Community Policies

Mondoo's cnspec GitHub repository is a free, open source collection of more than 80 security, best-practices, and compliance policy bundles created by Mondoo and the Mondoo community. They cover a wide range of platforms and technologies:

• Operating systems: FreeBSD, Linux, macOS, and Windows (including specialized variants for workstations and operational best practices)
• Cloud providers and virtualization: Alibaba Cloud, AWS, DigitalOcean, Google Cloud, Hetzner Cloud, Microsoft Azure, Nutanix, OpenStack, Oracle Cloud, Proxmox VE, STACKIT, and VMware vSphere
• Containers and infrastructure as code: Kubernetes, Dockerfiles, Portainer, and Terraform
• SaaS platforms: Atlassian, Cloudflare, Datadog, GitHub, GitLab, Google Workspace, Grafana, HashiCorp Cloud Platform, Microsoft 365, Netlify, NextDNS, Okta, Slack, Tailscale, and Vercel
• Databases and data platforms: Cassandra, ClickHouse, Databricks, Elasticsearch, MariaDB, MongoDB, MongoDB Atlas, MySQL, Neon, OpenSearch, PostgreSQL, Redis, Snowflake, and SQL Server
• AI platforms: Anthropic, Hugging Face, MCP servers, OpenAI, Together AI, and vLLM
• Network devices: Arista EOS, Cisco IOS XE, Cisco IOS XR, Cisco NX-OS, F5 BIG-IP, Fortinet FortiOS, Juniper Junos, MikroTik RouterOS, Palo Alto PAN-OS, and Ubiquiti UniFi
• Network and web security: DNS, TLS/HTTP, and email
• Other technologies: Chef Infra, EDR (endpoint detection and response), and industrial controllers (Phoenix PLCnext)

cnspec ships with default policies that automatically match the platform you scan, so there's no need to download those separately. Community policies are useful when you want to apply additional checks beyond the defaults, or run a policy that targets a system cnspec doesn't auto-detect (a SaaS tenant, for example).

Use a community policyCopy Anchor Link

To scan with a community policy bundle, pass its URL to cnspec with --policy-bundle (or its short alias, -f):

cnspec scan github org YOUR_ORG -f https://raw.githubusercontent.com/mondoohq/cnspec/refs/heads/main/content/mondoo-github-security.mql.yaml

You can also run a policy bundle against a local system:

cnspec scan local -f https://raw.githubusercontent.com/mondoohq/cnspec/refs/heads/main/content/mondoo-linux-security.mql.yaml

When you use -f, cnspec applies only the checks in that bundle instead of the default policies.

To save a copy locally instead of fetching the URL each scan, download the bundle file and pass its path:

cnspec scan local -f ./mondoo-linux-security.mql.yaml

Learn moreCopy Anchor Link

• To understand how policies and checks work, read About Policies.
• To apply and manage policies with the CLI, read Manage Policies with cnspec.
• To customize a community policy or write your own, read the Policy Authoring Guide.