| name | security-benchmarks |
| description | This skill should be used when the user asks about "cis benchmark", "cis kubernetes", "cis docker", "cis aws", "cis azure", "cis gcp", "soc2 rego", "soc2 policy", "hipaa compliance", "pci-dss", "nist 800-53", "iso 27001", "compliance rego", "security controls", "benchmark alignment", or mentions mapping OPA policies to compliance frameworks. Provides CIS benchmark control mappings and compliance framework references for OPA/Rego policies. |
Security Benchmarks
Reference for mapping OPA/Rego policies to CIS benchmarks, SOC 2, HIPAA, PCI-DSS, NIST 800-53, and other compliance frameworks. Use when writing benchmark-aligned policies or creating policy specs.
CRITICAL: Benchmark ID Accuracy
- ONLY cite control IDs that appear in this skill's tables or in
references/compliance-matrix.md. Do not generate plausible-looking IDs from general knowledge.
- If a user requests controls for a platform/framework not covered in these references, explicitly state: "The following IDs are from general knowledge and have not been verified against the authoritative benchmark document."
- Never fabricate CIS IDs. This skill covers a subset of each benchmark. If controls beyond this subset are needed, recommend consulting the full CIS benchmark document.
- HIPAA and ISO 27001 coverage is partial. Do not claim comprehensive coverage. State limitations transparently.
Benchmark Ecosystem Overview
| Framework | Type | Rego Coverage | Primary Tools |
|---|
| CIS Benchmarks | Technical controls | Strong | Terrascan, Trivy, Kubescape, Regula |
| SOC 2 Type II | Trust principles | Partial | Kubescape, Terrascan |
| HIPAA | Healthcare data | Partial | Cloud IaC rules, custom Rego |
| PCI-DSS 4.0 | Payment card data | Partial | Terrascan |
| NIST 800-53 | Federal security | Growing | OSCAL C2P, Terrascan |
| ISO 27001 | InfoSec management | Minimal | Custom Rego required |
CIS Kubernetes Benchmark
Key Controls for OPA/Gatekeeper
| CIS ID | Title | Rego Enforcement |
|---|
| 5.2.1 | Minimize admission of privileged containers | Deny securityContext.privileged: true |
| 5.2.2 | Minimize admission of containers wishing to share host PID | Deny hostPID: true |
| 5.2.3 | Minimize admission of containers wishing to share host IPC | Deny hostIPC: true |
| 5.2.4 | Minimize admission of containers wishing to share host network | Deny hostNetwork: true |
| 5.2.5 | Minimize admission of containers with allowPrivilegeEscalation | Deny unless allowPrivilegeEscalation: false |
| 5.2.6 | Minimize admission of root containers | Require runAsNonRoot: true |
| 5.2.7 | Minimize admission with NET_RAW capability | Require drop: ["ALL"] or drop: ["NET_RAW"] |
| 5.2.8 | Minimize admission with added capabilities | Deny capabilities beyond allowed list |
| 5.2.9 | Minimize admission of containers with assigned SELinux | Restrict SELinux options |
| 5.4.1 | Prefer using secrets as files over env vars | Warn on envFrom.secretRef |
| 5.7.1 | Create administrative boundaries between resources | Require namespace labels |
| 5.7.2 | Ensure that the seccomp profile is set | Require seccomp annotation/field |
| 5.7.3 | Apply security context to pods and containers | Require securityContext on all pods |
Pod Security Standards Mapping
| PSS Level | CIS Controls | Rego Focus |
|---|
| Privileged | None | No restrictions |
| Baseline | 5.2.1-5.2.4, 5.2.8 | Deny dangerous capabilities |
| Restricted | 5.2.1-5.2.9, 5.7.2-5.7.3 | Full security context enforcement |
CIS Docker Benchmark (Section 4: Container Images)
| CIS ID | Title | Rego Check |
|---|
| 4.1 | Ensure a user for the container has been created | Require USER instruction |
| 4.2 | Ensure containers use trusted base images | Allowlist registries |
| 4.3 | Ensure unnecessary packages are not installed | Warn on apt-get install without --no-install-recommends |
| 4.6 | Ensure HEALTHCHECK instructions have been added | Require HEALTHCHECK |
| 4.7 | Ensure update instructions are not used alone | Deny apt-get update without apt-get install in same RUN |
| 4.9 | Ensure COPY is used instead of ADD | Deny ADD except for archives |
| 4.10 | Ensure secrets are not stored in Dockerfiles | Deny ENV with secret-like patterns |
CIS AWS Foundations Benchmark
Key Controls for Terraform Policies
| CIS ID | Title | Resource Type | Rego Check |
|---|
| 1.4 | Ensure no root account access key | aws_iam_access_key | Deny root access keys |
| 1.16 | Ensure IAM policies not attached to users | aws_iam_user_policy | Deny direct user policies |
| 2.1.1 | Ensure S3 bucket encryption | aws_s3_bucket | Require SSE configuration |
| 2.1.2 | Ensure S3 bucket policy denies HTTP | aws_s3_bucket_policy | Require aws:SecureTransport |
| 2.1.5 | Ensure S3 bucket access logging | aws_s3_bucket_logging | Require logging config |
| 2.2.1 | Ensure EBS encryption by default | aws_ebs_volume | Require encrypted: true |
| 2.3.1 | Ensure RDS encryption | aws_rds_instance | Require storage_encrypted: true |
| 3.1 | Ensure CloudTrail enabled all regions | aws_cloudtrail | Require is_multi_region_trail |
| 4.1 | Ensure no SG allows ingress 0.0.0.0/0 to port 22 | aws_security_group | Deny 0.0.0.0/0 on port 22 |
| 4.2 | Ensure no SG allows ingress 0.0.0.0/0 to port 3389 | aws_security_group | Deny 0.0.0.0/0 on port 3389 |
| 5.1 | Ensure VPC flow logging | aws_flow_log | Require for all VPCs |
CIS Azure Foundations Benchmark
| CIS ID | Title | Rego Check |
|---|
| 3.1 | Ensure secure transfer required for storage | Require enable_https_traffic_only |
| 3.9 | Ensure storage account access keys rotated | Warn on long-lived keys |
| 4.1.1 | Ensure SQL auditing is enabled | Require audit policy |
| 4.3.1 | Ensure TLS 1.2+ for SQL | Require minimum_tls_version: "1.2" |
| 6.1 | Ensure Network Watcher is enabled | Require per region |
| 7.1 | Ensure VM disks are encrypted | Require disk encryption |
| 8.1 | Ensure Key Vault is recoverable | Require purge_protection_enabled |
CIS GCP Foundations Benchmark
| CIS ID | Title | Rego Check |
|---|
| 1.1 | Ensure MFA/2SV is enforced | Organization policy check |
| 3.1 | Ensure default network does not exist | Deny google_compute_network named "default" |
| 4.1 | Ensure Cloud SQL requires SSL | Require require_ssl: true |
| 5.1 | Ensure Cloud Storage uniform access | Require uniform_bucket_level_access |
| 6.1.1 | Ensure VM disks are encrypted with CSEK | Require disk_encryption_key |
| 6.2.1 | Ensure Cloud SQL automated backups | Require backup_configuration.enabled |
SOC 2 Type II Control Mapping
SOC 2 maps to Trust Service Criteria (TSC). Rego enforcement focuses on the technical controls that support each category.
| TSC Category | Control Area | Rego Enforcement Examples |
|---|
| CC6.1 | Logical access security | RBAC policies, network segmentation, auth requirements |
| CC6.2 | System credentials | Deny hardcoded secrets, require rotation |
| CC6.3 | Access authorization | Role-based deny rules, least privilege enforcement |
| CC6.6 | Security against threats | Pod security, container isolation, network policies |
| CC6.7 | Restrict data transmission | Require TLS, deny unencrypted protocols |
| CC6.8 | Prevent/detect unauthorized software | Image allowlists, signed images |
| CC7.1 | Detect configuration changes | Audit logging requirements |
| CC7.2 | Monitor for anomalies | Logging and monitoring enforcement |
| CC8.1 | Manage change process | Immutable infrastructure, deployment gates |
NIST 800-53 Control Families
| Family | ID | Rego Enforcement Focus |
|---|
| Access Control | AC-2, AC-6 | RBAC, least privilege, no wildcard perms |
| Audit | AU-2, AU-3 | Logging enabled, audit trails |
| Config Management | CM-2, CM-7 | Baseline configs, minimize functionality |
| Identification | IA-2, IA-5 | MFA, credential management |
| System Protection | SC-7, SC-8, SC-28 | Network boundaries, encryption in transit/at rest |
| System Integrity | SI-2, SI-3 | Patch management, malware protection |
OSCAL to OPA Pipeline
The NIST OSCAL Compass C2P (Compliance-to-Policy) project generates OPA bundles from OSCAL assessment plans:
OSCAL Assessment Plan -> C2P -> OPA Rego Bundle -> Policy Evaluation -> OSCAL Assessment Results
PCI-DSS 4.0 Key Controls
| Requirement | Rego Enforcement |
|---|
| 1.3 | Network access restricted (security group rules) |
| 2.2 | System components configured securely (baseline enforcement) |
| 3.4 | PAN data encrypted at rest (storage encryption) |
| 4.1 | Strong cryptography for transmission (TLS requirements) |
| 6.3 | Security vulnerabilities identified and managed (image scanning) |
| 7.1 | Access limited by need to know (RBAC, least privilege) |
| 8.3 | Authentication mechanisms (MFA, credential policies) |
| 10.2 | Audit log coverage (logging requirements) |
Using Benchmarks in Policy Specs
When creating a policy spec, include benchmark alignment:
## Benchmark Alignment
### CIS Controls
- **CIS-K8s-5.2.1**: Minimize admission of privileged containers (Level 1)
- **CIS-K8s-5.2.6**: Minimize admission of root containers (Level 1)
### Compliance Frameworks
- **SOC2 CC6.6**: Security against threats outside system boundaries
- **NIST AC-6**: Least privilege
- **PCI-DSS 2.2**: Configure system components securely
Use the # METADATA annotation in Rego to embed benchmark references:
# METADATA
# title: Deny privileged containers
# custom:
# benchmarks:
# cis_kubernetes: ["5.2.1"]
# soc2: ["CC6.6"]
# nist_800_53: ["AC-6"]
# pci_dss: ["2.2"]
# severity: high
Additional Resources
Reference Files
references/cis-kubernetes-full.md - Complete CIS Kubernetes Benchmark control mappings with Rego examplesreferences/cis-cloud-foundations.md - AWS, Azure, GCP CIS Foundations with resource-level detailreferences/compliance-matrix.md - Cross-framework mapping: CIS -> SOC2 -> NIST -> PCI-DSS -> HIPAA
