ComplianceTarget

A compliance obligation the organisation holds itself to, and how often Vulnetix measures it. For the report frameworks (eu_ai_act, nist_ai_rmf, iso_42001, owasp_top_10, pci_dss, coverage, exposure, eu_cra, iso_27001, owasp_dsomm) each run creates a compliance report for the period, scoped to the repositories named, through the same machinery as a report made by hand, so the OSCAL export, the evidence and the assessor workflow are unchanged. For the three evaluated targets there is no report: each run stores an evaluation. slsa checks the evidence for a SLSA build level; ssdf checks the NIST SP 800-218 practices Vulnetix holds evidence for; crypto-policy evaluates a cryptography policy, written in CEL over the components of the Cryptography Bill of Materials, against the newest CBOM of each repository in scope. The first run is due when the target is created and later runs follow the cadence. Needs the saas migration 20261228040000_compliance_target; until it is applied, plan refuses a document naming it.

apiVersion	vulnetix.com/v1
kind	ComplianceTarget
Group	Compliance
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists ComplianceTarget in its kinds. See Management tokens.
CEL fields	spec.crypto.allow (cbom), spec.crypto.appliesTo (cbom): see CEL rule expressions
Terraform resource	vulnetix_compliance_target, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v4.1.1 and later.
Pinned schema	v1.15.0/ComplianceTarget.schema.json
Newest schema	latest/ComplianceTarget.schema.json
First released in	v1.11.0
Print the built-in copy	vulnetix config schema ComplianceTarget

Minimal

Only the fields the kind requires. From examples/ComplianceTarget/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ComplianceTarget.schema.json
apiVersion: vulnetix.com/v1
kind: ComplianceTarget
metadata:
  name: quarterly-owasp
spec:
  framework: owasp_top_10

HCL (resource vulnetix_compliance_target)

# Only the arguments the kind requires. From config-schemas examples/ComplianceTarget/minimal.yaml.

resource "vulnetix_compliance_target" "quarterly_owasp" {
  name      = "quarterly-owasp"
  framework = "owasp_top_10"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ComplianceTarget.schema.json
apiVersion: vulnetix.com/v1
kind: ComplianceTarget
metadata:
  name: quarterly-owasp
spec:
  framework: owasp_top_10
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/ComplianceTarget/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ComplianceTarget.schema.json
apiVersion: vulnetix.com/v1
kind: ComplianceTarget
metadata:
  name: eu-ai-act-payments
  labels:
    team: governance
  annotations:
    ticket: https://tracker.example.com/GRC-77
spec:
  framework: eu_ai_act
  cadence: quarterly
  scope:
    repositories: [acme/payments-api, acme/fraud-model]
  enabled: true
  report:
    title: EU AI Act, payments
    context: The organisation is the provider of a high-risk credit scoring system (Annex III, 5b).
---
apiVersion: vulnetix.com/v1
kind: ComplianceTarget
metadata:
  name: slsa-build-l2
spec:
  framework: slsa
  cadence: monthly
  slsa:
    level: 2
---
apiVersion: vulnetix.com/v1
kind: ComplianceTarget
metadata:
  name: ssdf-core
spec:
  framework: ssdf
  cadence: quarterly
  ssdf:
    practices: [PS, PW, RV]
    minMet: 80
---
apiVersion: vulnetix.com/v1
kind: ComplianceTarget
metadata:
  name: pqc-readiness
spec:
  framework: crypto-policy
  cadence: monthly
  crypto:
    allow: quantumSafe || (primitive in ['block-cipher', 'hash', 'mac'] && classicalSecurityLevel >= 128)
    appliesTo: category == 'algorithm' && confidence != 'low'
    maxViolations: 0

HCL (resource vulnetix_compliance_target)

# Every argument the kind supports. From config-schemas examples/ComplianceTarget/advanced.yaml.

resource "vulnetix_compliance_target" "eu_ai_act_payments" {
  name      = "eu-ai-act-payments"
  cadence   = "quarterly"
  enabled   = true
  framework = "eu_ai_act"
  report = {
    context = "The organisation is the provider of a high-risk credit scoring system (Annex III, 5b)."
    title   = "EU AI Act, payments"
  }
  scope = {
    repositories = ["acme/payments-api", "acme/fraud-model"]
  }
  labels = {
    team = "governance"
  }
  annotations = {
    ticket = "https://tracker.example.com/GRC-77"
  }
}

resource "vulnetix_compliance_target" "slsa_build_l2" {
  name      = "slsa-build-l2"
  cadence   = "monthly"
  framework = "slsa"
  slsa = {
    level = 2
  }
}

resource "vulnetix_compliance_target" "ssdf_core" {
  name      = "ssdf-core"
  cadence   = "quarterly"
  framework = "ssdf"
  ssdf = {
    min_met   = 80
    practices = ["PS", "PW", "RV"]
  }
}

resource "vulnetix_compliance_target" "pqc_readiness" {
  name    = "pqc-readiness"
  cadence = "monthly"
  crypto = {
    allow          = "quantumSafe || (primitive in ['block-cipher', 'hash', 'mac'] && classicalSecurityLevel >= 128)"
    applies_to     = "category == 'algorithm' && confidence != 'low'"
    max_violations = 0
  }
  framework = "crypto-policy"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ComplianceTarget.schema.json
apiVersion: vulnetix.com/v1
kind: ComplianceTarget
metadata:
  name: eu-ai-act-payments
  labels:
    team: governance
  annotations:
    ticket: https://tracker.example.com/GRC-77
spec:
  framework: eu_ai_act
  cadence: quarterly
  scope:
    repositories: [acme/payments-api, acme/fraud-model]
  enabled: true
  report:
    title: EU AI Act, payments
    context: The organisation is the provider of a high-risk credit scoring system (Annex III, 5b).
---
apiVersion: vulnetix.com/v1
kind: ComplianceTarget
metadata:
  name: slsa-build-l2
spec:
  framework: slsa
  cadence: monthly
  slsa:
    level: 2
---
apiVersion: vulnetix.com/v1
kind: ComplianceTarget
metadata:
  name: ssdf-core
spec:
  framework: ssdf
  cadence: quarterly
  ssdf:
    practices: [PS, PW, RV]
    minMet: 80
---
apiVersion: vulnetix.com/v1
kind: ComplianceTarget
metadata:
  name: pqc-readiness
spec:
  framework: crypto-policy
  cadence: monthly
  crypto:
    allow: quantumSafe || (primitive in ['block-cipher', 'hash', 'mac'] && classicalSecurityLevel >= 128)
    appliesTo: category == 'algorithm' && confidence != 'low'
    maxViolations: 0
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly ComplianceTarget	Always ComplianceTarget.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.framework	string	yes		eu_ai_act, nist_ai_rmf, iso_42001, owasp_top_10, pci_dss, coverage, exposure, eu_cra, iso_27001, owasp_dsomm, slsa, ssdf, crypto-policy	What is measured. A report framework creates a report on each run. slsa, ssdf and crypto-policy are evaluated and need their block below.
spec.cadence	string	no	quarterly	weekly, monthly, quarterly, yearly	How often it runs. The period of a report, or the window an evaluation looks back over, is the cadence before the run: a week, a month, a quarter or a year.
spec.scope	object	no		no other keys	What is measured. Left out, the whole organisation.
spec.scope.repositories	array of string	no	[]	0 to 200 items; items unique; each item: pattern ^[^\s/]+(/[^\s/]+)+$	Only these repositories (owner/name), compared without regard to case. Left out or empty, every repository.
spec.enabled	boolean	no	true		False keeps the target and its history and stops it running.
spec.report	object	no		no other keys	For a report framework: how the report is made.
spec.report.title	string	no		length 1 to 200	The report’s name; the period is appended. Left out, the target’s name.
spec.report.context	string	no		length 0 to 8000	The report’s context text. For eu_ai_act this describes the AI system and the organisation’s role (provider or deployer) and risk class, which the Act’s obligations depend on.
spec.slsa	object	no		no other keys	For framework slsa. Evaluated against the evidence Vulnetix holds: provenance records for the dependencies in scope, signatures and attestations on what the organisation publishes, and the Software Factory’s minimum SLSA level (ScannerProfile slsaMin). Level 3 asks for what a hardened build platform leaves behind (verified provenance, witnessed signatures); Vulnetix cannot inspect the platform itself, so a pass says the evidence is there.
spec.slsa.level	integer	yes		1 to 3	The SLSA Build level targeted: 1 provenance exists, 2 signed and verified provenance, 3 hardened build with witnessed signatures.
spec.ssdf	object	no		no other keys	For framework ssdf. Checks the practices of NIST SP 800-218 that Vulnetix holds evidence for; a practice without evidence is not in the count.
spec.ssdf.practices	array of string	no		1 to any items; items unique; each item: PO, PS, PW, RV	The practice groups checked: PO prepare the organisation, PS protect the software, PW produce well-secured software, RV respond to vulnerabilities. Left out, all four.
spec.ssdf.minMet	integer	no	100	1 to 100	The percentage of the checked practices that must be met for the target to pass.
spec.crypto	object	no		no other keys	For framework crypto-policy. A component of the CBOM is acceptable when allow holds for it.
spec.crypto.allow	string	yes		length 1 to 4096	CEL over the cbom variables: true for a component the policy allows, such as quantumSafe || (primitive == 'block-cipher' && classicalSecurityLevel >= 128). A component the expression is false for, or cannot be evaluated for, is a violation.
spec.crypto.appliesTo	string	no	category == 'algorithm'	length 1 to 4096	CEL over the cbom variables: which components the policy judges. Left out, algorithms only (category == 'algorithm').
spec.crypto.maxViolations	integer	no	0	0 to 100000	How many violations still pass.

Rules

Conditions the schema enforces beyond each field’s own type. vulnetix config validate and the engine’s plan report a document that breaks one.

On	Rule
spec	When framework is slsa: slsa is required.
spec	When framework is crypto-policy: crypto is required.

CEL variables

spec.crypto.allow and spec.crypto.appliesTo are CEL expressions in the cbom context, returning bool. It is evaluated by the Vulnetix site API at every run of the target, once for each component of the newest CBOM of each repository in scope (at most 20000 components). Fails closed for crypto.allow: a component it cannot be evaluated for is a violation, because an unassessed algorithm must not pass a policy. A crypto.appliesTo that fails leaves the component in scope. See where each expression is evaluated. The functions, limits and error codes are on CEL rule expressions.

Variable	Type	Bound	Description
name	string	512 chars	The component’s name as the inventory records it: AES-256-GCM, RSA-2048, ML-KEM-768, a certificate subject, or a library name.
category	string	64 chars	algorithm, certificate, key or library.
assetType	string	64 chars	The CycloneDX cryptographic asset type: algorithm, certificate, related-crypto-material, or empty for a library.
oid	string	256 chars	The algorithm’s OID, such as 2.16.840.1.101.3.4.1.46, or empty when unknown.
primitive	string	64 chars	The CycloneDX cryptographic primitive: ae, block-cipher, stream-cipher, hash, mac, kdf, drbg, signature, pke, kem, key-agree, xof, combiner, other, or empty.
parameterSetIdentifier	string	256 chars	The parameter set: a key size such as 256, a curve such as P-256, or a named set such as ML-DSA-65. Empty when none.
classicalSecurityLevel	int		Classical security strength in bits. 0 when unknown.
nistQuantumSecurityLevel	int		The NIST post-quantum security category, 1 to 5 (6 for a hybrid that meets the highest). 0 when the algorithm offers none, or when unknown.
pqcStatus	string	64 chars	quantum-safe, quantum-vulnerable, deprecated, hybrid, or empty when not assessed.
quantumSafe	bool		Derived. True when pqcStatus is quantum-safe or hybrid, the set the Crypto Inventory counts as safe.
deprecated	bool		Derived. True when pqcStatus is deprecated.
standards	map(string, string)	20 keys, keys and values of 256 chars	Each standards body’s verdict on the algorithm, by body: standards['NIST'] is approved, deprecated, disallowed and so on. The bodies the catalogue knows include NIST, BSI and CNSA 2.0. Empty for a component with none.
provider	string	512 chars	The library or implementation that provides it, such as openssl or golang.org/x/crypto.
purl	string	2048 chars	Package URL of the providing library, when known.
confidence	string	64 chars	How sure the detection is: high, medium, low, or empty.
repo	string	512 chars	Repository full name, owner/name, of the scan the component was found in.
branch	string	512 chars	Branch of that scan.
now	timestamp		The time of evaluation. Callers may fix it; otherwise it is the clock when Eval runs.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How apply treats it

• A report framework (eu_ai_act, nist_ai_rmf, iso_42001, owasp_top_10, pci_dss, coverage, exposure, eu_cra, iso_27001, owasp_dsomm) creates a compliance report on each run, through the code a report made by hand uses, scoped to scope.repositories. The OSCAL export and the evidence are unchanged.
• slsa, ssdf and crypto-policy make no report: each run stores an evaluation with its checks, and the history is kept.
• The spec reads back with cadence and enabled written and the blocks of other frameworks absent, the repositories lower-cased and sorted.
• A new target is due at once. Each run schedules the next one cadence later, a failed run is tried again in an hour, and a changed cadence moves the next run. Delete removes the target and its runs and keeps the reports it created.
• It needs the compliance reports plan feature and saas migration 20261228040000_compliance_target. Until it runs, plan refuses a document, naming the migration, and nothing runs.

The evaluations

• slsa. Level 1 asks for build provenance; level 2 adds verified provenance and signed published artifacts; level 3 adds witnessed signatures and verified attestations. Each level also checks the Software Factory’s security.slsa_min. A pass means the evidence a hardened build platform leaves is there, since Vulnetix cannot inspect the platform.
• ssdf. Fourteen NIST SP 800-218 practices Vulnetix holds evidence for, in the groups PO, PS, PW and RV. A practice with no evidence is not counted. minMet is the percentage of counted practices that must be met. It is not a conformance claim.
• crypto-policy. crypto.allow is evaluated for each component of the newest CBOM of each repository in scope that crypto.appliesTo selects. A component it is false for, or cannot be evaluated for, is a violation, so the policy fails closed. A run with nothing to judge is unknown.

Terraform and OpenTofu

The resource is vulnetix_compliance_target in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_compliance_target.

Import an object that already exists by its name:

# Import an existing ComplianceTarget by its name (metadata.name).
terraform import vulnetix_compliance_target.quarterly_owasp quarterly-owasp

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.