Implement CIS 1.3.6 Customer Lockbox policy and tests

Author: Collando

engine/policies/cis/microsoft-365-foundations/v6.0.0/1.3.6_customer_lockbox_enabled.rego

@@ -0,0 +1,25 @@
+package cis.microsoft_365_foundations.v6_0_0.control_1_3_6
+
+import rego.v1
+
+default result := {
+    "compliant": false,
+    "message": "Evaluation failed: unable to verify Customer Lockbox status",
+    "details": {}
+}
+
+result := {
+    "compliant": true,
+    "message": "Customer Lockbox is enabled",
+    "details": {"customer_lockbox_enabled": true}
+} if {
+    input.customer_lockbox_enabled == true
+}
+
+result := {
+    "compliant": false,
+    "message": "Customer Lockbox is not enabled",
+    "details": {"customer_lockbox_enabled": false}
+} if {
+    input.customer_lockbox_enabled == false
+}

engine/tests/test_cis_1_3_6_customer_lockbox_enabled.rego

@@ -0,0 +1,29 @@
+package cis.microsoft_365_foundations.v6_0_0.test_control_1_3_6
+
+import rego.v1
+
+test_compliant_customer_lockbox_enabled if {
+    result := data.cis.microsoft_365_foundations.v6_0_0.control_1_3_6.result with input as {
+        "customer_lockbox_enabled": true
+    }
+    result.compliant == true
+}
+
+test_non_compliant_customer_lockbox_disabled if {
+    result := data.cis.microsoft_365_foundations.v6_0_0.control_1_3_6.result with input as {
+        "customer_lockbox_enabled": false
+    }
+    result.compliant == false
+}
+
+test_unknown_status_null if {
+    result := data.cis.microsoft_365_foundations.v6_0_0.control_1_3_6.result with input as {
+        "customer_lockbox_enabled": null
+    }
+    result.compliant == false
+}
+
+test_missing_field if {
+    result := data.cis.microsoft_365_foundations.v6_0_0.control_1_3_6.result with input as {}
+    result.compliant == false
+}