IEC 62443 — Rego Policies for OPA

12 open-source Rego policies encoding IEC 62443 industrial automation and control systems security. Apache 2.0, Rego v1, ready to load into OPA or Enterprise OPA.

What this is

12 Rego policy files encoding IEC 62443 industrial automation and control systems security, part of the Rego Policy Libraries — a standalone, dependency-free collection of Open Policy Agent policies for published security and compliance standards. No orchestrator, no agent, no vendor runtime.

Load and query it

git clone https://github.com/ynotbhatc/rego_policy_libraries.git
opa eval -d rego_policy_libraries/frameworks/critical_infrastructure/iec_62443 -f pretty 'data'

Or load into a running OPA:

for f in rego_policy_libraries/frameworks/critical_infrastructure/iec_62443/*.rego; do
  curl -X PUT --data-binary @"$f" "$OPA/v1/policies/$(basename $f .rego)"
done

Two ways to use these policies

Gating a change of state — evaluate a proposed action before it proceeds, and refuse it if it violates the standard. Measuring state — evaluate collected facts about an environment against the standard to produce compliance evidence. The same policy content serves both; only the integration differs.

Policy modules

Contributing

Test coverage is published in COVERAGE.md, and uncovered policies are the best first contribution — each is small, self-contained, and either passes opa test or does not. See CONTRIBUTING.md.

Links