Technical and operational indicators for assessing the effectiveness of security controls in Infrastructure as Code, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.
Organisational policy that defines the security requirements for the definition, validation, execution and maintenance of Infrastructure as Code (IaC), including configuration scanning, policy-as-code, environment separation, drift control, approved modules and plan signing, proportional to the criticality level (L1, L2, L3).