Policy Driven Cryptographic Agility
Project Summary: Policy-Driven Cryptographic Agility & Data Security Decision Engine
This repository contains two related governance systems, built by the same design philosophy but kept deliberately separate:
1. Cryptographic Policy Engine (R/00–R/10)
Maintains an auditable inventory of where cryptography is used across an organization’s systems, a version-controlled policy defining which algorithms are currently approved (including post-quantum and hybrid algorithms), and an engine that evaluates and durably logs which algorithm applies to which system — reading inventory facts itself rather than trusting caller claims.
2. Data Security Decision Engine (R/11–R/14)
A correlation-aware, multi-signal risk engine that recommends ALLOW / WARN / BLOCK for data-movement events (e.g., sensitive data headed to an external destination). It evaluates signals against a governed policy table and discounts correlated signal pairs rather than naively summing them, producing a durable evidence trail for human security/compliance review.
Shared design philosophy:
Don’t trust a single signal — gather evidence from the systems that actually own it
Control explicitly for correlated or contradictory evidence rather than combining it naively
Evaluate against an external, versioned, content-hashed policy — never an ad hoc decision
Make a defensible, attributable, durably-logged decision
Stop short of enforcement and stop short of the final human judgment call
What it is not: neither engine is a cryptographic implementation or an enforcement point. Real deployments still need HSMs/PKI/validated crypto libraries for the first system, and real DLP/IAM/CASB enforcement for the second — this project governs the decisions, not the enforcement.
Structure: R scripts (R/), CSV-based config and policy tables (config/), tests (tests/), an R Markdown report (report.Rmd) that renders the live inventory/policy state, and a full worked example comparing both engines side by side.




