STIGQter: STIG Summary: Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 01 Apr 2026:

Images stored within the container registry must contain only images to be run as containers within the container platform.

DISA Rule

SV-253533r960963_rule

Vulnerability Number

V-253533

Group Title

SRG-APP-000141-CTR-000320

Rule Version

CNTR-PC-000480

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.
• CCI-001774 - Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system.

Weight

10

Fix Recommendation

Navigate to Prisma Cloud Compute Console's >> Defend >> Compliance >> Trusted Images tab.

Select the "Trust groups" tab.

Create a trusted group:
- Click "Add Group".
Name: "IronBank"
- Specify a registry or repository: https://ironbank.dso.mil
- Click "Add to group".
- Specify a registry or repository: https://registry1.dso.mil/
(There are two group images total.)
- Click "Save".

Select the "Policy" tab.

Set the Trusted Images Rules to "on".

If a rule does not exist:
- Click "Add rule".
Rule name = "IronBank"
Scope = "All"

Allowed:
- Click "Select groups".
- Select "IronBank".
- Click "Apply".
- Keep all defaults and click "Save".

Enable policy:
- Click the "Default - alert all components" policy three-dot menu.
- Set to "Enable".

Policy row scope:
- Click the policy rows.
- Change the policy scope to all images and containers within the intended monitored environment.
- Click "Save".

Check Contents

Navigate to Prisma Cloud Compute Console's >> Defend >> Compliance Trusted Images tab.

Select the "Trust groups" tab.
If there is no Group, this is a finding.

Select the "Policy" tab.
If the Trusted Images Rules is set to "off", this is a finding.

If a rule does not exist, this is a finding.

Click the three dots in the "Actions" column for rule.
If the policy is disabled, this is a finding.

Click the policy row.
If the policy is not scoped to "All", this is a finding.

Vulnerability Number

V-253533

Documentable

False

Rule Version

CNTR-PC-000480

Severity Override Guidance

Navigate to Prisma Cloud Compute Console's >> Defend >> Compliance Trusted Images tab.

Select the "Trust groups" tab.
If there is no Group, this is a finding.

Select the "Policy" tab.
If the Trusted Images Rules is set to "off", this is a finding.

If a rule does not exist, this is a finding.

Click the three dots in the "Actions" column for rule.
If the policy is disabled, this is a finding.

Click the policy row.
If the policy is not scoped to "All", this is a finding.

Check Content Reference

M

Target Key

5473