2.3.2. Regulatory Compliance and Security Controls in Defender for Cloud
💡 First Principle: Individual policies are the building blocks; a regulatory compliance standard (like ISO 27001, NIST, or PCI DSS) is a pre-built collection of those blocks mapped to a named external framework, letting you evaluate your entire environment against that framework in one dashboard instead of manually cross-referencing hundreds of controls yourself.
The regulatory compliance dashboard in Defender for Cloud shows your current compliance posture against whichever standards you've assigned, broken down control by control, each backed by the underlying Azure Policy initiative doing the actual evaluation. Separately, security standards and recommendations in Defender for Cloud (built on the Microsoft Cloud Security Benchmark by default) drive your secure score — a single number summarizing how well-hardened your environment is, independent of any specific external regulatory framework.
⚠️ Exam Trap: Secure score and regulatory compliance percentage are related but not the same metric — secure score reflects Microsoft's general security benchmark, while a compliance standard's score reflects that specific framework's control set. A resource can improve one without moving the other if the two frameworks don't overlap on that particular control.
Reflection Question: An auditor asks specifically about PCI DSS compliance status. Would you point them to secure score or the regulatory compliance dashboard, and why does the distinction matter?
