---
title: "Node Group Policies"
description: "Add CIS benchmarks and custom policies to a node group."
product: "Guardian"
edition: "Classic"
type: "workflow"
url: "https://docs.cloudhouse.com/guardian/classic/inventory/monitored/node-groups/settings/node-group-policies/"
---
# Node Group Policies

The **Node Group Policies** page displays the complete list of policies that have been applied to a selected node group. Here, you can add Center for Internet Security (**CIS**) benchmarks and custom policies to your node groups. Policies are an excellent resource in Guardian that allow you to define a desired configuration state at the node level. A node group can contain multiple policies that are applied to the same node or a number of different nodes. For more information on node groups, see [Node Groups](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/node-groups/node-groups/index.md).

Applies to: `Guardian Classic`

![Edit node group policies](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/node-groups/edit-node-group/edit-node-group-policies.png)

Policies consist of a number of checks to confirm if a configuration item within a node is passing or failing a particular condition. The checks provide a definition for a single configuration attribute and its expected value. Guardian contains a list of industry-standard, best-practice policies, stipulated by the CIS to ensure the security of a target system. However, you can also build policies from scratch, import policies from the policy library, or create a policy from a node scan. These are known as custom policies. Both policy types are displayed on the **Node Group Policies** page. For more information on policies, see [Policies](https://docs.cloudhouse.com/guardian/classic/control/policies/policies/index.md).

To access the Node Group Policies page, complete the following steps:

1. In the Guardian web application, navigate to the **Monitored** tab.

    ![Monitored tab](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/node-groups/policies/monitored-tab.png)

2. In the **Node Groups** drop-down menu, locate the node group you want to access the policies for. Then, click the **Settings** button (![Settings button as shown in the Guardian user interface.](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/buttons/settings.png)).

    ![Settings menu](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/node-groups/policies/settings-menu.png)

3. Select **Policies** from the **Settings** drop-down list. **Node Group Policies** page is displayed.

    ![Policy page](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/node-groups/policies/policy-page.png)

Here, you can view, edit, and configure the current list of policies applied to the node group, as well as add a new policy to the node group.

## Add policy to group

To add a policy to a node group, complete the following steps:

1. On the **Node Group Policies** page, click the **Add Policy to Group** button. The **Select policies** dialog is displayed.

    ![Add policy](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/node-groups/policies/add-policy.png)

2. Click to **Select** a policy, or policies, from the list of options.

    !!! note

        By default, this list is populated with CIS policies. However, you can also build policies from scratch, import policies from the policy library, or create a policy from a node scan. Any custom policies you have created are displayed here. For more information on how to create a custom policy, see [Build Custom Policy](https://docs.cloudhouse.com/guardian/classic/control/policies/build-custom-policy/index.md).

    ![Select policies](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/node-groups/policies/select-policies.png)

3. Then, click outside of the **Select policies** dialog to close it and apply the policies to your node group.

    ![Updated policies](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/node-groups/policies/updated-policies.png)

The next time your node group is scanned, the policies are run and validated against each (applicable) node within the group. For example, the 'etc/rc.tcpip - sendmail' CIS policy is only applicable to validate systems that operate as a mail server. If applied at the node group level, only configuration items that send, receive, or process e-mail will have this policy applied. You can view the results of each policy check by accessing the scan report for each individual node within the group. For more information, see [Node Scan Results](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/nodes/node-scan-results/index.md).

## Configure existing policies

To configure the existing policies displayed on the **Node Group Policies** page, complete the following actions:

1. On the **Node Group Policies** page, locate the policy you want to configure.
2. Then, click the **View** drop-down list to display the following options:

    ![View drop down](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/node-groups/policies/view-drop-down.png)

    - **Run Policy** – Run the policy against the node group. If selected, the policy run is queued for processing and you can track its progress from the **Job History** tab. For more information, see [Job History](https://docs.cloudhouse.com/guardian/classic/control/job-history/job-history/index.md).

        !!! note

            This option is only displayed for CIS benchmarks, not custom policies.

    - **Remove** – Remove the policy from the node group.

3. Select an option from the list. The change is applied instantly.

!!! note

    Alternatively, you can click the **View** button to display the policy in the **Policies** tab. Specifically, a break down of each of the checks included in the policy. Here, you can find each of the node groups that have the policy assigned and each of the node groups that have been excluded from the policy. For more information, see [Benchmarks](https://docs.cloudhouse.com/guardian/classic/control/benchmarks/benchmarks/index.md).