In Micro soft Defender for Cloud, regulatory compliance standards such as PCI DSS 4.0 , ISO 27001 , and NIST SP 800-53 are part of the Cloud Security Posture Management (CSPM) capabilities. To assign or view these regulatory initiatives, the CSPM plan must first be e nabled for the environment.
According to Microsoft Defender for Cloud documentation, when you open Environment settings # Security policy , you can view and manage the assigned initiatives. If the option to "Add more industry and regulatory standards" is gr ayed out or unavailable , it means that the CSPM plan is not active for that subscription.
Once you enable the Defender CSPM plan , Defender for Cloud automatically assigns the Microsoft Cloud Security Benchmark (MCSB) initiative and allows you to add additi onal frameworks such as PCI DSS 4.0, NIST, or SOC 2.
* Option A (Correct) - Enabling CSPM unlocks regulatory compliance capabilities, allowing you to assign the PCI DSS 4.0 initiative.
* Option B - Disabling MCSB is unnecessary and not required; it's automatically included when CSPM is enabled.
* Options C and D - Continuous export settings (to Event Hubs or Log Analytics) are used for exporting data, not enabling compliance initiatives.
Hence, the first step to make the "Add more standards" option avail able is to enable the Cloud Security Posture Management (CSPM) plan on the subscription.