Policy Packs
Policy packs are pre-built policies that map to common regulatory frameworks. Each pack ships as a complete bundle of rule sets, mappings, and allowlists, ready to import, customize, and activate against your account.
The Secure pack ships with every Anchore Enterprise deployment. The remaining packs require additional license entitlements:
| Pack | Frameworks covered | Entitlement |
|---|---|---|
| Secure | Anchore Enterprise’s default checks: feed data currency, critical-severity and KEV-listed vulnerabilities, and fixable low, medium, and high vulnerabilities | Included with every deployment |
| NIST | NIST 800-53 and NIST 800-190 (Application Container Security Guide) | Anchore Enforce |
| CIS | CIS Docker Benchmark | Anchore Enforce |
| FedRAMP | FedRAMP Rev 5 (NIST 800-53 Rev 5, NIST 800-190) and FedRAMP 20x Class C Key Security Indicators | Anchore Enforce plus the FedRAMP add-on |
| DoD | DISA Image Creation and Deployment Guide, IronBank requirements | Anchore Enforce plus the DoD add-on |
| CMMC | CMMC compliance via NIST 800-171r3 controls | Anchore Enforce |
| ASD Essential 8 | Australian Signals Directorate (ASD) Essential Eight, Maturity Levels 1–3 | Anchore Enforce |
| PCI DSS | PCI DSS v4.0.1 requirement 11.3.1 (internal vulnerability scanning) | Anchore Enforce |
| EU CRA | EU Cyber Resilience Act, Annex I Part I (no known exploitable vulnerabilities) | Anchore Enforce |
The NIST SSDF sub-pack covers the Secure Software Development Framework (NIST SP 800-218); see the NIST page for how it relates to the broader NIST pack.
Use a Pack
Each pack page covers the same workflow: download the bundle, import it into Anchore Enterprise, activate it, and adjust its mappings or allowlists for your environment. The mechanics are the same as for any policy: anchorectl policy add, the GUI’s Import action, and the POST /policies endpoint. See Manage Policies for the general CRUD workflow.
Most packs are VEX-aware: their vulnerability rule sets act on the annotation recorded for each finding, so a vulnerability assessed as not_affected or fixed drops out of the evaluation while un-triaged findings keep counting. See Annotations and VEX for how the statuses work and what they produce downstream.
Packs are a starting point, not a final shape. Most teams customize the pack they import before activating the result as the account’s default policy: adjusting mappings to scope the pack to specific registries or repositories, attaching allowlists for known false positives, or layering additional rule sets on top.
Last modified September 22, 2026