Correct pre-built policy pack coverage, and enforce the allowlist against the registry

content/docs/administration/get-started/setting-up-for-success.md

@@ -22,7 +22,7 @@ Security is a team effort that's best established from the outset. Pulumi Cloud
 
 Modern enterprises face rigorous compliance requirements. Pulumi Cloud is SOC 2 Type II certified and AWS-reviewed for compliance best practices. The infrastructure hosting Pulumi Cloud aligns with IT security standards including SOC 1/SSAE 16/ISAE 3402, SOC 2, SOC 3, FISMA, FedRAMP, DOD SRG Levels 2 and 4, PCI DSS Level 1, EU Model Clauses, ISO 9001/27001/27017/27018, ITAR, IRAP, FIPS 140-2, MLPS Level 3, and MTCS. Learn more at [Pulumi Security](/security/).
 
-Use Pulumi's Policy as Code engine, [Pulumi Policies](/docs/insights/policy/), to enforce compliant infrastructure practices. Pulumi Policies includes hundreds of out-of-the-box policies for AWS, Azure, Google Cloud, and Kubernetes, spanning CIS, HITRUST, NIST, and PCI DSS. You can also write custom policies for your specific industry or enterprise requirements.
+Use Pulumi's Policy as Code engine, [Pulumi Policies](/docs/insights/policy/), to enforce compliant infrastructure practices. Pulumi Policies includes hundreds of out-of-the-box policies for AWS, Azure, Google Cloud, and Kubernetes, spanning CIS, HITRUST, NIST, PCI DSS, ISO 27001, and CMMC. You can also write custom policies for your specific industry or enterprise requirements.
 
 Pulumi Policies identifies issues in existing cloud infrastructure and prevents new problems from being introduced. Configure it at warning or error levels, and apply it flexibly across projects—for example, GDPR rules might only apply to infrastructure in European regions. Pulumi Policies also features automatic remediations.
 

content/docs/insights/_index.md

@@ -70,7 +70,7 @@ sections:
   - icon: package
     heading: Pre-built Policy Packs
     link: /docs/insights/policy/policy-packs/pre-built-packs/
-    description: Use ready-made compliance rules for CIS, HITRUST, NIST, and PCI DSS with no code required.
+    description: Use ready-made compliance rules for CIS, HITRUST, NIST, PCI DSS, ISO 27001, and CMMC with no code required.
   - icon: arrows-clockwise
     heading: Policy Groups
     link: /docs/insights/policy/policy-groups/

content/docs/insights/policy/_index.md

@@ -52,7 +52,7 @@ Policy as Code is implemented via [analyzer plugins](/docs/iac/concepts/plugins/
 Pulumi Policies uses a hierarchy of components to enforce compliance rules:
 
 1. **Policies** are individual rules that validate infrastructure configuration (e.g., "S3 buckets must be private" or "VMs must use approved instance types").
-1. **Policy packs** are versioned collections of related policies that you publish and manage together. You can use [pre-built policy packs](/docs/insights/policy/policy-packs/pre-built-packs/) for common compliance frameworks (CIS, HITRUST, NIST, and PCI DSS) or [write custom packs](/docs/insights/policy/policy-packs/authoring/) in TypeScript, JavaScript, Python, or [OPA (Rego)](/docs/insights/policy/policy-packs/authoring/#opa).
+1. **Policy packs** are versioned collections of related policies that you publish and manage together. You can use [pre-built policy packs](/docs/insights/policy/policy-packs/pre-built-packs/) for common compliance frameworks (CIS, HITRUST, ISO 27001, NIST, PCI DSS, and CMMC) or [write custom packs](/docs/insights/policy/policy-packs/authoring/) in TypeScript, JavaScript, Python, or [OPA (Rego)](/docs/insights/policy/policy-packs/authoring/#opa).
 1. **Policy groups** apply policy packs to specific stacks or cloud accounts. This lets you enforce stricter policies in production and more permissive policies in development environments. Learn more about [policy groups](/docs/insights/policy/policy-groups/).
 
 ### Enforcement modes
@@ -115,7 +115,7 @@ Policies can be written in TypeScript/JavaScript (Node.js), Python, or OPA (Rego
 Choose your path based on your needs:
 
 - **New to Pulumi Policies?** Start with the [Get Started guide](/docs/insights/policy/get-started/) to configure your first policy group and apply policies to stacks or cloud accounts.
-- **Want ready-made compliance rules?** Browse [pre-built policy packs](/docs/insights/policy/policy-packs/pre-built-packs/) for CIS, PCI DSS, HITRUST, NIST, and other frameworks. Enable them directly from Pulumi Cloud with no code required.
+- **Want ready-made compliance rules?** Browse [pre-built policy packs](/docs/insights/policy/policy-packs/pre-built-packs/) for CIS, PCI DSS, HITRUST, NIST, ISO 27001, CMMC, and other frameworks. Enable them directly from Pulumi Cloud with no code required.
 - **Need custom policies?** Learn to [write custom policy packs](/docs/insights/policy/policy-packs/authoring/) in TypeScript, JavaScript, Python, or OPA (Rego). Create organization-specific rules tailored to your requirements.
 - **Managing compliance?** View violations and track remediation progress in [Policy Findings](/docs/insights/policy/policy-findings/). Triage issues, assign owners, and monitor compliance trends across your organization.
 - **Configuring discovered resources?** Visit the [Discovery Get Started tutorial](/docs/insights/discovery/get-started/) for a detailed guide on audit policies for cloud resources discovered outside Pulumi.

content/docs/insights/policy/policy-packs/_index.md

@@ -24,7 +24,7 @@ A pack does nothing on its own. To enforce it, add it to a [policy group](/docs/
 
 ## Types of policy packs
 
-- <a id="pre-built-policy-packs"></a>**[Pre-built policy packs](/docs/insights/policy/policy-packs/pre-built-packs/)** are written and maintained by Pulumi. They cover common compliance frameworks, including CIS, PCI DSS, HITRUST, and NIST, as well as security, cost, and operational best practices for AWS, Azure, and Google Cloud. You enable them from Pulumi Cloud without writing any code.
+- <a id="pre-built-policy-packs"></a>**[Pre-built policy packs](/docs/insights/policy/policy-packs/pre-built-packs/)** are written and maintained by Pulumi. They cover common compliance frameworks, including CIS, PCI DSS, HITRUST, NIST, ISO 27001, and CMMC, as well as security, cost, and operational best practices for AWS, Azure, and Google Cloud. You enable them from Pulumi Cloud without writing any code.
 
 - <a id="custom-policy-packs"></a>**[Custom policy packs](/docs/insights/policy/policy-packs/authoring/)** are the ones you write yourself, in TypeScript, Python, or [OPA (Rego)](/docs/insights/policy/policy-packs/authoring/#opa), to enforce requirements specific to your organization. You can test a custom pack locally with `pulumi preview --policy-pack` before publishing it to Pulumi Cloud.
 

content/docs/insights/policy/policy-packs/pre-built-packs.md

@@ -36,10 +36,11 @@ The following pre-built policy packs are available out of the box in Pulumi Clou
 | ----- | ----- | ----- |
 | **CIS 8.1** | [AWS](/docs/reference/pre-built-policy-packs/cis/aws/), [Azure](/docs/reference/pre-built-policy-packs/cis/azure/), [Google Cloud](/docs/reference/pre-built-policy-packs/cis/google-cloud/) | Enforces CIS 8.1 controls to help organizations implement industry-recognized security best practices and benchmarks across multiple cloud providers. |
 | **CIS Kubernetes** | [AWS (EKS)](/docs/reference/pre-built-policy-packs/cis-kubernetes/aws/), [Azure (AKS)](/docs/reference/pre-built-policy-packs/cis-kubernetes/azure/), [Google Cloud (GKE)](/docs/reference/pre-built-policy-packs/cis-kubernetes/google-cloud/) | Enforces CIS Kubernetes Benchmark controls for managed Kubernetes services, helping organizations secure their container orchestration platforms with industry-recognized best practices. |
+| **CMMC 2.0** | [AWS](/docs/reference/pre-built-policy-packs/cmmc/aws/) | Enforces CMMC 2.0 practices for AWS resources, helping defense-industrial-base organizations meet Department of Defense cybersecurity maturity requirements. |
 | **HITRUST CSF 11.5** | [AWS](/docs/reference/pre-built-policy-packs/hitrust/aws/), [Azure](/docs/reference/pre-built-policy-packs/hitrust/azure/), [Google Cloud](/docs/reference/pre-built-policy-packs/hitrust/google-cloud/) | Provides predefined controls that align cloud resources with HITRUST CSF requirements, helping organizations enforce security and compliance baselines across multiple providers. |
-| **ISO/IEC 27001:2022** | [AWS](/docs/reference/pre-built-policy-packs/iso-27001/aws/) | Enforces ISO/IEC 27001:2022 Annex A controls for AWS resources, helping organizations align their cloud infrastructure with the international standard for information security management. |
-| **NIST SP 800-53** | [AWS](/docs/reference/pre-built-policy-packs/nist/aws/), [Google Cloud](/docs/reference/pre-built-policy-packs/nist/google-cloud/) | Enforces NIST SP 800-53 rev. 5 security and privacy controls for AWS and Google Cloud resources, helping federal agencies and organizations meet rigorous compliance requirements. |
-| **PCI DSS v4.0.1** | [AWS](/docs/reference/pre-built-policy-packs/pci-dss/aws/) | Enforces PCI DSS v4.0.1 compliance controls for AWS resources, ensuring payment card data security and helping organizations meet payment card industry standards. |
+| **ISO/IEC 27001:2022** | [AWS](/docs/reference/pre-built-policy-packs/iso-27001/aws/), [Azure](/docs/reference/pre-built-policy-packs/iso-27001/azure/), [Google Cloud](/docs/reference/pre-built-policy-packs/iso-27001/google-cloud/) | Enforces ISO/IEC 27001:2022 Annex A controls across multiple cloud providers, helping organizations align their cloud infrastructure with the international standard for information security management. |
+| **NIST SP 800-53** | [AWS](/docs/reference/pre-built-policy-packs/nist/aws/), [Azure](/docs/reference/pre-built-policy-packs/nist/azure/), [Google Cloud](/docs/reference/pre-built-policy-packs/nist/google-cloud/) | Enforces NIST SP 800-53 rev. 5 security and privacy controls across multiple cloud providers, helping federal agencies and organizations meet rigorous compliance requirements. |
+| **PCI DSS v4.0.1** | [AWS](/docs/reference/pre-built-policy-packs/pci-dss/aws/), [Azure](/docs/reference/pre-built-policy-packs/pci-dss/azure/), [Google Cloud](/docs/reference/pre-built-policy-packs/pci-dss/google-cloud/) | Enforces PCI DSS v4.0.1 compliance controls across multiple cloud providers, ensuring payment card data security and helping organizations meet payment card industry standards. |
 | **Pulumi Best Practices** | [AWS](/docs/reference/pre-built-policy-packs/pulumi-best-practices/aws/), [Azure](/docs/reference/pre-built-policy-packs/pulumi-best-practices/azure/), [Google Cloud](/docs/reference/pre-built-policy-packs/pulumi-best-practices/google-cloud/) | Offers a foundational set of recommended governance and security controls, serving as a strong starting point for organizations seeking comprehensive security coverage. |
 | **AWS Organizations Tag Policies** | [AWS and AWS-Native](/docs/reference/pre-built-policy-packs/aws-organizations-tag-policies/aws/) | Integrates with AWS Organizations Tag Policies to validate that infrastructure as code resources have required tags before deployment. [Learn more](/docs/insights/policy/integrations/aws-organizations-tag-policies/). |
 

content/docs/integrations/clouds/aws/_index.md

@@ -89,6 +89,8 @@ For AWS:
 - [NIST 800-53 for AWS](/docs/reference/pre-built-policy-packs/nist/aws/)
 - [PCI DSS for AWS](/docs/reference/pre-built-policy-packs/pci-dss/aws/)
 - [HITRUST CSF for AWS](/docs/reference/pre-built-policy-packs/hitrust/aws/)
+- [ISO/IEC 27001 for AWS](/docs/reference/pre-built-policy-packs/iso-27001/aws/)
+- [CMMC 2.0 for AWS](/docs/reference/pre-built-policy-packs/cmmc/aws/)
 - [CIS Kubernetes Benchmark on AWS](/docs/reference/pre-built-policy-packs/cis-kubernetes/aws/) — for EKS clusters.
 - [AWS Organizations Tag Policies](/docs/reference/pre-built-policy-packs/aws-organizations-tag-policies/aws/) — enforce Organizations tagging standards on Pulumi-managed resources.
 - [AWS Organizations Tag Policies in Insights](/docs/insights/policy/integrations/aws-organizations-tag-policies/) — integration with Pulumi Insights.

content/docs/integrations/clouds/azure/_index.md

@@ -77,7 +77,10 @@ For Azure:
 
 - [Pulumi best practices for Azure](/docs/reference/pre-built-policy-packs/pulumi-best-practices/azure/) — Pulumi-authored policies for common Azure misconfigurations.
 - [CIS Microsoft Azure Foundations Benchmark](/docs/reference/pre-built-policy-packs/cis/azure/)
+- [NIST 800-53 for Azure](/docs/reference/pre-built-policy-packs/nist/azure/)
+- [PCI DSS for Azure](/docs/reference/pre-built-policy-packs/pci-dss/azure/)
 - [HITRUST CSF for Azure](/docs/reference/pre-built-policy-packs/hitrust/azure/)
+- [ISO/IEC 27001 for Azure](/docs/reference/pre-built-policy-packs/iso-27001/azure/)
 - [CIS Kubernetes Benchmark on Azure](/docs/reference/pre-built-policy-packs/cis-kubernetes/azure/) — for AKS clusters.
 
 ## Migration

content/docs/integrations/clouds/gcp/_index.md

@@ -72,7 +72,10 @@ For Google Cloud:
 
 - [Pulumi best practices for Google Cloud](/docs/reference/pre-built-policy-packs/pulumi-best-practices/google-cloud/) — Pulumi-authored policies for common Google Cloud misconfigurations.
 - [CIS Google Cloud Platform Foundations Benchmark](/docs/reference/pre-built-policy-packs/cis/google-cloud/)
+- [NIST 800-53 for Google Cloud](/docs/reference/pre-built-policy-packs/nist/google-cloud/)
+- [PCI DSS for Google Cloud](/docs/reference/pre-built-policy-packs/pci-dss/google-cloud/)
 - [HITRUST CSF for Google Cloud](/docs/reference/pre-built-policy-packs/hitrust/google-cloud/)
+- [ISO/IEC 27001 for Google Cloud](/docs/reference/pre-built-policy-packs/iso-27001/google-cloud/)
 - [CIS Kubernetes Benchmark on Google Cloud](/docs/reference/pre-built-policy-packs/cis-kubernetes/google-cloud/) — for GKE clusters.
 
 ## Migration

data/policy_pack_lastmod.json

@@ -14,7 +14,6 @@
     "cis-kubernetes-gcp": "2026-07-16",
     "cmmc-aws": "2026-07-16",
     "hitrust-aws": "2026-07-16",
-    "hitrust-awsnative": "2026-07-16",
     "hitrust-azure": "2026-07-16",
     "hitrust-google-cloud": "2026-07-16",
     "iso-27001-aws": "2026-07-16",