Policy Management
Policy Management in CBOM Secure is where you define the cryptographic rules that the rest of the platform measures your environment against. A policy is a named set of approved algorithms, key sizes, and parameters that represents what your organization considers acceptable cryptography. Once a policy is defined, CBOM Secure uses it as the baseline for evaluating discovered keys, certificates, and cipher suites, flagging any cryptographic material that does not conform.
Policies can be built to mirror a recognized compliance standard (for example, NIST SP-800, PCI-DSS, or GDPR) or assembled manually to match an organization's own internal cryptographic standards. This gives security teams a single, consistent reference point for assessing the cryptographic posture of their infrastructure.
Why Policy Management Is Used
Without a defined policy, an inventory of cryptographic assets is just a list. Policy Management turns that inventory into an actionable posture assessment by giving every asset something to be measured against. It is used to:
-
Establish a cryptographic baseline: Codify which algorithms, key strengths, and parameters are permitted across the organization.
-
Enforce compliance: Align cryptographic usage with regulatory and industry standards such as NIST SP-800, PCI-DSS, and GDPR.
-
Identify non-compliant cryptography: Surface weak, deprecated, or disallowed algorithms and key sizes that fall outside the approved policy.
-
Support post-quantum readiness: Define and track adoption of quantum-safe algorithms (such as ML-KEM, ML-DSA, SLH-DSA, and HQC) as part of an organization's migration strategy.
-
Standardize evaluation: Provide a consistent, reusable reference that can be applied across discovery scans, analysis, and reporting.
Policy Categories
Policy Management is organized into two areas, both under Governance in the navigation menu:
-
User Policy: Policies created and maintained by users of the platform. This is where you add, edit, and delete the policies that apply to your organization. See User Policy for details.
-
Standard Policy: A built-in library of predefined policies based on well-known compliance frameworks and cryptographic standards, provided as ready-to-use references. See Standard Policy for details.
Compliance and Custom Policies
When a policy is created, it is built in one of two modes, and this determines the value shown in the Type column of the policy list:
-
Compliance (Standard): The set of allowed algorithms is derived automatically from a selected compliance standard. This is the fastest way to align with a recognized framework without manually choosing every algorithm.
-
Custom: The allowed algorithms, key sizes, and parameters are selected manually, giving full control to define a policy that matches an organization's specific requirements.
Accessing Policy Management
Policy Management is available from the left navigation menu of the CBOM Secure portal under Governance. Expanding it reveals the User Policy and Standard Policy options. Select User Policy to view, create, and manage the policies maintained by your organization.
The two entries are gated separately: User Policy needs the policy:read permission and Standard Policy needs std-policy:read, so a role may see one without the other. If your roles carry neither, the Governance menu does not appear at all.