Rego Policy Libraries

Open Policy Agent Policy-as-Code Compliance

Open source Rego policy library for enterprise compliance automation.
Covers CIS benchmarks, NIST, ISO 27001, SOC 2, NERC-CIP, DORA, NIS2, PCI-DSS, Digital Sovereignty, and AI governance — all in auditable, extensible Rego v1 syntax.

Part of the Ansible Automated Compliance (AAC) platform — Policy-as-Code compliance at enterprise scale, built on Ansible Automation Platform and Open Policy Agent.

View on GitHub →

Framework Coverage

FrameworkCategoryOPA Container
CIS Benchmarks (RHEL 9, Ubuntu, Windows, AWS)Securityopa-security :8181
DISA STIGsSecurityopa-security :8181
NIST 800-53 / FedRAMP / FISMA / CMMCFederalopa-security :8181
ISO 27001 / SOC 2 / PCI-DSS / SOXComplianceopa-compliance :8182
GDPR / HIPAA / PrivacyPrivacyopa-compliance :8182
DORA / NIS2 / Digital SovereigntySovereigntyopa-compliance :8182
NERC-CIP (CIP-002 through CIP-015)Critical Infrastructureopa-ot :8183
AMI / NIST IR 7628 / IEC 62443OT / Smart Gridopa-ot :8183
AI Governance / MCP EnforcementAI / Governanceopa-ot :8183
Ansible / Terraform / Git EnforcementPipelineopa-compliance :8182

Quick Start

git clone https://github.com/ynotbhatc/rego_policy_libraries.git

# Load a policy into OPA
curl -X PUT --data-binary @benchmarks/cis/os/linux/rhel_9/cis_rhel9_complete.rego \
  http://localhost:8181/v1/policies/cis_rhel9_complete

# Query compliance
curl -X POST http://localhost:8181/v1/data/cis_rhel9/compliance_assessment \
  -H 'Content-Type: application/json' -d @your_facts.json

Policy Library Structure

DirectoryContents
benchmarks/cis/CIS benchmark policies — 200+ files
benchmarks/stig/DISA STIG policies
frameworks/federal/NIST, FISMA, FedRAMP, CMMC
frameworks/management/ISO 27001, SOC 2, Corporate
frameworks/financial/PCI-DSS, SOX
frameworks/privacy/GDPR, HIPAA
frameworks/critical_infrastructure/NERC-CIP, AMI, IEC 62443
frameworks/sovereignty/Digital Sovereignty (11 domains)
enforcement/Ansible, Terraform, Git pipeline enforcement
governance/AI governance, MCP enforcement
threat_detection/Threat and anomaly detection policies

Standards Covered

Each standard has its own page listing the policy modules it contains and how to load them into OPA: browse all 42 standards.

CIS RHEL 9 · NERC-CIP · ISO 27001 · PCI-DSS · GDPR · SOC 2 · EU AI Act · DISA STIG RHEL 9

Links

Rego Policy Libraries — Part of the Ansible Automated Compliance (AAC) project.
All policies use Rego v1 syntax. Requires OPA 0.60+.