"This newly formed ONUG Collaborative Working Group will focus on helping cloud consumers find solutions to effective risk governance"
Mark Tierney, CTO ONUG
The Working Group’s initial goal is to develop a Policy as Code vocabulary and framework as an effective means to implement controls to manage risk with automated governance within multi-cloud environments.
Beginning in July of 2022, this new Working Group seeks to identify the issues, challenges and areas of concern that will need to be addressed going forward. These include:
-
- What would constitute an effective set of guidelines for translating high-level business requirements around risk into specific policies?
- How might we ensure that those higher level policy articulations ramify through to lower-level architectures?
- What policy languages should one employ? Indeed, what should be the criteria for language selection? Or, do we need to define a new, common language?
- Is a common, broad-based, multi-tiered “Policy as Code reference architecture” needed?
- How will the integrity, confidentiality, and availability of policies and policy state be verified?
- How will policies be managed by identity authentication systems and domain-specific toolchains responsible for policy enforcement?
- How can policy as code be used to reduce toil and improve transparency for second line functions?
- Does the recent work of the CNCF in this area, namely their Open Policy Agent initiative, meet the needs of industry practitioners?
- Once expressed in software, moreover, how does one proceed to manage the policy codebase so as to maintain consistency of intent and avoid the problems of “drift”?
- Wouldn’t Policy as Code playbooks serve a useful purpose as enterprises pursue new policy governance strategies?
