> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/create-sbom-policies.md).

# Create SBOM policies

Create SBOM policies using OPA.

This document provides a step-by-step guide on how to create SBOM Policies. Go to [write policy definitions](/software-supply-chain-assurance/troubleshooting-and-resources/how-to-guides/define-sbom-policies.md) to learn how to write these policies. Go to [enforcing SBOM policies](/software-supply-chain-assurance/use-scs/open-source-management/enforce-sbom-policies.md) to implement them.

{% embed url="<https://youtu.be/u1QxLMUvrPU?si=a7w8h-NJ58n34xW0>" %}

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

Review the following before you create SBOM policies:

* **Policy as Code overview:** Go to [Harness Policy as Code - Overview](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-overview.md) to understand the governance framework.
* **Policy as Code quickstart:** Go to [Harness Policy as Code - Quickstart](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-quickstart.md)

The Harness Policy Library provides sample policies that simplify the process of creating and enforcing them against SBOM. The following describes how to use these samples for policy creation.

{% hint style="info" %}
Policies can be created at the account, organization, and project levels, this guide will focus on creating a policy at the account level. Go to the [overview guide](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-overview.md) to craft policies for the organization and project levels, which outlines a similar process.
{% endhint %}

### Create an SBOM policy <a href="#create-an-sbom-policy" id="create-an-sbom-policy"></a>

1. Navigate to Account Settings > Security and Governance > Policies within your Harness Account, and select "Policies" from the options in the top right corner. Then, click on the "+New Policy" button.
2. In the policy creation window, name the policy "SBOM allow and deny List" and click "Create."

![SBOM policy create step](https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2Fgit-blob-e367ddf027e9d55d85476b1d9c2fc380005a3b72%2Fsom-policy-create.png?alt=media)

3. You can then browse the library of sample policies by searching for **SBOM** and select the appropriate option according to your needs.

![SBOM Sample policies](https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2Fgit-blob-b96dec4a50fdb5054f0aa93ac41a5e73fc9861e9%2Fsample-policies-sbom.png?alt=media)

Preview the sample policy of your choice and click on "Use this sample" to proceed.

![Use this sample](https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2Fgit-blob-6dd192b40979dcd406383043499cdbc20d8ffd97%2Fuse-this-sample-page.png?alt=media)

After selecting the sample, you can modify it as needed and then test the changes to ensure it meets your requirements.

### Create an SBOM policy set <a href="#create-an-sbom-policy-set" id="create-an-sbom-policy-set"></a>

Policies take effect only when they are added into a Policy Set. Within a Policy Set, policies are organized and linked to a specific Harness entity, such as SBOM, in this context. For a policy to be enforced, it must be part of a Policy Set.

To create an SBOM Policy Set, follow these steps:

1. Navigate to Account Settings > Security and Governance > Policies within your Harness Account, and select "Policies"
2. Select “Policy Sets” from the options in the top right corner, then click on the “+New Policy Set” button.
3. Name the policy set and choose “SBOM” for the “Entity Type that this policy set applies to” field.

![SBOM Entity type selection](https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2Fgit-blob-99bfa36625c92b2230745a78e7740d387c59b1b2%2Ftmp.png?alt=media)

Set the "On what event should the policy set be evaluated" option to "On Step" and click continue.

Next, you can define what should happen if a policy fails, you can set it to

* **Warn and continue**: The step will warn about the policy violation and continues the execution.
* **Error and exit**: The step throws and error and terminates the pipeline execution. You can handle this by setting a failure strategy.

![SBOM Policy evaluation criteria](https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2Fgit-blob-e2c5c7062008b1b4486081ff7a0d652c73b449b1%2Fsbom-policy-criteria.png?alt=media)

Then, click on the "+ add policy" button to proceed with adding policies to your Policy Set.

![Policy list](https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2Fgit-blob-ddc313d880a4c14ded95ebe6cab8385fd72639ab%2Fpolicy-list.png?alt=media)

Select the necessary policies you wish to include in the set and add them. You have the option to specify the action to be taken if a policy fails, by choosing either “Error and exit” or “Warn and continue.” After making your selections, click "Apply" and then "Finish"

This process will create a new policy set comprising all the selected policies. You can then select this policy set during the SBOM Enforcement step. Go to [Enforce SBOM Policies](/software-supply-chain-assurance/use-scs/open-source-management/enforce-sbom-policies.md) to enforce SBOM policies.

{% @harness-feedback/feedback %}