In a CNAPP context, policies are rules and configurations that define how cloud resources should be secured and governed. They act as guardrails for automated security and compliance enforcement.
A basic understanding of our glossary, compliance frameworks, job roles and unified cloud security categories is required.
Policies for Cloud Security, Compliance & More
Key Policy Types
Here are key types of policies you’ll find in CNAPP platforms:
- Security posture policies
Define expected secure configuration standards for cloud resources, such as enforcing encryption, disabling public access, or specifying network rules. These help prevent misconfiguration issues. - Compliance policies
Map cloud configurations to regulatory or standards requirements (e.g., PCI-DSS, GDPR). The CNAPP continuously checks conformance and flags or remediates violations. - Access and entitlement policies
Govern identity and permissions (e.g., least privilege), often via integrated Cloud Infrastructure Entitlement Management (CIEM) tools. These policies help control who can do what in cloud environments. - Infrastructure-as-Code (IaC) policies
Define rules for IaC templates (e.g., Terraform) to prevent insecure constructs from ever reaching production. - Automated remediation policies
Some CNAPPs allow policy-based automation so that when a rule is violated, the platform automatically corrects or quarantines the issue.
Why these matter:
Policies ensure that cloud security practices are consistent, automated, enforceable across environments (AWS, Azure, GCP, etc.), and integrated into DevOps workflows rather than being manual checklists.
Policies in AI-Related Security / AI Governance
There isn’t a standard industry term “AI NAPP,” but in the context of AI security and governance, “policies” refer to rules that govern the secure, responsible, and compliant use of AI systems. These serve a similar purpose as policies in CNAPP — but focused on AI risks.
Types of Policies in AI Security / Governance
Organizations typically define the following:
1. AI Acceptable Use Policies (AI AUP)
Rules that determine how employees and systems may safely interact with AI tools. They often govern what data can be input, what outputs are permitted, and what uses are prohibited (e.g., no secret or PII uploads to public AI).
Key elements include:
- Scope of use and authorized tools
- Data handling and privacy rules
- Prohibited behaviors
- Approval and monitoring requirements
2. AI Security Policies
Rules focused on protecting AI systems themselves — including securing models, data, training pipelines and runtime environments against threats such as:
- Adversarial attacks
- Data poisoning
- Unauthorized access
- Model theft
- Runtime misuse
These policies often include:
- Access controls
- Encryption/secure storage
- Monitoring and logging
- Incident response procedures
- Bias and fairness checks
3. Model Governance / Ethical AI Policies
Rules that ensure AI decisions are explainable, auditable, fair, and compliant with regulations (e.g., the EU AI Act), and outline accountability and oversight.
These include things like:
- Transparency requirements
- Bias detection and mitigation
- Documentation of training data and lineage
How CNAPP & AI Policies Compare
Policy Area | CNAPP | AI / AI Governance |
|---|---|---|
Purpose | Secure cloud resources & compliance across cloud lifecycle | Secure and govern AI systems and their use |
Focus | Infrastructure configs, workload security, identities, misconfigurations | AI model integrity, data security, responsible use |
Automation | Automated enforcement of cloud security rules | Automation is emerging; often policy + human oversight |
Examples | CSPM rules, CIEM/least privilege, IaC validation | AI acceptable use policies, secure development policies, fairness/ethics policies |
Summary
CNAPP policies are formal rules within cloud security platforms that define how cloud infrastructure, workloads, identities, and configurations should meet security and compliance requirements — and often automate enforcement.
AI-related policies (what some might mean by “AI NAPP policies” or AI governance/security policies) are rules that govern the secure development, deployment, and responsible use of AI systems, including acceptable use, access control, model integrity, fairness, and compliance.