[Assured Workloads](https://docs.cloud.google.com/assured-workloads/docs/overview) helps ensure that
your Google Cloud Armor deployments across your organization are configured in
a compliant manner. You create a folder that contains the projects in which you
want to maintain compliance, and then apply one or more
[control packages](https://docs.cloud.google.com/assured-workloads/docs/control-packages) to that folder to
enforce those controls across all of those projects. This document explains what
control packages you can apply to Cloud Armor resources, and highlights
what resources aren't supported by Assured Workloads.

## Maintain compliance through Assured Workloads

Cloud Armor can be deployed in configurations which satisfy a variety
of global, country specific, or industry specific compliance frameworks. A
comprehensive list of supported compliance offerings across Google Cloud and
whether Cloud Armor is in scope for them can be found in our
[Compliance Offerings](https://cloud.google.com/security/compliance/offerings).

## Control packages by security policy type

The following table explains what control packages are available for each
[security policy type](https://docs.cloud.google.com/armor/docs/security-policy-overview#policy-types). For
more information about these control packages and to search for the control
packages that support Cloud Armor, see
[supported products by control package](https://docs.cloud.google.com/assured-workloads/docs/supported-products).

| Control package | Global backend security policy | Edge security policy | Regional backend security policy | Network edge security policy |
|---|---|---|---|---|
| Criminal Justice Information Systems (CJIS) |   |   | Yes | Yes |
| FedRAMP High |   |   | Yes | Under [JAB review](https://cloud.google.com/security/compliance/fedramp#services-in-scope) |
| FedRAMP Moderate | Yes | Yes | Yes | Under [JAB review](https://cloud.google.com/security/compliance/fedramp#services-in-scope) |
| Healthcare and Life Sciences Controls |   |   |   |   |
| Healthcare and Life Sciences Controls with US support |   |   |   |   |
| Impact Level 2 (IL2) | Yes | Yes | Yes |   |
| Impact Level 4 (IL4) |   |   |   |   |
| Impact Level 5 (IL5) |   |   |   |   |
| International Traffic in Arms Regulations (ITAR) |   |   | Yes | Yes |
| IRS Publication 1075 |   |   |   |   |
| Regions where Cloud Armor is [listed](https://docs.cloud.google.com/assured-workloads/docs/supported-products) |   |   | Yes | Yes |
| Regions and Support where Cloud Armor is [listed](https://docs.cloud.google.com/assured-workloads/docs/supported-products) |   |   | Yes | Yes |
| Sovereign Controls for EU |   |   | Yes | Yes |
| Sovereign Controls for the Kingdom of Saudi Arabia |   |   | Yes | Yes |