Policy Packs

Policy Packs are curated collections of policy rules that enforce a specific compliance framework. Rather than authoring every rule yourself, your organisation subscribes to a pack and inherits the rules it contains. Packs are maintained by Troposphere, so they stay current as the underlying framework evolves.

Frameworks#

Each pack is tied to a published compliance framework and version. Examples include:

• CIS – Center for Internet Security benchmarks.
• HIPAA – Health Insurance Portability and Accountability Act controls.
• PCI DSS – Payment Card Industry Data Security Standard.
• SOC 2 – Service Organisation Control 2 trust services criteria.
• NIST – National Institute of Standards and Technology guidelines.

Packs carry a version (for example, “CIS Azure Benchmark v2.0”) so you always know which revision of a framework you are enforcing.

Pack Rules#

Each rule in a pack has the same structure as a custom policy – a target property, an operator, one or more values, and a severity – plus a reference field that cites the specific control it implements (for example, “CIS 6.2” or “HIPAA §164.312(a)(2)(iv)”). Pack rules are managed centrally and cannot be edited by organisation users; to deviate from a pack’s rules, author a custom policy instead.

Subscriptions#

An organisation opts into a pack by creating a subscription. Subscriptions can be toggled on or off at any time, and each one tracks:

• The most recent evaluation timestamp.
• The total number of evaluations recorded for the subscription.
• The current number of open violations from the pack’s rules.

When a subscription is enabled, every resource in the organisation’s scope is evaluated against the pack’s rules on each sync. Violations are surfaced through the same alerting mechanism as custom policies, giving you a unified feed of compliance findings.

Custom Policies vs. Packs#

Custom Policies are rules your organisation authors and maintains itself. Policy Packs are pre-built rule bundles Troposphere maintains on your behalf. The two run side by side – use packs to cover well-known frameworks and fill in the gaps with custom policies tailored to your internal standards.