<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-security-policy-automation
description: >-
  Automate security policy lifecycle management including authoring, version control, approval workflows, distribution, attestation tracking, and compliance mapping. Covers policy-as-code with OPA/Rego, automated compliance checks, and continuous policy enforcement across cloud and on-premises environments.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - policy-automation
  - policy-as-code
  - OPA
  - rego
  - compliance-automation
  - governance
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf:
  - "GV.PO-1"
  - "GV.PO-2"
  - "PR.IP-1"
  - "PR.IP-12"
  - "DE.CM-7"
  frameworks:
  - "NIST CSF 2.0"
  - "ISO 27001 A.5"
  - "CIS Controls v8"
  - "OPA/Rego"
  mitre-attack: []
---

# Building Security Policy Automation

## Overview

Security policy automation replaces manual document-driven governance with
machine-enforceable policy-as-code. Using Open Policy Agent (OPA) with Rego,
policies become testable, versionable artifacts that enforce security requirements
across infrastructure, applications, and cloud environments in real time.

## Workflow

1. **Policy Inventory** — Catalog existing policies and map to framework controls (NIST, ISO, CIS)
2. **Policy-as-Code Translation** — Convert natural-language policies to OPA/Rego rules
3. **Version Control Setup** — Establish Git-based policy repository with branching and review workflows
4. **Automated Testing** — Write policy unit tests and integration tests with OPA test framework
5. **Enforcement Pipeline** — Deploy policies to admission controllers, CI/CD gates, and runtime checks
6. **Attestation Tracking** — Automate employee policy acknowledgment and track completion rates
7. **Drift Detection** — Monitor for policy violations and configuration drift in real time
8. **Review Cycle Automation** — Schedule annual reviews with automated stakeholder notifications

## Key Concepts

### OPA/Rego Policy Structure

```rego
package security.network

# Deny public S3 buckets
deny[msg] {
    input.resource_type == "aws_s3_bucket"
    input.resource.acl == "public-read"
    msg := sprintf("S3 bucket '%s' must not be public", [input.resource.name])
}
```

### Policy Lifecycle Stages

| Stage | Automation | Tools |
|-------|-----------|-------|
| Draft | Template generation | Jinja2, Markdown |
| Review | PR-based approval | GitHub/GitLab |
| Approval | Digital signatures | GPG, DocuSign API |
| Distribution | Automated publishing | Confluence API, SharePoint |
| Attestation | Acknowledgment tracking | Custom portal, LMS |
| Enforcement | Real-time checks | OPA, Kyverno, Sentinel |
| Review | Scheduled notifications | Cron, workflow engines |

### Policy-to-Control Mapping

| Policy Domain | NIST CSF | CIS Control | ISO 27001 |
|--------------|----------|-------------|-----------|
| Access Control | PR.AC | 5, 6 | A.9 |
| Data Protection | PR.DS | 3 | A.8, A.10 |
| Incident Response | RS.RP | 17 | A.16 |
| Change Management | PR.IP | 4 | A.12.1.2 |
| Network Security | PR.AC, PR.PT | 9, 12, 13 | A.13 |

## Detection Opportunities

### Policy Violation Indicators

- **Drift detected**: resource configuration deviates from enforced policy baseline
- **Attestation gap**: employees with overdue policy acknowledgments
- **Exception abuse**: excessive or long-lived policy exceptions without review
- **Enforcement bypass**: resources deployed outside policy-checked pipelines
- **MITRE mapping**: T1562.001 (Disable Security Tools), T1078 (Valid Accounts), T1098 (Account Manipulation)
