update

Author: msmbaldwin

articles/payment-hsm/certification-compliance.md

@@ -14,11 +14,31 @@ ms.author: mbaldwin
 
 # Certification and compliance
 
-The Azure Payment HSM service is PCI PIN, PCI DSS, and PCI 3DS compliant.
+Azure maintains the largest compliance portfolio in the industry. For details, see [Microsoft Azure Compliance Offerings](https://azure.microsoft.com/en-us/resources/microsoft-azure-compliance-offerings/), Each offering description provides an up to-date-scope statement and links to useful downloadable resources.
 
-- [Azure - PCI PIN - 2022 Package](https://servicetrust.microsoft.com/ViewPage/MSComplianceGuideV3?command=Download&downloadType=Document&downloadId=52eb9daa-f254-4914-aec6-46d40287a106) – Microsoft Azure PCI PIN Attestation of Compliance (AOC) report for Azure Payment HSM.
-- [Azure - PCI DSS - 2022 Package](https://servicetrust.microsoft.com/ViewPage/MSComplianceGuideV3?command=Download&downloadType=Document&downloadId=b9cc20e0-38db-4953-aa58-9fb5cce26cc2&tab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb&docTab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb_PCI_DSS) – Contains the official PCI DSS certification reports and shared responsibility matrices. The PCI DSS AOC includes the full list of PCI DSS certified Azure offerings and regions. Customers can use Azure's PCI DSS AOC during their PCI DSS assessment.
-- [Azure - PCI 3DS - 2022 Package](https://servicetrust.microsoft.com/ViewPage/MSComplianceGuideV3?command=Download&downloadType=Document&downloadId=45ade37c-753c-4392-8321-adc49ecad12c&tab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb&docTab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb_PCI_DSS) – Contains the official PCI 3DS certification report, shared responsibility matrix, and whitepaper. The PCI 3DS AOC includes the full list of PCI 3DS certified Azure offerings and regions. Customers can use Azure’s PCI 3DS AOC during their PCI 3DS assessment.
+Azure payment HSM meets following compliance standards:
+
+- PCI DSS
+- PCI PIN
+- PCI 3DS
+- CSA STAR Certification
+- CSA STAR Attestation
+- ISO 20000-1:2018
+- ISO 22301:2019
+- ISO 27001:2013
+- ISO 27017:2015
+- ISO 27018:2019
+- ISO 27701:2019
+- ISO 9001:2015
+- SOC 1, 2, 3
+- Germany C5
+
+To download latest certification and attestation reports, please go to [Service Trust Portal Home Page (microsoft.com)](https://servicetrust.microsoft.com/ViewPage/HomePageVNext)
+
+For example, the latest PCI certification reports and shared responsibility matrices are:
+- [Azure PCI PIN V3.1](https://servicetrust.microsoft.com/DocumentPage/52eb9daa-f254-4914-aec6-46d40287a106) (2022-09-16)
+- [Azure PCI DSS V4.0](https://servicetrust.microsoft.com/DocumentPage/3be58cb9-de55-426b-9c3d-0ba90dd29572) (2023-03-07)
+- [Azure PCI 3DS V1.0](https://servicetrust.microsoft.com/DocumentPage/a9fe4984-3c73-4abf-bf88-a197c3821690) (2023-03-07)
 
 Thales payShield 10K HSMs are certified to FIPS 140-2 Level 3 and PCI HSM v3.
 

articles/payment-hsm/deployment-scenarios.md

@@ -38,6 +38,19 @@ For High Availability, customer must allocate HSMs between stamp 1 and stamp 2 (
 
 This scenario caters to regional-level failure. The usual strategy is to completely switch the application stack (and its HSMs), rather than trying to reach an HSM in Region 2 from application in Region 1 due to latency.
 
+## fastpathenabled
+
+The fastpathenabled tag is an Azure Feature Exposure Control (AFEC) flag, which will enable subscriptions to connect to Payment HSM.
+
+The fastpathenabled tag must be added/registered to all subscriptions that connect to Payment HSM. Enabling the fastpathenabled tag on the subscriptions with existing resources will have **no** impact on the existing resources. Follow the steps outlined in Register the [Azure Payment HSM resource providers](register-payment-hsm-resource-providers.md?tabs=azure-cli).
+
+> [!NOTE]
+> If you have multiple subscriptions that require access to a Payment HSM, contact [Mirosoft support](support-guide.md#microsoft-support) to have all subscription IDs enabled.
+
+The fastpathenabled tag must be enabled on any virtual networks that the Payment HSM uses, peered or otherwise. For instance, to peer a virtual network of a payment HSM with a virtual network of a VM, you must first add the fastpathenabled tag to the latter. Unfortunately, adding the fastpathenabled tag through the Azure portal is insufficient -- it must be done from the commandline. To o so, follow the steps outlined in [How to peer Azure Payment HSM virtual networks](peer-vnets.md?tabs=azure-cli)
+
+For an MNAT scenario, ensure that you add the fastpathenabled tag with a value of `True` when creating the NAT gateway (not after the NAT gateway is created).
+
 ## Next steps
 
 - Learn more about [Azure Payment HSM](overview.md)