SOC 2 — Rego Policies for OPA

12 open-source Rego policies encoding SOC 2 Trust Services Criteria. Apache 2.0, Rego v1, ready to load into OPA or Enterprise OPA.

What this is

12 Rego policy files encoding SOC 2 Trust Services Criteria, part of the Rego Policy Libraries — a standalone, dependency-free collection of Open Policy Agent policies for published security and compliance standards. No orchestrator, no agent, no vendor runtime.

Load and query it

git clone https://github.com/ynotbhatc/rego_policy_libraries.git
opa eval -d rego_policy_libraries/frameworks/management/soc2 -f pretty 'data'

Or load into a running OPA:

for f in rego_policy_libraries/frameworks/management/soc2/*.rego; do
  curl -X PUT --data-binary @"$f" "$OPA/v1/policies/$(basename $f .rego)"
done

Two ways to use these policies

Gating a change of state — evaluate a proposed action before it proceeds, and refuse it if it violates the standard. Measuring state — evaluate collected facts about an environment against the standard to produce compliance evidence. The same policy content serves both; only the integration differs.

Policy modules

system_availability.rego soc2.availability.system_availability
data_confidentiality.rego soc2.confidentiality.data_confidentiality
applications_services.rego soc2.infrastructure.applications_services
network_infrastructure.rego soc2.infrastructure.network
security_infrastructure.rego soc2.infrastructure.security
storage_infrastructure.rego soc2.infrastructure.storage
systems_infrastructure.rego soc2.infrastructure.systems
data_privacy.rego soc2.privacy.data_privacy
data_processing.rego soc2.processing_integrity.data_processing
access_controls.rego soc2.security.access_controls
soc2_assessment.rego soc2
soc2_main.rego soc2.main

Contributing