-21), Level 2 (the 110 security requirements of NIST SP 800-171 Rev 2) and Level 3 (24 enhanced requirements selected from NIST SP 800-172).

ProwlerOfficialBuilt-inVerifiedprowler-compliance-cmmcRun in Prowler Cloud

The Cybersecurity Maturity Model Certification (CMMC) 2.0 program, codified in 32 CFR Part 170, is the U.S. Department of Defense mechanism to verify that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It defines three levels: Level 1 (15 basic safeguarding requirements from 48 CFR 52.204-21), Level 2 (the 110 security requirements of NIST SP 800-171 Rev 2) and Level 3 (24 enhanced requirements selected from NIST SP 800-172).

ProwlerOfficialBuilt-inVerifiedprowler-compliance-cmmcRun in Prowler Cloud

The Cybersecurity Maturity Model Certification (CMMC) 2.0 program, codified in 32 CFR Part 170, is the U.S. Department of Defense mechanism to verify that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It defines three levels: Level 1 (15 basic safeguarding requirements from 48 CFR 52.204-21), Level 2 (the 110 security requirements of NIST SP 800-171 Rev 2) and Level 3 (24 enhanced requirements selected from NIST SP 800-172).

ProwlerOfficialBuilt-inVerifiedprowler-compliance-cmmcRun in Prowler Cloud

The Cybersecurity Maturity Model Certification (CMMC) 2.0 program, codified in 32 CFR Part 170, is the U.S. Department of Defense mechanism to verify that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It defines three levels: Level 1 (15 basic safeguarding requirements from 48 CFR 52.204-21), Level 2 (the 110 security requirements of NIST SP 800-171 Rev 2) and Level 3 (24 enhanced requirements selected from NIST SP 800-172).

ProwlerOfficialBuilt-inVerifiedprowler-compliance-cmmcRun in Prowler Cloud

The Cybersecurity Maturity Model Certification (CMMC) 2.0 program, codified in 32 CFR Part 170, is the U.S. Department of Defense mechanism to verify that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It defines three levels: Level 1 (15 basic safeguarding requirements from 48 CFR 52.204-21), Level 2 (the 110 security requirements of NIST SP 800-171 Rev 2) and Level 3 (24 enhanced requirements selected from NIST SP 800-172).

ProwlerOfficialBuilt-inVerifiedprowler-compliance-cmmcRun in Prowler Cloud

The Cybersecurity Maturity Model Certification (CMMC) 2.0 program, codified in 32 CFR Part 170, is the U.S. Department of Defense mechanism to verify that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It defines three levels: Level 1 (15 basic safeguarding requirements from 48 CFR 52.204-21), Level 2 (the 110 security requirements of NIST SP 800-171 Rev 2) and Level 3 (24 enhanced requirements selected from NIST SP 800-172).

ProwlerOfficialBuilt-inVerifiedprowler-compliance-cmmcRun in Prowler Cloud

The Digital Operational Resilience Act (DORA) is a European Union regulation (Regulation (EU) 2022/2554) that sets a uniform framework for the digital operational resilience of the EU financial sector. Mandatory since 17 January 2025, it applies to financial entities (banks, insurers, investment firms, payment institutions, etc.) and to ICT third-party service providers. DORA is structured around five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing. This Prowler mapping covers the technical controls auditable from cloud configuration; the organisational, contractual and supervisory obligations defined in DORA must be addressed outside of Prowler.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-doraRun in Prowler Cloud

The Digital Operational Resilience Act (DORA) is a European Union regulation (Regulation (EU) 2022/2554) that sets a uniform framework for the digital operational resilience of the EU financial sector. Mandatory since 17 January 2025, it applies to financial entities (banks, insurers, investment firms, payment institutions, etc.) and to ICT third-party service providers. DORA is structured around five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing. This Prowler mapping covers the technical controls auditable from cloud configuration; the organisational, contractual and supervisory obligations defined in DORA must be addressed outside of Prowler.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-doraRun in Prowler Cloud

The Digital Operational Resilience Act (DORA) is a European Union regulation (Regulation (EU) 2022/2554) that sets a uniform framework for the digital operational resilience of the EU financial sector. Mandatory since 17 January 2025, it applies to financial entities (banks, insurers, investment firms, payment institutions, etc.) and to ICT third-party service providers. DORA is structured around five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing. This Prowler mapping covers the technical controls auditable from cloud configuration; the organisational, contractual and supervisory obligations defined in DORA must be addressed outside of Prowler.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-doraRun in Prowler Cloud

The Digital Operational Resilience Act (DORA) is a European Union regulation (Regulation (EU) 2022/2554) that sets a uniform framework for the digital operational resilience of the EU financial sector. Mandatory since 17 January 2025, it applies to financial entities (banks, insurers, investment firms, payment institutions, etc.) and to ICT third-party service providers. DORA is structured around five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing. This Prowler mapping covers the technical controls auditable from cloud configuration; the organisational, contractual and supervisory obligations defined in DORA must be addressed outside of Prowler.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-doraRun in Prowler Cloud

The Digital Operational Resilience Act (DORA) is a European Union regulation (Regulation (EU) 2022/2554) that sets a uniform framework for the digital operational resilience of the EU financial sector. Mandatory since 17 January 2025, it applies to financial entities (banks, insurers, investment firms, payment institutions, etc.) and to ICT third-party service providers. DORA is structured around five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing. This Prowler mapping covers the technical controls auditable from cloud configuration; the organisational, contractual and supervisory obligations defined in DORA must be addressed outside of Prowler.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-doraRun in Prowler Cloud

Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) for Okta Identity as a Service (IDaaS), Version 1 Release 2 (Benchmark Date: 05 Jan 2026).

ProwlerOfficialBuilt-inVerifiedprowler-provider-oktaRun in Prowler Cloud

The accreditation scheme of the ENS (National Security Scheme) has been developed by the Ministry of Finance and Public Administrations and the CCN (National Cryptological Center). This includes the basic principles and minimum requirements necessary for the adequate protection of information.

ProwlerOfficialBuilt-inVerifiedprowler-provider-azureRun in Prowler Cloud

The accreditation scheme of the ENS (National Security Scheme) has been developed by the Ministry of Finance and Public Administrations and the CCN (National Cryptological Center). This includes the basic principles and minimum requirements necessary for the adequate protection of information.

ProwlerOfficialBuilt-inVerifiedprowler-provider-awsRun in Prowler Cloud

The accreditation scheme of the ENS (National Security Scheme) has been developed by the Ministry of Finance and Public Administrations and the CCN (National Cryptological Center). This includes the basic principles and minimum requirements necessary for the adequate protection of information.

ProwlerOfficialBuilt-inVerifiedprowler-provider-gcpRun in Prowler Cloud

FedRAMP Rules (FRR) that cloud service providers must follow for a FedRAMP 20x Class C Certification, from the FedRAMP Consolidated Rules for 2026 (release 2026.09.13.02, https://github.com/FedRAMP/rules). Covers the 158 provider rules of the 15 rulesets on the 20x Class C reference page; rules that only bind FedRAMP, agencies, assessors or advisors are excluded, and class-varying rules use their Class C statement. Most rules are program and process obligations that need manual evidence. The Key Security Indicators of the same ruleset are in the fedramp_20x_ksi_2026 framework.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-fedramp-20x-frr-class-cRun in Prowler Cloud

FedRAMP Rules (FRR) that cloud service providers must follow for a FedRAMP 20x Class C Certification, from the FedRAMP Consolidated Rules for 2026 (release 2026.09.13.02, https://github.com/FedRAMP/rules). Covers the 158 provider rules of the 15 rulesets on the 20x Class C reference page; rules that only bind FedRAMP, agencies, assessors or advisors are excluded, and class-varying rules use their Class C statement. Most rules are program and process obligations that need manual evidence. The Key Security Indicators of the same ruleset are in the fedramp_20x_ksi_2026 framework.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-fedramp-20x-frr-class-cRun in Prowler Cloud

FedRAMP Rules (FRR) that cloud service providers must follow for a FedRAMP 20x Class C Certification, from the FedRAMP Consolidated Rules for 2026 (release 2026.09.13.02, https://github.com/FedRAMP/rules). Covers the 158 provider rules of the 15 rulesets on the 20x Class C reference page; rules that only bind FedRAMP, agencies, assessors or advisors are excluded, and class-varying rules use their Class C statement. Most rules are program and process obligations that need manual evidence. The Key Security Indicators of the same ruleset are in the fedramp_20x_ksi_2026 framework.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-fedramp-20x-frr-class-cRun in Prowler Cloud

FedRAMP 20x Key Security Indicators (KSIs) from the FedRAMP Consolidated Rules for 2026 (release 2026.07.14.01, https://github.com/FedRAMP/rules). KSIs are outcome-oriented indicators that cloud service providers must demonstrate through automation and continuous monitoring; they do not replace the FedRAMP Rules (FRR) program obligations. Class A authorizations mandate a subset of seven KSIs via FRC-CLA-MFR; Classes B and C apply the full catalog within the Minimum Assessment Scope, with five indicators optional on Class B and required on Class C.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-fedramp-20x-ksiRun in Prowler Cloud

FedRAMP 20x Key Security Indicators (KSIs) from the FedRAMP Consolidated Rules for 2026 (release 2026.07.14.01, https://github.com/FedRAMP/rules). KSIs are outcome-oriented indicators that cloud service providers must demonstrate through automation and continuous monitoring; they do not replace the FedRAMP Rules (FRR) program obligations. Class A authorizations mandate a subset of seven KSIs via FRC-CLA-MFR; Classes B and C apply the full catalog within the Minimum Assessment Scope, with five indicators optional on Class B and required on Class C.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-fedramp-20x-ksiRun in Prowler Cloud

FedRAMP 20x Key Security Indicators (KSIs) from the FedRAMP Consolidated Rules for 2026 (release 2026.07.14.01, https://github.com/FedRAMP/rules). KSIs are outcome-oriented indicators that cloud service providers must demonstrate through automation and continuous monitoring; they do not replace the FedRAMP Rules (FRR) program obligations. Class A authorizations mandate a subset of seven KSIs via FRC-CLA-MFR; Classes B and C apply the full catalog within the Minimum Assessment Scope, with five indicators optional on Class B and required on Class C.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-fedramp-20x-ksiRun in Prowler Cloud

FedRAMP 20x Key Security Indicators (KSIs) from the FedRAMP Consolidated Rules for 2026 (release 2026.07.14.01, https://github.com/FedRAMP/rules). KSIs are outcome-oriented indicators that cloud service providers must demonstrate through automation and continuous monitoring; they do not replace the FedRAMP Rules (FRR) program obligations. Class A authorizations mandate a subset of seven KSIs via FRC-CLA-MFR; Classes B and C apply the full catalog within the Minimum Assessment Scope, with five indicators optional on Class B and required on Class C.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-fedramp-20x-ksiRun in Prowler Cloud

FedRAMP 20x Key Security Indicators (KSIs) from the FedRAMP Consolidated Rules for 2026 (release 2026.07.14.01, https://github.com/FedRAMP/rules). KSIs are outcome-oriented indicators that cloud service providers must demonstrate through automation and continuous monitoring; they do not replace the FedRAMP Rules (FRR) program obligations. Class A authorizations mandate a subset of seven KSIs via FRC-CLA-MFR; Classes B and C apply the full catalog within the Minimum Assessment Scope, with five indicators optional on Class B and required on Class C.

ProwlerOfficialBuilt-inVerifiedprowler-compliance-fedramp-20x-ksiRun in Prowler Cloud