---
schema_version: "1"
id: a867b611cb32320d12a38953ab51b66bc11f82851da5510317fba1cdcf118ae3
title: Deploy Data 360 Governance Policies with DevOps Data Kits
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/data/264-0-0/c360_a_deploy_policies_devops_datakit.md
canonical_url: https://help.salesforce.com/s/articleView?id=data.c360_a_deploy_policies_devops_datakit.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 9818e2b50bf5c692b0ff6ee37d1e0dc81780c9201a681c9db88e02e3a2cc663d
description: Migrate your data governance policies from sandbox to production orgs using DevOps data kits. This approach maintains consistency and reduces manual errors.
products:
  - Data 360
release: "264"
---
# Deploy Data 360 Governance Policies with DevOps Data Kits

Migrate your data governance policies from sandbox to production orgs using DevOps data kits. This approach maintains consistency and reduces manual errors.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All Editions</strong> supported by Data 360. See <a href="https://help.salesforce.com/s/articleView?id=data.c360_a_dc_editions.htm&amp;release=264.0.0&amp;type=5" title="Data 360 is available in several supported Salesforce editions. Some Data 360 features also require additional licenses.">Data 360 edition availability</a>.</td></tr></tbody></table>

 
| User permission needed |   |
| --- | --- |
| To deploy Data 360 changes: | Data Cloud Architect |

Verify that your deployment meets these prerequisites before starting a mergeback.

- Create and test governance policies in a sandbox org. See:
    - [Create an Object or Field-Level Access Policy in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_create_ols_fls_policy.htm&type=5&language=en_US)
    - [Create a Record-Level Policy in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_create_rls_policy.htm&type=5&language=en_US)
    - [Dynamic Data Masking Policies in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_dynamic_data_masking_policies.htm&type=5&language=en_US)
- The target organization contains the necessary data model objects (DMOs) and data lake objects (DLOs).
- Bundle all policies and their associated protected objects in a single data kit to prevent policy leaks and unintended data exposure.
- Make sure dependencies for record-level security (RLS) policies, including objects referenced in joins, exist in the target environment.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-data-data_cloud-264-0-0-production-enus/f3569962-3c9b-4f83-9d0c-b6a574e785da/images/icon_important.png)

Important Deploy governance policies only using Salesforce change sets. The Salesforce CLI doesn’t support governance policy deployment.

To move governance policies:

1. Create a DevOps data kit in your sandbox org. See [Create a Data 360 Sandbox](https://help.salesforce.com/s/articleView?id=data.c360_a_data_cloud_sandbox_create.htm&type=5&language=en_US).
    1. Select the data assets such as data stream bundles or DLOs that you want to migrate.
    2. In the data kit wizard, select the associated RLS, OLS, and FLS policies and tag assignments.
    3. If your implementation includes RLS policies with joins, create a second DevOps data kit. Add the data stream bundle that contains the RLS policies with joins and related tag assignments.
2. Add the data kit and its tag assignments to an outbound change set.
    1. From Setup, in the Quick Find box, enter Outbound Change Sets, and then select **Outbound Change Sets**.
    2. Create a new outbound change set.
    3. Add the data kit with all its dependencies to the change set. See [View and Add Dependent Components to a Change Set](https://help.salesforce.com/s/articleView?id=platform.changesets_outbound_dependencies.htm&type=5&language=en_US).
    4. Review the publishing sequence. Make sure that the dependent DLOs or DMOs are deployed before or are higher up in the deployment sequence.
3. Upload the change set to the production org. See [Upload an Outbound Change Set](https://help.salesforce.com/s/articleView?id=platform.changesets_outbound_init_deploy.htm&type=5&language=en_US).
4. In the production org, deploy the change set.
    
    Deploying the change set installs the DevOps data kit and applies the associated governance policies in the target org. See [Deploy a Change Set](https://help.salesforce.com/s/articleView?id=platform.changesets_inbound_deploy.htm&type=5&language=en_US).
5. Verify the deployment status.
    1. In the target org, go to **Data Kits**, click **Deployment History** and verify that the deployment is successful.
    2. In the target org, go to **Data Governance**, click **Policies** and verify that the merged RLS, FLS, and OLS policies appear in the dashboard and are active.

#### See Also

- [_Salesforce Help_: Deploy Data 360 Changes Across Orgs](https://help.salesforce.com/s/articleView?id=data.c360_a_data_cloud_sandbox_deploy.htm&type=5&language=en_US)