> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cysmiq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create and enforce a policy

> Define a custom security policy, preview its matches, and manage the resulting violations.

Policies turn security data into consistent rules for monitoring and enforcement. When a policy matches a target, Cysmiq creates a policy violation for review and follow-up.

## Prerequisites

* A workspace with scanned security data
* Workspace owner permission to create and manage policies

<Info>Availability depends on your Cysmiq plan.</Info>

## Steps

<Steps>
  <Step title="Start a custom policy">
    Open **Settings**, select **Policies**, then select **New policy**. In **Basics**:

    * Enter a name that describes the rule's intent.
    * Choose the target type, such as **Vulnerability**, **Package**, or **Manifest**.
    * Keep the policy **Active** when it should evaluate current data.
    * Choose whether it applies everywhere by default or only where it is explicitly bound.
    * Select **Monitor**, **Warn**, or **Block** for its enforcement behavior.

    This example blocks critical and high-severity vulnerability matches.
  </Step>

  <Step title="Build the match criteria">
    In **Match**, select fields, operators, and values. Use nested groups when the policy needs several conditions:

    * **All** requires every item in the group to match.
    * **Any** requires at least one item to match.
    * **None** requires every item in the group to remain unmatched.

    <Frame caption="A custom vulnerability policy matching critical and high severities.">
      <img src="https://mintcdn.com/cysmiq/jILg5Q1KdyGSo81w/images/guides/create-policy/create-policy-01-match.webp?fit=max&auto=format&n=jILg5Q1KdyGSo81w&q=85&s=14d27ae6af5f732ecd41899a31ab033b" alt="Policy creation wizard showing an All group where vulnerability severity is in critical or high." width="2880" height="1300" data-path="images/guides/create-policy/create-policy-01-match.webp" />
    </Frame>

    Use the [Policy condition fields](/reference/policy-condition-fields) reference for supported fields, operators, and values.
  </Step>

  <Step title="Configure the response">
    In **Response**, optionally set an SLA window and notification recipients. The enforcement mode controls how matched violations affect connected workflows:

    * **Monitor** records violations without warning or blocking.
    * **Warn** surfaces warning-level enforcement.
    * **Block** surfaces blocking enforcement.

    Review the summary, then create the policy.
  </Step>

  <Step title="Preview matches">
    Open the policy and select **Dry run**. Choose a repository and run the preview to see current matches using the unsaved match criteria. A dry run does not create policy violations.

    <Frame caption="A dry run finding one blocking match in the storefront repository.">
      <img src="https://mintcdn.com/cysmiq/jILg5Q1KdyGSo81w/images/guides/create-policy/create-policy-02-dry-run.webp?fit=max&auto=format&n=jILg5Q1KdyGSo81w&q=85&s=0174b6b90f5a369f64d48f41196abe94" alt="Policy dry-run results showing one blocking Flask debug vulnerability match." width="1588" height="796" data-path="images/guides/create-policy/create-policy-02-dry-run.webp" />
    </Frame>

    Review the matched target, scope, enforcement, and context before saving policy changes.
  </Step>

  <Step title="Review policy violations">
    Open **Policy Violations** to review active matches across the workspace. The table shows the policy, status, scope, target, timing, and assignee.

    <Frame caption="A blocking policy violation created from the high-severity rule.">
      <img src="https://mintcdn.com/cysmiq/jILg5Q1KdyGSo81w/images/guides/create-policy/create-policy-03-violation.webp?fit=max&auto=format&n=jILg5Q1KdyGSo81w&q=85&s=45fc8bdf06b4b9baee7702e8f9b1a342" alt="Policy Violations page showing an open blocking violation for the Flask debug vulnerability." width="2880" height="860" data-path="images/guides/create-policy/create-policy-03-violation.webp" />
    </Frame>

    Open a violation to assign an owner, review its scope and target, request or apply a snooze when available, and record the final decision. See [Policy violations](/policies/violations) for the complete lifecycle.
  </Step>
</Steps>

## Related documentation

* [Policies](/policies/overview)
* [Custom policies](/policies/custom-policies)
* [Policy violations](/policies/violations)
* [Policy condition fields](/reference/policy-condition-fields)