cybernetic-agent-governance-engine/compliance/lula/lula-validation-ra5.yaml at main · google/cybernetic-agent-governance-engine · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# lula-validation-ra5.yaml
# NIST SP 800-53 Rev 5 — RA-5: Vulnerability Monitoring and Scanning
#
# Asserts that a vulnerability scanning CronJob is present and active in the
# cluster. The security scanning workflow is defined in:
#   .github/workflows/security-scan.yml (CI/CD pipeline — Trivy + SAST)
# The sbom-cronjob (deployment/k8s/sbom-cronjob.yaml) provides the in-cluster
# continuous scanning evidence for RA-5.
#
# Domain: kubernetes → Security Scan CronJob
# Provider: opa (inline Rego)
#
# References:
#   - .github/workflows/security-scan.yml — CI/CD security scanning (Trivy, SAST)
#   - deployment/k8s/sbom-cronjob.yaml — In-cluster SBOM/vulnerability scan CronJob
#   - docs/NIST_RMF_CHUNK5_MONITOR_ROADMAP.md — RA-5 monitoring roadmap
#   - docs/POAM.md — RA-5 POAM item
#
# Namespace: governance-stack (confirmed from live cluster deployment snapshot)

component-definition:
  uuid: 2a8c1f51-012c-5939-9c55-ac9b8f185c2c
  metadata:
    title: CAGE Validation — RA5
    last-modified: '2026-07-01T13:18:54Z'
    version: 1.0.0
    oscal-version: 1.1.2
    remarks: 'Auto-converted from standalone lula validation format.

      Region: US_FED. Posture: nist-sp800-53.

      Notes: NIST SP 800-53 Rev 5 RA-5: Vulnerability Monitoring and Scanning. Namespace: governance-stack (confirmed from live cluster deployment snapshot). CI/CD pipeline scanning is implemented via .github/workflows/security-scan.yml (Trivy container scanning + SAST); this Lula validation covers the continuous in-cluster scanning requirement per NIST RA-5 continuous monitoring. The sbom-cronjob (deployment/k8s/sbom-cronjob.yaml) provides the in-cluster CronJob evidence. Apply it with: kubectl apply -f deployment/k8s/sbom-cronjob.yaml See: compliance/continuous-monitoring/ISCM_STRATEGY.md — RA-5 monitoring cadence. See: docs/POAM.md — RA-5 POAM remediation item.'
  components:
  - uuid: aee40988-d903-59fe-abef-2e2d24a084fa
    type: software
    title: CAGE Cybernetic Governance Engine
    description: The Cybernetic AI Governance Engine (CAGE) — AI governance gateway, compliance bridge, and governed financial advisor.
    control-implementations:
    - uuid: 6957afe5-394b-5641-b059-4d210795dc00
      source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
      description: 'Control implementation for RA5. Region: US_FED. Posture: nist-sp800-53.'
      implemented-requirements:
      - uuid: 4647ae49-b402-5fcd-919b-8a39244aa7f6
        control-id: ra5
        description: Automated lula validation for RA5.
        links:
        - href: '#7a32a7bb-2f37-54ce-a16f-1435d2607512'
          rel: lula
  back-matter:
    resources:
    - uuid: 7a32a7bb-2f37-54ce-a16f-1435d2607512
      title: Lula Validation — RA5
      rlinks:
      - href: lula.dev
      description: "domain:\n  type: kubernetes\n  kubernetes-spec:\n    resources:\n    - name: security-scanner-cronjob\n      resource: cronjobs\n      namespace: governance-stack\nprovider:\n  type: opa\n  opa-spec:\n    rego: \"package lula\\n\\nimport future.keywords.if\\n\\n# RA-5: Vulnerability Monitoring and Scanning\\n# Verifies a security scanning CronJob is present in the cluster.\\n# The CronJob should run Trivy or equivalent vulnerability scanner on a\\n# regular schedule (minimum weekly per ISCM cadence).\\n# NOTE: This is a structural assertion — it confirms the scanner is deployed.\\n# Review CronJob execution history separately for scan result evidence.\\nvalidate if {\\n  input[\\\"security-scanner-cronjob\\\"].metadata.name != null\\n  input[\\\"security-scanner-cronjob\\\"].spec.schedule != null\\n}\\n\"\n"