diff --git a/content/en/policies/pod-security-cel/baseline/disallow-privileged-containers/disallow-privileged-containers.md b/content/en/policies/pod-security-cel/baseline/disallow-privileged-containers/disallow-privileged-containers.md
new file mode 100644
index 000000000..b666f2798
--- /dev/null
+++ b/content/en/policies/pod-security-cel/baseline/disallow-privileged-containers/disallow-privileged-containers.md
@@ -0,0 +1,68 @@
+---
+title: "Disallow Privileged Containers in CEL expressions"
+category: Pod Security Standards (Baseline) in CEL
+version: 
+subject: Pod
+policyType: "validate"
+description: >
+    Privileged mode disables most security mechanisms and must not be allowed. This policy ensures Pods do not call for privileged mode.
+---
+
+## Policy Definition
+<a href="https://github.com/kyverno/policies/raw/main//pod-security-cel/baseline/disallow-privileged-containers/disallow-privileged-containers.yaml" target="-blank">/pod-security-cel/baseline/disallow-privileged-containers/disallow-privileged-containers.yaml</a>
+
+```yaml
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: disallow-privileged-containers
+  annotations:
+    policies.kyverno.io/title: Disallow Privileged Containers in CEL expressions
+    policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    kyverno.io/kyverno-version: 1.11.0
+    kyverno.io/kubernetes-version: "1.26-1.27"
+    policies.kyverno.io/description: >-
+      Privileged mode disables most security mechanisms and must not be allowed. This policy
+      ensures Pods do not call for privileged mode.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: privileged-containers
+      match:
+        any:
+        - resources:
+            kinds:
+              - Pod
+      validate:
+        cel:
+          expressions:
+            - expression: >-
+                object.spec.containers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.privileged) ||
+                container.securityContext.privileged == false)
+              message: >-
+                Privileged mode is disallowed. The fields spec.containers[*].securityContext.privileged
+                must be unset or set to `false`.
+
+            - expression: >-
+                !has(object.spec.initContainers) ||
+                object.spec.initContainers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.privileged) ||
+                container.securityContext.privileged == false)
+              message: >-
+                Privileged mode is disallowed. The fields spec.initContainers[*].securityContext.privileged
+                must be unset or set to `false`.
+
+            - expression: >-
+                !has(object.spec.ephemeralContainers) ||
+                object.spec.ephemeralContainers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.privileged) ||
+                container.securityContext.privileged == false)
+              message: >-
+                Privileged mode is disallowed. The fields spec.ephemeralContainers[*].securityContext.privileged
+                must be unset or set to `false`.
+
+```
diff --git a/content/en/policies/pod-security-cel/baseline/disallow-proc-mount/disallow-proc-mount.md b/content/en/policies/pod-security-cel/baseline/disallow-proc-mount/disallow-proc-mount.md
new file mode 100644
index 000000000..72f13f557
--- /dev/null
+++ b/content/en/policies/pod-security-cel/baseline/disallow-proc-mount/disallow-proc-mount.md
@@ -0,0 +1,70 @@
+---
+title: "Disallow procMount in CEL expressions"
+category: Pod Security Standards (Baseline) in CEL
+version: 
+subject: Pod
+policyType: "validate"
+description: >
+    The default /proc masks are set up to reduce attack surface and should be required. This policy ensures nothing but the default procMount can be specified. Note that in order for users to deviate from the `Default` procMount requires setting a feature gate at the API server.
+---
+
+## Policy Definition
+<a href="https://github.com/kyverno/policies/raw/main//pod-security-cel/baseline/disallow-proc-mount/disallow-proc-mount.yaml" target="-blank">/pod-security-cel/baseline/disallow-proc-mount/disallow-proc-mount.yaml</a>
+
+```yaml
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: disallow-proc-mount
+  annotations:
+    policies.kyverno.io/title: Disallow procMount in CEL expressions
+    policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    kyverno.io/kyverno-version: 1.11.0
+    kyverno.io/kubernetes-version: "1.26-1.27"
+    policies.kyverno.io/description: >-
+      The default /proc masks are set up to reduce attack surface and should be required. This policy
+      ensures nothing but the default procMount can be specified. Note that in order for users
+      to deviate from the `Default` procMount requires setting a feature gate at the API
+      server.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: check-proc-mount
+      match:
+        any:
+        - resources:
+            kinds:
+              - Pod
+      validate:
+        cel:
+          expressions:
+            - expression: >- 
+                object.spec.containers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.procMount) ||
+                container.securityContext.procMount == 'Default')
+              message: >-
+                Changing the proc mount from the default is not allowed. The field
+                spec.containers[*].securityContext.procMount must be unset or set to `Default`.
+      
+            - expression: >-
+                !has(object.spec.initContainers) ||
+                object.spec.initContainers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.procMount) ||
+                container.securityContext.procMount == 'Default')
+              message: >-
+                Changing the proc mount from the default is not allowed. The field
+                spec.initContainers[*].securityContext.procMount must be unset or set to `Default`.
+              
+            - expression: >- 
+                !has(object.spec.ephemeralContainers) ||
+                object.spec.ephemeralContainers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.procMount) ||
+                container.securityContext.procMount == 'Default')
+              message: >-
+                Changing the proc mount from the default is not allowed. The field
+                spec.ephemeralContainers[*].securityContext.procMount must be unset or set to `Default`.
+
+```
diff --git a/content/en/policies/pod-security-cel/baseline/disallow-selinux/disallow-selinux.md b/content/en/policies/pod-security-cel/baseline/disallow-selinux/disallow-selinux.md
new file mode 100644
index 000000000..52b371726
--- /dev/null
+++ b/content/en/policies/pod-security-cel/baseline/disallow-selinux/disallow-selinux.md
@@ -0,0 +1,130 @@
+---
+title: "Disallow SELinux in CEL expressions"
+category: Pod Security Standards (Baseline) in CEL
+version: 
+subject: Pod
+policyType: "validate"
+description: >
+    SELinux options can be used to escalate privileges and should not be allowed. This policy ensures that the `seLinuxOptions` field is undefined.
+---
+
+## Policy Definition
+<a href="https://github.com/kyverno/policies/raw/main//pod-security-cel/baseline/disallow-selinux/disallow-selinux.yaml" target="-blank">/pod-security-cel/baseline/disallow-selinux/disallow-selinux.yaml</a>
+
+```yaml
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: disallow-selinux
+  annotations:
+    policies.kyverno.io/title: Disallow SELinux in CEL expressions
+    policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    kyverno.io/kyverno-version: 1.11.0
+    kyverno.io/kubernetes-version: "1.26-1.27"
+    policies.kyverno.io/description: >-
+      SELinux options can be used to escalate privileges and should not be allowed. This policy
+      ensures that the `seLinuxOptions` field is undefined.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: selinux-type
+      match:
+        any:
+        - resources:
+            kinds:
+              - Pod
+      validate:
+        cel:
+          expressions:
+            - expression: >- 
+                !has(object.spec.securityContext) ||
+                !has(object.spec.securityContext.seLinuxOptions) ||
+                !has(object.spec.securityContext.seLinuxOptions.type) ||
+                object.spec.securityContext.seLinuxOptions.type == 'container_t' ||
+                object.spec.securityContext.seLinuxOptions.type == 'container_init_t' ||
+                object.spec.securityContext.seLinuxOptions.type == 'container_kvm_t'
+              message: >-
+                Setting the SELinux type is restricted. The field spec.securityContext.seLinuxOptions.type 
+                must either be unset or set to one of the allowed values (container_t, container_init_t, or container_kvm_t).
+
+            - expression: >-
+                object.spec.containers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.seLinuxOptions) ||
+                !has(container.securityContext.seLinuxOptions.type) ||
+                container.securityContext.seLinuxOptions.type == 'container_t' ||
+                container.securityContext.seLinuxOptions.type == 'container_init_t' ||
+                container.securityContext.seLinuxOptions.type == 'container_kvm_t')
+              message: >-
+                Setting the SELinux type is restricted. The field spec.containers[*].securityContext.seLinuxOptions.type 
+                must either be unset or set to one of the allowed values (container_t, container_init_t, or container_kvm_t).
+
+            - expression: >- 
+                !has(object.spec.initContainers) ||
+                object.spec.initContainers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.seLinuxOptions) ||
+                !has(container.securityContext.seLinuxOptions.type) ||
+                container.securityContext.seLinuxOptions.type == 'container_t' ||
+                container.securityContext.seLinuxOptions.type == 'container_init_t' ||
+                container.securityContext.seLinuxOptions.type == 'container_kvm_t')
+              message: >-
+                Setting the SELinux type is restricted. The field spec.initContainers[*].securityContext.seLinuxOptions.type 
+                must either be unset or set to one of the allowed values (container_t, container_init_t, or container_kvm_t).
+
+            - expression: >- 
+                !has(object.spec.ephemeralContainers) ||
+                object.spec.ephemeralContainers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.seLinuxOptions) ||
+                !has(container.securityContext.seLinuxOptions.type) ||
+                container.securityContext.seLinuxOptions.type == 'container_t' ||
+                container.securityContext.seLinuxOptions.type == 'container_init_t' ||
+                container.securityContext.seLinuxOptions.type == 'container_kvm_t')
+              message: >-
+                Setting the SELinux type is restricted. The field spec.ephemeralContainers[*].securityContext.seLinuxOptions.type 
+                must either be unset or set to one of the allowed values (container_t, container_init_t, or container_kvm_t).
+    - name: selinux-user-role
+      match:
+        any:
+        - resources:
+            kinds:
+              - Pod
+      validate:
+        cel:
+          expressions:
+            - expression: >- 
+                !has(object.spec.securityContext) ||
+                !has(object.spec.securityContext.seLinuxOptions) ||
+                (!has(object.spec.securityContext.seLinuxOptions.user) && !has(object.spec.securityContext.seLinuxOptions.role))
+              message: >-
+                Setting the SELinux user or role is forbidden. The fields
+                spec.securityContext.seLinuxOptions.user and spec.securityContext.seLinuxOptions.role must be unset.
+
+            - expression: >- 
+                object.spec.containers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.seLinuxOptions) ||
+                (!has(container.securityContext.seLinuxOptions.user) && !has(container.securityContext.seLinuxOptions.role)))
+              message: >-
+                Setting the SELinux user or role is forbidden. The fields
+                spec.containers[*].securityContext.seLinuxOptions.user and spec.containers[*].securityContext.seLinuxOptions.role must be unset.
+
+            - expression: >- 
+                !has(object.spec.initContainers) ||
+                object.spec.initContainers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.seLinuxOptions) ||
+                (!has(container.securityContext.seLinuxOptions.user) && !has(container.securityContext.seLinuxOptions.role)))
+              message: >-
+                Setting the SELinux user or role is forbidden. The fields
+                spec.initContainers[*].securityContext.seLinuxOptions.user and spec.initContainers[*].securityContext.seLinuxOptions.role must be unset.
+
+            - expression: >- 
+                !has(object.spec.ephemeralContainers) ||
+                object.spec.ephemeralContainers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.seLinuxOptions) ||
+                (!has(container.securityContext.seLinuxOptions.user) && !has(container.securityContext.seLinuxOptions.role)))
+              message: >-
+                Setting the SELinux user or role is forbidden. The fields
+                spec.ephemeralContainers[*].securityContext.seLinuxOptions.user and spec.ephemeralContainers[*].securityContext.seLinuxOptions.role must be unset.
+
+```
diff --git a/content/en/policies/pod-security-cel/baseline/restrict-seccomp/restrict-seccomp.md b/content/en/policies/pod-security-cel/baseline/restrict-seccomp/restrict-seccomp.md
new file mode 100644
index 000000000..1acbaf872
--- /dev/null
+++ b/content/en/policies/pod-security-cel/baseline/restrict-seccomp/restrict-seccomp.md
@@ -0,0 +1,85 @@
+---
+title: "Restrict Seccomp in CEL expressions"
+category: Pod Security Standards (Baseline) in CEL
+version: 
+subject: Pod
+policyType: "validate"
+description: >
+    The seccomp profile must not be explicitly set to Unconfined. This policy,  requiring Kubernetes v1.19 or later, ensures that seccomp is unset or  set to `RuntimeDefault` or `Localhost`.
+---
+
+## Policy Definition
+<a href="https://github.com/kyverno/policies/raw/main//pod-security-cel/baseline/restrict-seccomp/restrict-seccomp.yaml" target="-blank">/pod-security-cel/baseline/restrict-seccomp/restrict-seccomp.yaml</a>
+
+```yaml
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: restrict-seccomp
+  annotations:
+    policies.kyverno.io/title: Restrict Seccomp in CEL expressions
+    policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    kyverno.io/kyverno-version: 1.11.0
+    kyverno.io/kubernetes-version: "1.26-1.27"
+    policies.kyverno.io/description: >-
+      The seccomp profile must not be explicitly set to Unconfined. This policy, 
+      requiring Kubernetes v1.19 or later, ensures that seccomp is unset or 
+      set to `RuntimeDefault` or `Localhost`.
+spec:
+  background: true
+  validationFailureAction: Audit
+  rules:
+    - name: check-seccomp
+      match:
+        any:
+        - resources:
+            kinds:
+              - Pod
+      validate:
+        cel:
+          expressions:
+            - expression: >- 
+                !has(object.spec.securityContext) ||
+                !has(object.spec.securityContext.seccompProfile) ||
+                !has(object.spec.securityContext.seccompProfile.type) ||
+                object.spec.securityContext.seccompProfile.type == 'RuntimeDefault' ||
+                object.spec.securityContext.seccompProfile.type == 'Localhost'
+              message: >-
+                Use of custom Seccomp profiles is disallowed. The field
+                spec.securityContext.seccompProfile.type must be unset or set to `RuntimeDefault` or `Localhost`.
+
+            - expression: >- 
+                object.spec.containers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.seccompProfile) ||
+                !has(container.securityContext.seccompProfile.type) ||
+                container.securityContext.seccompProfile.type == 'RuntimeDefault' ||
+                container.securityContext.seccompProfile.type == 'Localhost')
+              message: >-
+                Use of custom Seccomp profiles is disallowed. The field
+                spec.containers[*].securityContext.seccompProfile.type must be unset or set to `RuntimeDefault` or `Localhost`.
+
+            - expression: >- 
+                !has(object.spec.initContainers) ||
+                object.spec.initContainers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.seccompProfile) ||
+                !has(container.securityContext.seccompProfile.type) ||
+                container.securityContext.seccompProfile.type == 'RuntimeDefault' ||
+                container.securityContext.seccompProfile.type == 'Localhost')
+              message: >-
+                Use of custom Seccomp profiles is disallowed. The field
+                spec.initContainers[*].securityContext.seccompProfile.type must be unset or set to `RuntimeDefault` or `Localhost`.
+
+            - expression: >- 
+                !has(object.spec.ephemeralContainers) ||
+                object.spec.ephemeralContainers.all(container, !has(container.securityContext) ||
+                !has(container.securityContext.seccompProfile) ||
+                !has(container.securityContext.seccompProfile.type) ||
+                container.securityContext.seccompProfile.type == 'RuntimeDefault' ||
+                container.securityContext.seccompProfile.type == 'Localhost')
+              message: >-
+                Use of custom Seccomp profiles is disallowed. The field
+                spec.ephemeralContainers[*].securityContext.seccompProfile.type must be unset or set to `RuntimeDefault` or `Localhost`.
+
+```
diff --git a/content/en/policies/pod-security-cel/baseline/restrict-sysctls/restrict-sysctls.md b/content/en/policies/pod-security-cel/baseline/restrict-sysctls/restrict-sysctls.md
new file mode 100644
index 000000000..4ca47e8de
--- /dev/null
+++ b/content/en/policies/pod-security-cel/baseline/restrict-sysctls/restrict-sysctls.md
@@ -0,0 +1,62 @@
+---
+title: "Restrict sysctls in CEL expressions"
+category: Pod Security Standards (Baseline) in CEL
+version: 
+subject: Pod
+policyType: "validate"
+description: >
+    Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed "safe" subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node. This policy ensures that only those "safe" subsets can be specified in a Pod.
+---
+
+## Policy Definition
+<a href="https://github.com/kyverno/policies/raw/main//pod-security-cel/baseline/restrict-sysctls/restrict-sysctls.yaml" target="-blank">/pod-security-cel/baseline/restrict-sysctls/restrict-sysctls.yaml</a>
+
+```yaml
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: restrict-sysctls
+  annotations:
+    policies.kyverno.io/title: Restrict sysctls in CEL expressions
+    policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    kyverno.io/kyverno-version: 1.11.0
+    kyverno.io/kubernetes-version: "1.26-1.27"
+    policies.kyverno.io/description: >-
+      Sysctls can disable security mechanisms or affect all containers on a
+      host, and should be disallowed except for an allowed "safe" subset. A
+      sysctl is considered safe if it is namespaced in the container or the
+      Pod, and it is isolated from other Pods or processes on the same Node.
+      This policy ensures that only those "safe" subsets can be specified in
+      a Pod.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: check-sysctls
+      match:
+        any:
+        - resources:
+            kinds:
+              - Pod
+      validate:
+        cel:
+          expressions:
+            - expression: >- 
+                !has(object.spec.securityContext) ||
+                !has(object.spec.securityContext.sysctls) ||
+                object.spec.securityContext.sysctls.all(sysctl, !has(sysctl.name) ||
+                sysctl.name == 'kernel.shm_rmid_forced' ||
+                sysctl.name == 'net.ipv4.ip_local_port_range' ||
+                sysctl.name == 'net.ipv4.ip_unprivileged_port_start' ||
+                sysctl.name == 'net.ipv4.tcp_syncookies' ||
+                sysctl.name == 'net.ipv4.ping_group_range')
+              message: >-
+                Setting additional sysctls above the allowed type is disallowed.
+                The field spec.securityContext.sysctls must be unset or not use any other names
+                than kernel.shm_rmid_forced, net.ipv4.ip_local_port_range,
+                net.ipv4.ip_unprivileged_port_start, net.ipv4.tcp_syncookies and
+                net.ipv4.ping_group_range.
+
+```