NCSC CAF — Rego Policies for OPA

8 open-source Rego policies encoding UK NCSC Cyber Assessment Framework. Apache 2.0, Rego v1, ready to load into OPA or Enterprise OPA.

What this is

8 Rego policy files encoding UK NCSC Cyber Assessment Framework, part of the Rego Policy Libraries — a standalone, dependency-free collection of Open Policy Agent policies for published security and compliance standards. No orchestrator, no agent, no vendor runtime.

Load and query it

git clone https://github.com/ynotbhatc/rego_policy_libraries.git
opa eval -d rego_policy_libraries/frameworks/compliance/ncsc_caf -f pretty 'data'

Or load into a running OPA:

for f in rego_policy_libraries/frameworks/compliance/ncsc_caf/*.rego; do
  curl -X PUT --data-binary @"$f" "$OPA/v1/policies/$(basename $f .rego)"
done

Two ways to use these policies

Gating a change of state — evaluate a proposed action before it proceeds, and refuse it if it violates the standard. Measuring state — evaluate collected facts about an environment against the standard to produce compliance evidence. The same policy content serves both; only the integration differs.

Policy modules

caf_a3_asset_management.rego ncsc_caf.a3_asset_management
caf_b2_identity_access.rego ncsc_caf.b2_identity_access
caf_b3_data_security.rego ncsc_caf.b3_data_security
caf_b4_system_security.rego ncsc_caf.b4_system_security
caf_b5_resilience.rego ncsc_caf.b5_resilience
caf_c1_security_monitoring.rego ncsc_caf.c1_security_monitoring
caf_d1_response_recovery.rego ncsc_caf.d1_response_recovery
caf_main.rego ncsc_caf.main

Contributing