Payment Card Industry Data Security Standard, PCI DSS, Compliance Standards

Defense Information Systems Agency, DISA, Security Standards

Center for Internet Security, CIS, Security Standards

The supported benchmarks from the provided list are PCI DSS , DISA , and CIS . VCF Operations compliance monitoring is accessed from Security > Compliance , where compliance scorecards are based on alert definitions with the Compliance subtype. The official VCF 9.0 documentation states that Regulatory Benchmarks display benchmarks for industry-standard regulatory compliance requirements and explicitly lists Defense Information Systems Agency (DISA) Security Standards , Payment Card Industry Data Security Standard (PCI DSS) Compliance Standards , and CIS Security Standards as supported regulatory benchmark options. DISA is available as a native pack, PCI DSS is listed as a regulatory compliance standard, and CIS is supported through a compliance pack from VMware Marketplace . FedRAMP and GDPR are not listed in the VCF Operations regulatory benchmark set shown in the guide. NIST is supported only as specific NIST SP 800-171 and NIST SP 800-53 R5 packs, not as the generic “NIST CyberSecurity Framework Security Baseline Standards” option shown in the question . Reference topic: Objective 4.16 – Monitor Security, Compliance and Configuration / Compliance Benchmarks / Regulatory Benchmarks .