> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-policies/create-cicd-configuration-policies.md). # Create CI/CD configuration policies CI/CD configuration policies scan your CI/CD and Version Control System (VCS) environments to detect and enforce standards against misconfigurations and risky settings in pipelines, workflows and VCS systems (such as GitHub). #### Prioritize risk with application context By leveraging application context, you can create Scope-Based Access Control (SBAC) policies that align security enforcement with each application's purpose, business sensitivity, and lifecycle, ensuring targeted and effective risk management that allows you to focus efforts on high-impact issues and reduces noise. For more information about creating application-scoped policies, refer to [Scope user access to applications (Application SBAC)](/application-security/application-security-posture-management-aspm/applications/scope-user-access-to-applications-application-sbac.md). ## Steps 1. Under **Modules**, select **Application Security** → **AppSec Policies** → **+ Add Policy**. 2. On the **General** step of the policy creation wizard. 1. Select **CI/CD Configuration Scanners** as the policy type. 2. Provide a policy name (required) and description. 3. Click **Next**. 3. On the **Conditions** step of the wizard, define the conditions that apply to the policy. By default, **CI/CD Risk** is selected as the Finding Type. 1. Click `+` to define CI/CD condition attributes. Adding attributes allows you to narrow and refine findings, creating a tailored policy that targets the specific risk patterns you want to address. You can also use the `AND/OR` options to build more precise logic: each `AND` bracket defines a set of conditions that must all be met, and multiple brackets can be combined with `OR` to evaluate different sets of conditions independently. Refer to [Reference A: CI/CD policy Condition attributes](/application-security/software-supply-chain-security/governance-and-enforcement/cicd-policies/reference-a-ci-cd-policy-condition-attributes.md) for more information about condition attributes. 2. Select **Next**. 4. On the **Scope** step of the wizard. Limit policy evaluation to relevant assets: {% tabs %} {% tab title="Asset types" %} Use **Asset Types** to limit policy evaluation to relevant assets. Select **Asset Types** → **Add Filters** → select an **asset type** → select or provide a value from the matching **Value** field. For supported asset types and values, refer to [Reference B:Scope Asset Types](/application-security/software-supply-chain-security/governance-and-enforcement/cicd-policies/reference-b-scope-asset-types.md). {% endtab %} {% tab title="Asset groups" %} Select **Asset Groups**: * Select the asset groups on which this policy and its chosen detection rules will be evaluated. You can only select asset groups that are assigned to you as part of your scope. * The policy is evaluated only on the relevant assets within the selected group, based on the asset types defined in the category filter. For more information about Cortex Cloud Application Security **Asset Groups**, refer to [Scope user access to applications (Application SBAC)](/application-security/application-security-posture-management-aspm/applications/scope-user-access-to-applications-application-sbac.md). {% endtab %} {% endtabs %} Click **Next**. 5. On the **Triggers & Action** step of the wizard. 1. Verify that **Periodic Scan** (required) is selected by default.

Note

Periodic scan is the only trigger that is supported for CI/CD policies.

2. Verify that **Create an Issue** (required) is selected by default) 3. (Optional): Select **Override Severity** to apply a severity level other than the default. 4. Click Next. 6. On the **Summary** step of the wizard: Review the policy settings and click Done. This step provides an overview of the configured policy, including its name and description, the configured scope, and a table of conditions, triggers, and actions. It also displays the user who created the policy and the creation date. You can view the custom policy that you created in the general policies table on the **AppSec Policies** page. ## Next step: Investigate and remediate repository and pipeline Investigate and remediate issues detected in your VCS configurations and CI/CD infrastructure to mitigate risks across your development lifecycle and delivery process. For more information, refer to [CI/CD Risks](/application-security/software-supply-chain-security/risk-and-remediation/cicd-risks.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-policies/create-cicd-configuration-policies.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.