CSA CCM — Rego Policies for OPA

17 open-source Rego policies encoding Cloud Security Alliance Cloud Controls Matrix. Apache 2.0, Rego v1, ready to load into OPA or Enterprise OPA.

What this is

17 Rego policy files encoding Cloud Security Alliance Cloud Controls Matrix, part of the Rego Policy Libraries — a standalone, dependency-free collection of Open Policy Agent policies for published security and compliance standards. No orchestrator, no agent, no vendor runtime.

Load and query it

git clone https://github.com/ynotbhatc/rego_policy_libraries.git
opa eval -d rego_policy_libraries/frameworks/management/csa_ccm -f pretty 'data'

Or load into a running OPA:

for f in rego_policy_libraries/frameworks/management/csa_ccm/*.rego; do
  curl -X PUT --data-binary @"$f" "$OPA/v1/policies/$(basename $f .rego)"
done

Two ways to use these policies

Gating a change of state — evaluate a proposed action before it proceeds, and refuse it if it violates the standard. Measuring state — evaluate collected facts about an environment against the standard to produce compliance evidence. The same policy content serves both; only the integration differs.

Policy modules

csa_ccm_application_security.rego csa_ccm.application_security
csa_ccm_audit_assurance.rego csa_ccm.audit_assurance
csa_ccm_business_continuity.rego csa_ccm.business_continuity
csa_ccm_change_control.rego csa_ccm.change_control
csa_ccm_cryptography.rego csa_ccm.cryptography
csa_ccm_data_security.rego csa_ccm.data_security
csa_ccm_endpoint_management.rego csa_ccm.endpoint_management
csa_ccm_governance.rego csa_ccm.governance
csa_ccm_human_resources.rego csa_ccm.human_resources
csa_ccm_identity_access.rego csa_ccm.identity_access
csa_ccm_incident_management.rego csa_ccm.incident_management
csa_ccm_infrastructure.rego csa_ccm.infrastructure
csa_ccm_interoperability.rego csa_ccm.interoperability
csa_ccm_logging_monitoring.rego csa_ccm.logging_monitoring
csa_ccm_main.rego csa_ccm.main
csa_ccm_supply_chain.rego csa_ccm.supply_chain
csa_ccm_threat_vulnerability.rego csa_ccm.threat_vulnerability

Contributing