Organisational Policies - IaC and Infrastructure as Code

The effective application of Chapter 08 - IaC and Infrastructure as Code requires the existence of formal organisational policies that frame, reinforce and legitimise the practices of technical governance, security and validation associated with the automation of infrastructure.

These policies ensure that:

• Infrastructure is treated as a software artefact, subject to the same rules of control, quality and traceability as source code;
• The management of environments and resources is deterministic, auditable and reversible;
• Security and compliance are validated before the application of any infrastructure change.

---

📄 Relevant Organisational Policies

Policy Name	Mandatory?	Application	Summary of the Required Content
IaC Governance Policy	✅ Yes	All repositories and pipelines that define or apply infrastructure	Defines principles, roles and responsibilities; requires code review, segregation of environments, access control and formal approval before apply.
Secrets and Credentials Management Policy in IaC	✅ Yes	IaC repositories, pipelines and orchestration tools	Prohibits the inclusion of secrets in code; mandates the use of secret managers; establishes a rotation policy, minimum scopes and monitoring of access.
IaC Security Validation and Testing Policy	✅ Yes	CI/CD pipelines and shared modules	Requires the execution of IaC scanning and policy-as-code (tfsec, Checkov, KICS, OPA); mandatory validations before merge and deploy.
Cloud Resource Hardening and Secure Configuration Policy	✅ Yes	Automated cloud, hybrid and on-premises environments	Defines minimum controls (IAM, network, storage, logging); imposes baselines (CIS, ENISA Cloud); mandates the detection and mitigation of drift.
IaC Module Management and Reuse Policy	⚠️ Recommended	Internal registries of modules and templates	Establishes approval criteria, semantic versioning, security review and the lifecycle of reusable modules.
Automated Rollback and Recovery Policy	⚠️ Reinforced	Critical and production environments	Defines mechanisms for automated reversal and periodic tests of configuration and state restoration; establishes consistency requirements.
Infrastructure Change Observability and Audit Policy	⚠️ Reinforced	All environments managed via IaC	Determines that all changes (automatic or manual) are recorded with commit ID, pipeline run and evidence of approval.
IaC Plan Approval Policy	✅ Yes	DevOps, AppSec	Mandatory human review before apply; impact criteria; segregation of duties and SoD

---

📃 Minimum structure of each policy

Each policy must contain, at a minimum:

• Objective and scope (technologies, environments, teams covered);
• Roles and responsibilities (DevOps, Cloud Engineer, AppSec, Audit);
• Mandatory criteria and technical controls (automatic validations, gates, segregation);
• CI/CD integration (verification points, policy-as-code, approval);
• Traceable evidence (logs, reports, pull requests);
• Frequency of review and compliance audit.

---

✅ Final recommendations

• The policies must be published and managed centrally in the organisation's technical policy repository.
• They must be integrated into the CI/CD pipelines as automatic compliance mechanisms (policy enforcement).
• Their application must be assessed in the chapter's per-project review checklists and in security audits.
• Continuous alignment with CIS/ENISA benchmarks and with the practices of the cloud providers is recommended.
• Compliance with these policies is a formal maturity criterion in infrastructure security and DevSecOps.

📁 Templates or detailed examples of these policies may be included in future versions as complementary 60-*.md files of the manual.