Policy
Risk-informed guidance tailored to your organization's specific needs and risk appetite.
Role
Policy is the organisation-specific binding: who is in scope, which catalogs and guidance are imported, which risks are mitigated or accepted, and which assessment plans and enforcement methods apply.
It says how an organisation uses those definitions for governing a sensitive activity.
Examples
FOSS contribution policy scope
A policy covers employees and authorised contractors contributing to company-moderated and company-interest projects, and explicitly excludes FOSS consumption. Contacts name OSPO, Legal, line managers and contributors in RACI form so ownership is not implied.
Source: Free and Open Source Software Contribution Policy (foss-contribution-policy) scope and contacts.
Mitigated data-leakage with assessment plans
The policy imports the FOSS control catalog, lists data-leakage and related risks as mitigated, and defines per-contribution assessment plans—such as IP review and secret-scan checks—that evaluation logs later execute.
Source: Mitigated risks and assessment plans in the FOSS Contribution Policy.
Enforcement methods for failed evaluations
Methods such as blocking merge and notifying the OSPO are declared on the policy so enforcement logs cite an authorised response rather than an improvised script.
Source: em-foss-block-merge and related enforcement methods in the FOSS Contribution Policy.
Links upstream
Links downstream
- Evaluation Log — executes assessment plans against activity instances
- Enforcement Log — applies methods justified by evaluation results
- Audit Log — reviews conformance using policy criteria and recorded evidence