--- title: "Extend Enterprise Security Controls to Kubernetes" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/tigera-products/security-controls/" description: "Meet regulatory compliance requirements for container workloads by extending your existing enterprise security controls to your Kubernetes environment." --- Solution # Extend Enterprise Security Controls to Kubernetes Meet regulatory and corporate compliance requirements for container workloads by extending your existing enterprise security controls to your Kubernetes environment [Start Free](https://www.calicocloud.io/) [Get a Demo](https://www.tigera.io/demo/) ![AuditCompliance_short](https://embed-ssl.wistia.com/deliveries/e676a5a1bc5d2bbd240430047ea3b0c5.jpg?image_crop_resized=612x344) ## Benefits ![Two overlapping blue parallelograms](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/05/Icon-1.png) ### Automate and Simplify Automates and simplifies compliance monitoring, enforcement, and audit by tracking all policy changes and retaining a daily history of your compliance status. ### Audit and Report Enables you to easily access audit reports showing the network security rules in place, in order to demonstrate proof of compliance for your security team and auditors. ### Maintain Compliance Helps DevSecOps teams maintain the security posture needed to meet compliance requirements mandated by legislation or your own internal security team, helping you to get to production faster. ## Trusted by Customers Worldwide [![Orange logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Orange.png)](http://www.orange.com/en) [![Siemens Healthineers logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/logo-siemens-healthineers.png)](https://www.siemens-healthineers.com/) [![RBC logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-RBC.png)](https://www.rbcroyalbank.com/) [![Marsh McLennan logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Marsh-and-McLennan.png)](http://www.mmc.com/) [![Nowcom logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-NOWCOM.png)](http://www.nowcom.com/) [![Presidio logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Presidio.png)](https://www.presidio.com/) [![Box logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-box.png)](http://www.box.com/home) [![Nvidia logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Nvidia.png)](https://www.nvidia.com/) [![FM Global logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/03/logo-FM-Global.png)](https://www.fmglobal.com/) [![Upwork logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/12/logo-upwork.png)](https://www.upwork.com/) [![Essentra logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/04/logo-Essentra.png)](https://www.essentra.com/en) [![GoDaddy logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/03/logo-GoDaddy.png)](https://www.godaddy.com/) [![Arvato Systems logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/01/logo-Arvato-systems.png)](https://www.arvato-systems.com/) [![Aldagi logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/10/logo-aldagi.png)](https://aldagi.ge/en/) [![NBC Universal logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/logo-NBC-Universal.png)](https://www.nbcuniversal.com/) [![Chipotle logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Chipotle.png)](https://www.chipotle.com/) [![Meridianlink logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Meridianlink.png)](http://www.meridianlink.com/) [![Mulligan Funding logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-MulliganFunding.png)](https://www.mulliganfunding.com/) [![HanseMerkur logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-HanseMerkur.png)](http://www.hmrv.de/en) [![Fiserv logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/12/logo-fiserv.png)](https://www.fiserv.com/) [![Berenberg logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-BERENBERG.png)](http://www.berenberg.de/en/) [![eHealth logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/10/logo-eHealth.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/ehealth-case-study/) [![Coinmetrics logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-coinmetrics.png)](http://coinmetrics.io/) ## Key Features ![Calico Encryption](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/calico-encryption.png) ### Encryption Several regulatory standards impose data protection and compliance requirements on organizations and specify the use of encryption, including PCI, SOX, HIPAA, and GDPR. Encrypting traffic using a standard approach like TLS, for example, requires SSL certificates and results in more complexity and operational overhead for IT organizations that are already overburdened. Calico avoids unnecessary complexity by utilizing WireGuard to implement data-in-transit encryption. WireGuard runs as a module inside the Linux kernel and provides better performance and lower CPU utilization than IPsec and OpenVPN tunneling protocols. Independent [benchmark tests of Kubernetes CNI’s](https://itnext.io/benchmark-results-of-kubernetes-network-plugins-cni-over-10gbit-s-network-updated-august-2020-6e1b757b9e49) have shown that Calico with encryption enabled is 6x faster than any other solution in the market. And with Calico, you’ll maintain visibility into all traffic in your Kubernetes clusters even when encryption is deployed. ### Policy Tiers Calico introduces the concept of policy tiers. Policy tiers define the order in which security policies are evaluated. Higher tiers evaluate traffic first. This is where you define and implement your security controls. Policy tiers can federate across multiple clusters using [unified control](https://www.tigera.io/tigera-products/multi-cloud-security/), enabling a single definition of security controls that can be applied to all clusters. If the traffic complies with the security controls then it is evaluated by the lower tiers. ![A dashboard displays a list of system and network alerts with details.](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/Extend-Enterprise-Security-Controls-to-Kubernetes-Monitoring-and-Alerting.png) ### Monitoring and Alerting How would you know if someone changed your security policies? Calico monitors and logs all changes to policies, including the version history. When a policy that implements your security controls changes, you will be alerted of the change. The change history shows exactly what changed and is the first step in providing security forensics that provide a record identifying what happened and how. ![View Policy Screenshot](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/View-Policy-4.png) ### Policy View When the security team asks to see the corporate security controls you implemented, showing them YAML files is not going to work. Calico includes a web-based GUI that visually describes the security controls in place in an easy-to-understand policy view. ![Compliance Reports Screenshot](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/Compliance-Reports-03.png) ### Compliance Reports The next thing the security team will want to know is which workloads are covered by the security controls and which ones are not? Compliance reports show all workloads that are in-scope and out-of-scope with your policy. ![Audit log interface displaying filtered deletion events by kubernetes-admin.](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/Timeline-Compliance-Reports-Audit.png) ### Audit Finally, the security team will need to ensure that the policies haven’t been tampered with. For example, a policy may have recently changed for two hours, allowing the controls to be violated. Calico tracks all changes to policies and maintains a version history of those changes. With all of this in place, you should be able to ace your next security audit! ## How It Works? ![Compliance explainer](https://embed-ssl.wistia.com/deliveries/f4872abecc750baf83f76a7d92b22abdaa01e04d.jpg?image_crop_resized=1184x666) ## Available on Microsoft Azure, AWS, and Google Marketplace Get started right away on Azure, AWS, or Google Cloud—every Calico component you need to get up and running is ready to go. [On Azure](https://azuremarketplace.microsoft.com/en-ca/marketplace/apps/tigerainc1620235671643.calicocloudsaas?tab=overview) [On AWS](https://aws.amazon.com/marketplace/pp/prodview-pq3tgvtlj3wce) [On Google Cloud](https://console.cloud.google.com/marketplace/product/tigera-public/calico-cloud?inv=1&invt=Ab27_g&project=tigera-public) ![Microsoft Azure, AWS, and Google Cloud logos.](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/07/Solution-cloud-marketplace-AWS-Azure-03.svg) ## Resources ![Solving Microservices Connectivity Issues with Network Logs](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2020/10/Solving-Microservices-Connectivity-Issues-with-Network-Logs.png) Blog ### Solving Microservices Connectivity Issues with Network Logs DevOps, SecOps, Network and Platform teams can use network logs to address use cases that apply within their respective domains. [Learn More](https://www.tigera.io/blog/solving-microservices-connectivity-issues-with-network-logs/) ![PCI Compliance for Hosts, VMs, Containers and Kubernetes](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/07/white-paper-PCI-1200x628-2.png) White Paper ### PCI Compliance for Hosts, VMs, Containers and Kubernetes Implement controls, mitigate known risks, and successfully meet Kubernetes PCI compliance requirements with our step-by-step guide. [Learn More](https://www.tigera.io/lp/kubernetes-pci-compliance/) ![Introduction to Kubernetes Networking and Security](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/05/Calico-Enterprise-Tigera-1200x628-1.png) Documentation ### Introduction to Kubernetes Networking and Security Read our docs and see how you can kickstart your Kubernetes journey with Calico Enterprise. [Read More](https://docs.tigera.io/calico-enterprise/latest/about/) ![Calico Logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/01/Calico-logo-2026-black-text.svg) ## Ready to Get Started? Get started for free or request a demo to see Calico in action [Start Free](https://www.calicocloud.io/) [Get a Demo](https://wordpress-1075849-4005834.cloudwaysapps.com/demo/)