Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared

No violationsstackroxmediumdeploy

When HostNetwork is enabled the container is not placed inside a separate network stack. The container's networking is not containerized when this option is applied. The consequence of this is that the container has full access to the host's network interfaces. It also enables a shared UTS namespace. The UTS namespace provides isolation between two system identifiers: the hostname and the NIS domain name. It is used to set the hostname and the domain which are visible to running processes in that namespace. Processes running within containers do not typically require to know either the hostname or the domain name. The UTS namespace should therefore not be shared with the host.

Rationale: Selecting this option is potentially dangerous. It allows the container process to open reserved low numbered ports in the way that any other root process can. It also allows the container to access network services such as D-bus on a Docker host. A container process could potentially carry out undesired actions, such as shutting down the host. The container will also share the network namespace with the host, providing full permission for each container to change the hostname of the host. This is not in line with good security practice and should not be permitted.
Remediation: You should not create a deployment with `hostNetwork: true`

CategoriesDocker CIS

Compliance mappingsView coverage →

CIS Kubernetes Benchmark v1.8: 5.2.4
DORA EU 2022/2554: Art. 9.2
ISO/IEC 27001 2022: A.8.9
NIST SP 800-53 rev. 5: CM-2
PCI DSS 4.0: 2.2.1
SOC 2 2017 TSC: CC6.1

Generated artifacts

3 of 5 targets supported

docker-cis-5-9-and-5-20-ensure-that-the-host-s-network-namespac.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: docker-cis-5-9-and-5-20-ensure-that-the-host-s-network-namespac
  annotations:
    policies.kyverno.io/title: "Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared"
    policies.kyverno.io/category: Docker CIS
    policies.kyverno.io/severity: medium
    policies.kyverno.io/description: "When HostNetwork is enabled the container is not placed inside a separate network stack. The container's networking is not containerized when this option is applied. The consequence of this is that the container has full access to the host's network interfaces. It also enables a shared UTS namespace. The UTS namespace provides isolation between two system identifiers: the hostname and the NIS domain name. It is used to set the hostname and the domain which are visible to running processes in that namespace. Processes running within containers do not typically require to know either the hostname or the domain name. The UTS namespace should therefore not be shared with the host."
    policies.kyverno.io/remediation: "You should not create a deployment with `hostNetwork: true`"
    policies.kyverno.io/rationale: Selecting this option is potentially dangerous. It allows the container process to open reserved low numbered ports in the way that any other root process can. It also allows the container to access network services such as D-bus on a Docker host. A container process could potentially carry out undesired actions, such as shutting down the host. The container will also share the network namespace with the host, providing full permission for each container to change the hostname of the host. This is not in line with good security practice and should not be permitted.
    policies.io/source: stackrox
    policies.io/source-id: 6226d4ad-7619-4a0b-a160-46373cfcee66
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: docker-cis-5-9-and-5-20-ensure-that-the-host-s-net
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Policy \"Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared\" violated: When HostNetwork is enabled the container is not placed inside a separate network stack. The container's networking is not containerized when this option is applied. The consequence of this is that the container has full access to the host's network interfaces. It also enables a shared UTS namespace. The UTS namespace provides isolation between two system identifiers: the hostname and the NIS domain name. It is used to set the hostname and the domain which are visible to running processes in that namespace. Processes running within containers do not typically require to know either the hostname or the domain name. The UTS namespace should therefore not be shared with the host."
        deny:
          conditions:
            all:
              - key: "{{ request.object.spec.hostNetwork || `false` }}"
                operator: Equals
                value: true
      exclude:
        any:
          - resources:
              namespaces:
                - openshift-cloud-controller-manager
          - resources:
              namespaces:
                - openshift-cluster-csi-drivers
          - resources:
              namespaces:
                - openshift-cluster-csi-drivers
          - resources:
              namespaces:
                - openshift-cluster-machine-approver
          - resources:
              namespaces:
                - openshift-ovn-kubernetes
          - resources:
              namespaces:
                - openshift-ovn-kubernetes
          - resources:
              namespaces:
                - openshift-cloud-controller-manager-operator
          - resources:
              namespaces:
                - openshift-dns
          - resources:
              namespaces:
                - openshift-cluster-csi-drivers
          - resources:
              namespaces:
                - openshift-cluster-csi-drivers
          - resources:
              namespaces:
                - openshift-cluster-csi-drivers
          - resources:
              namespaces:
                - openshift-cluster-csi-drivers
          - resources:
              namespaces:
                - kube-system
          - resources:
              namespaces:
                - openshift-kube-apiserver
          - resources:
              namespaces:
                - openshift-kube-scheduler
          - resources:
              namespaces:
                - openshift-kube-controller-manager
          - resources:
              namespaces:
                - openshift-sdn
          - resources:
              namespaces:
                - openshift-network-operator
          - resources:
              namespaces:
                - openshift-multus
          - resources:
              namespaces:
                - openshift-cluster-version
          - resources:
              namespaces:
                - openshift-image-registry
          - resources:
              namespaces:
                - openshift-etcd
          - resources:
              namespaces:
                - openshift-machine-config-operator
          - resources:
              namespaces:
                - openshift-monitoring
          - resources:
              namespaces:
                - openshift-machine-api
          - resources:
              namespaces:
                - openshift-cluster-node-tuning-operator
          - resources:
              namespaces:
                - openshift-vsphere-infra
          - resources:
              namespaces:
                - openshift-vsphere-infra
          - resources:
              namespaces:
                - openshift-vsphere-infra
          - resources:
              namespaces:
                - openshift-vsphere-infra
          - resources:
              namespaces:
                - openshift-vsphere-infra
          - resources:
              namespaces:
                - openshift-ingress
          - resources:
              namespaces:
                - openshift-cluster-csi-drivers
          - resources:
              namespaces:
                - openshift-cluster-csi-drivers
          - resources:
              namespaces:
                - openshift-network-node-identity
          - resources:
              namespaces:
                - openshift-ovn-kubernetes
          - resources:
              namespaces:
                - openshift-cloud-controller-manager

IR (canonical)

{
  "id": "6226d4ad-7619-4a0b-a160-46373cfcee66",
  "name": "Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared",
  "description": "When HostNetwork is enabled the container is not placed inside a separate network stack. The container's networking is not containerized when this option is applied. The consequence of this is that the container has full access to the host's network interfaces. It also enables a shared UTS namespace. The UTS namespace provides isolation between two system identifiers: the hostname and the NIS domain name. It is used to set the hostname and the domain which are visible to running processes in that namespace. Processes running within containers do not typically require to know either the hostname or the domain name. The UTS namespace should therefore not be shared with the host.",
  "rationale": "Selecting this option is potentially dangerous. It allows the container process to open reserved low numbered ports in the way that any other root process can. It also allows the container to access network services such as D-bus on a Docker host. A container process could potentially carry out undesired actions, such as shutting down the host. The container will also share the network namespace with the host, providing full permission for each container to change the hostname of the host. This is not in line with good security practice and should not be permitted.",
  "remediation": "You should not create a deployment with `hostNetwork: true`",
  "severity": "medium",
  "categories": [
    "Docker CIS"
  ],
  "lifecycle": [
    "deploy"
  ],
  "eventSource": "none",
  "scope": [],
  "exclusions": [
    {
      "name": "gcp-cloud-controller-manager",
      "namespace": "openshift-cloud-controller-manager"
    },
    {
      "name": "gcp-pd-csi-driver-controller",
      "namespace": "openshift-cluster-csi-drivers"
    },
    {
      "name": "gcp-pd-csi-driver-node",
      "namespace": "openshift-cluster-csi-drivers"
    },
    {
      "name": "machine-approver",
      "namespace": "openshift-cluster-machine-approver"
    },
    {
      "name": "ovnkube-master",
      "namespace": "openshift-ovn-kubernetes"
    },
    {
      "name": "ovnkube-node",
      "namespace": "openshift-ovn-kubernetes"
    },
    {
      "name": "cluster-cloud-controller-manager-operator",
      "namespace": "openshift-cloud-controller-manager-operator"
    },
    {
      "name": "node-resolver",
      "namespace": "openshift-dns"
    },
    {
      "name": "aws-ebs-csi-driver-controller",
      "namespace": "openshift-cluster-csi-drivers"
    },
    {
      "name": "aws-ebs-csi-driver-node",
      "namespace": "openshift-cluster-csi-drivers"
    },
    {
      "name": "azure-disk-csi-driver-controller",
      "namespace": "openshift-cluster-csi-drivers"
    },
    {
      "name": "azure-disk-csi-driver-node",
      "namespace": "openshift-cluster-csi-drivers"
    },
    {
      "name": "Don't alert on kube-system namespace",
      "namespace": "kube-system"
    },
    {
      "name": "Don't alert on openshift-kube-apiserver namespace",
      "namespace": "openshift-kube-apiserver"
    },
    {
      "name": "Don't alert on openshift-kube-scheduler namespace",
      "namespace": "openshift-kube-scheduler"
    },
    {
      "name": "Don't alert on openshift-kube-controller-manager namespace",
      "namespace": "openshift-kube-controller-manager"
    },
    {
      "name": "Don't alert on openshift-sdn namespace",
      "namespace": "openshift-sdn"
    },
    {
      "name": "Don't alert on openshift-network-operator namespace",
      "namespace": "openshift-network-operator"
    },
    {
      "name": "Don't alert on openshift-multus namespace",
      "namespace": "openshift-multus"
    },
    {
      "name": "Don't alert on openshift-cluster-version namespace",
      "namespace": "openshift-cluster-version"
    },
    {
      "name": "node-ca",
      "namespace": "openshift-image-registry"
    },
    {
      "name": "Don't alert on host network usage within the openshift-etcd namespace",
      "namespace": "openshift-etcd"
    },
    {
      "name": "Don't alert on host network usage within the openshift-machine-config-operator namespace",
      "namespace": "openshift-machine-config-operator"
    },
    {
      "name": "Don't alert on host network usage within the openshift-monitoring namespace",
      "namespace": "openshift-monitoring"
    },
    {
      "name": "Don't alert on host network usage within the openshift-machine-api namespace",
      "namespace": "openshift-machine-api"
    },
    {
      "name": "Don't alert on host network usage within the openshift-cluster-node-tuning-operator namespace",
      "namespace": "openshift-cluster-node-tuning-operator"
    },
    {
      "name": "coredns-ci-ln-.*-master-\\d+",
      "namespace": "openshift-vsphere-infra"
    },
    {
      "name": "haproxy-ci-ln-.*-master-\\d+",
      "namespace": "openshift-vsphere-infra"
    },
    {
      "name": "keepalived-ci-ln-.*-master-\\d+",
      "namespace": "openshift-vsphere-infra"
    },
    {
      "name": "coredns-ci-ln-.*-worker-.*",
      "namespace": "openshift-vsphere-infra"
    },
    {
      "name": "keepalived-ci-ln-.*-worker-.*",
      "namespace": "openshift-vsphere-infra"
    },
    {
      "name": "router-default",
      "namespace": "openshift-ingress"
    },
    {
      "name": "vmware-vsphere-csi-driver-controller",
      "namespace": "openshift-cluster-csi-drivers"
    },
    {
      "name": "vmware-vsphere-csi-driver-node",
      "namespace": "openshift-cluster-csi-drivers"
    },
    {
      "name": "network-node-identity",
      "namespace": "openshift-network-node-identity"
    },
    {
      "name": "ovnkube-control-plane",
      "namespace": "openshift-ovn-kubernetes"
    },
    {
      "name": "aws-cloud-controller-manager",
      "namespace": "openshift-cloud-controller-manager"
    }
  ],
  "enforcement": {
    "failBuild": false
  },
  "expression": {
    "op": "criterion",
    "field": "host-network",
    "values": [
      "true"
    ],
    "valuesOp": "or",
    "negate": false
  },
  "disabled": false
}

Original StackRox JSON

{
  "id": "6226d4ad-7619-4a0b-a160-46373cfcee66",
  "name": "Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared",
  "description": "When HostNetwork is enabled the container is not placed inside a separate network stack. The container's networking is not containerized when this option is applied. The consequence of this is that the container has full access to the host's network interfaces. It also enables a shared UTS namespace. The UTS namespace provides isolation between two system identifiers: the hostname and the NIS domain name. It is used to set the hostname and the domain which are visible to running processes in that namespace. Processes running within containers do not typically require to know either the hostname or the domain name. The UTS namespace should therefore not be shared with the host.",
  "rationale": "Selecting this option is potentially dangerous. It allows the container process to open reserved low numbered ports in the way that any other root process can. It also allows the container to access network services such as D-bus on a Docker host. A container process could potentially carry out undesired actions, such as shutting down the host. The container will also share the network namespace with the host, providing full permission for each container to change the hostname of the host. This is not in line with good security practice and should not be permitted.",
  "remediation": "You should not create a deployment with `hostNetwork: true`",
  "disabled": false,
  "categories": [
    "Docker CIS"
  ],
  "lifecycleStages": [
    "DEPLOY"
  ],
  "eventSource": "NOT_APPLICABLE",
  "exclusions": [
    {
      "name": "Don't alert on deployment gcp-cloud-controller-manager in openshift-cloud-controller-manager namespace",
      "deployment": {
        "name": "gcp-cloud-controller-manager",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cloud-controller-manager",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment gcp-pd-csi-driver-controller in namespace openshift-cluster-csi-drivers",
      "deployment": {
        "name": "gcp-pd-csi-driver-controller",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-csi-drivers",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment gcp-pd-csi-driver-node in namespace openshift-cluster-csi-drivers",
      "deployment": {
        "name": "gcp-pd-csi-driver-node",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-csi-drivers",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment machine-approver in namespace openshift-cluster-machine-approver",
      "deployment": {
        "name": "machine-approver",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-machine-approver",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment ovnkube-master in namespace openshift-ovn-kubernetes",
      "deployment": {
        "name": "ovnkube-master",
        "scope": {
          "cluster": "",
          "namespace": "openshift-ovn-kubernetes",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment ovnkube-node in namespace openshift-ovn-kubernetes",
      "deployment": {
        "name": "ovnkube-node",
        "scope": {
          "cluster": "",
          "namespace": "openshift-ovn-kubernetes",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment cluster-cloud-controller-manager-operator in namespace openshift-cloud-controller-manager-operator",
      "deployment": {
        "name": "cluster-cloud-controller-manager-operator",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cloud-controller-manager-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment node-resolver in namespace openshift-dns",
      "deployment": {
        "name": "node-resolver",
        "scope": {
          "cluster": "",
          "namespace": "openshift-dns",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment aws-ebs-csi-driver-controller in namespace openshift-cluster-csi-drivers",
      "deployment": {
        "name": "aws-ebs-csi-driver-controller",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-csi-drivers",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment aws-ebs-csi-driver-node in namespace openshift-cluster-csi-drivers",
      "deployment": {
        "name": "aws-ebs-csi-driver-node",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-csi-drivers",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment azure-disk-csi-driver-controller in namespace openshift-cluster-csi-drivers",
      "deployment": {
        "name": "azure-disk-csi-driver-controller",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-csi-drivers",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment azure-disk-csi-driver-node in namespace openshift-cluster-csi-drivers",
      "deployment": {
        "name": "azure-disk-csi-driver-node",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-csi-drivers",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on kube-system namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "kube-system",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-kube-apiserver namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-apiserver",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-kube-scheduler namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-scheduler",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-kube-controller-manager namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-controller-manager",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-sdn namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-sdn",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-network-operator namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-network-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-multus namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-multus",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-cluster-version namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-version",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on node-ca DaemonSet in the openshift-image-registry namespace",
      "deployment": {
        "name": "node-ca",
        "scope": {
          "cluster": "",
          "namespace": "openshift-image-registry",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on host network usage within the openshift-etcd namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-etcd",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on host network usage within the openshift-machine-config-operator namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-machine-config-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on host network usage within the openshift-monitoring namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-monitoring",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on host network usage within the openshift-machine-api namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-machine-api",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on host network usage within the openshift-cluster-node-tuning-operator namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-node-tuning-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment coredns-ci-ln-*-master-\\d+ in namespace openshift-vsphere-infra",
      "deployment": {
        "name": "coredns-ci-ln-.*-master-\\d+",
        "scope": {
          "cluster": "",
          "namespace": "openshift-vsphere-infra",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment haproxy-ci-ln-*-master-\\d+ in namespace openshift-vsphere-infra",
      "deployment": {
        "name": "haproxy-ci-ln-.*-master-\\d+",
        "scope": {
          "cluster": "",
          "namespace": "openshift-vsphere-infra",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment keepalived-ci-ln-*-master-\\d+ in namespace openshift-vsphere-infra",
      "deployment": {
        "name": "keepalived-ci-ln-.*-master-\\d+",
        "scope": {
          "cluster": "",
          "namespace": "openshift-vsphere-infra",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployments coredns-ci-ln-*-worker-* in namespace openshift-vsphere-infra",
      "deployment": {
        "name": "coredns-ci-ln-.*-worker-.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-vsphere-infra",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployments keepalived-ci-ln-*-worker-* in namespace openshift-vsphere-infra",
      "deployment": {
        "name": "keepalived-ci-ln-.*-worker-.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-vsphere-infra",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment router-default in namespace openshift-ingress",
      "deployment": {
        "name": "router-default",
        "scope": {
          "cluster": "",
          "namespace": "openshift-ingress",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment vmware-vsphere-csi-driver-controller in namespace openshift-cluster-csi-drivers",
      "deployment": {
        "name": "vmware-vsphere-csi-driver-controller",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-csi-drivers",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment vmware-vsphere-csi-driver-node in namespace openshift-cluster-csi-drivers",
      "deployment": {
        "name": "vmware-vsphere-csi-driver-node",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-csi-drivers",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment network-node-identity in namespace openshift-network-node-identity",
      "deployment": {
        "name": "network-node-identity",
        "scope": {
          "cluster": "",
          "namespace": "openshift-network-node-identity",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment ovnkube-control-plane in namespace openshift-ovn-kubernetes",
      "deployment": {
        "name": "ovnkube-control-plane",
        "scope": {
          "cluster": "",
          "namespace": "openshift-ovn-kubernetes",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment aws-cloud-controller-manager in namespace openshift-cloud-controller-manager",
      "deployment": {
        "name": "aws-cloud-controller-manager",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cloud-controller-manager",
          "label": null
        }
      },
      "image": null
    }
  ],
  "scope": [],
  "severity": "MEDIUM_SEVERITY",
  "enforcementActions": [],
  "policySections": [
    {
      "sectionName": "Section 1",
      "policyGroups": [
        {
          "fieldName": "Host Network",
          "booleanOperator": "OR",
          "negate": false,
          "values": [
            {
              "value": "true"
            }
          ]
        }
      ]
    }
  ],
  "notifiers": [],
  "lastUpdated": null,
  "SORTName": "",
  "SORTLifecycleStage": "",
  "SORTEnforcement": false,
  "policyVersion": "1.1",
  "mitreAttackVectors": [],
  "criteriaLocked": true,
  "mitreVectorsLocked": true,
  "isDefault": true,
  "source": "IMPERATIVE"
}