Common Cloud Controls Catalog (CCC)

CCC.Core.CN01 Encrypt Data for Transmission

Data

Most cloud services enable TLS 1.3 by default. Where it is not already set, ensure that your services are configured or updated accordingly.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.

CCC.Core.CN01 Encrypt Data for Transmission

Data

Any time port 22 is exposed, ensure that it has a properly implemented SSH server with SSHv2 enabled and configured with strong ciphers.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.

CCC.Core.CN01 Encrypt Data for Transmission

Data

Review firewall, load balancer, and application configurations to ensure insecure protocols such as HTTP, FTP, and Telnet are not exposed. Where possible, implement automatic redirection to secure protocols such as HTTPS, SFTP, SSH, and regularly scan for protocol drift.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.

CCC.Core.CN01 Encrypt Data for Transmission

Data

Reference the IANA Service Name and Transport Protocol Port Number Registry for more information about correct protocol-to-port assignments. Avoid running non-standard services on well-known ports.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.

CCC.Core.CN01 Encrypt Data for Transmission

Data

Configure mTLS for all endpoints that process or transmit sensitive data. Ensure both client and server certificates are validated and managed securely. Regularly review certificate authorities and automate certificate rotation where possible.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.

CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates

Data

Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.

CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates

Data

Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.

CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates

Data

Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.

CCC.Core.CN06 Restrict Deployments to Trust Perimeter

Data

Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate the service's deployment location is included in this list.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.

CCC.Core.CN06 Restrict Deployments to Trust Perimeter

Data

Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate that child resources can only be deployed to locations included in this list.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.

CCC.Core.CN08 Replicate Data to Multiple Locations

Data

Implement automated data replication processes to ensure that data is consistently duplicated in another region or availability zone. Regularly test data recovery from the replicated location to ensure integrity and availability.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.

CCC.Core.CN08 Replicate Data to Multiple Locations

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.

CCC.Core.CN09 Ensure Integrity of Access Logs

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.

CCC.Core.CN09 Ensure Integrity of Access Logs

Data

No normal business operations should disable logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging mechanisms are tightly integrated with service operations, so that logging cannot be disabled without stopping the service itself.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.

CCC.Core.CN09 Ensure Integrity of Access Logs

Data

No normal business operations should result in the redirection of logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging configurations are immutable during service operation so that any changes require stopping the service and publishing corresponding events to monitored channels.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.

CCC.Core.CN10 Restrict Data Replication to Trust Perimeter

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that data is only replicated on infrastructure in locations that are explicitly included within a defined trust perimeter.

CCC.Core.CN02 Encrypt Data for Storage

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that all data stored is encrypted at rest using strong encryption algorithms.

CCC.Core.CN11 Protect Encryption Keys

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).

CCC.Core.CN11 Protect Encryption Keys

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).

CCC.Core.CN11 Protect Encryption Keys

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).

CCC.Core.CN11 Protect Encryption Keys

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).

CCC.Core.CN11 Protect Encryption Keys

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).

CCC.Core.CN11 Protect Encryption Keys

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).

CCC.Core.CN14 Maintain Recent Backups

Data

Use immutable storage solutions where possible. Implement backup retention policies that enforce a minimum retention period of 30 days.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.

CCC.Core.CN14 Maintain Recent Backups

Data

Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 30 days.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.

CCC.Core.CN14 Maintain Recent Backups

Data

Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 14 days.

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters.

Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.

CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access

Identity and Access Management

The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration.

Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.

CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access

Identity and Access Management

The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration.

Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.

CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access

Identity and Access Management

The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration.

Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.

CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access

Identity and Access Management

The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration.

Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.

CCC.Core.CN05 Prevent Access from Untrusted Entities

Identity and Access Management

The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration.

Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.

CCC.Core.CN05 Prevent Access from Untrusted Entities

Identity and Access Management

The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration.

Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.

CCC.Core.CN05 Prevent Access from Untrusted Entities

Identity and Access Management

The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration.

Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.

CCC.Core.CN05 Prevent Access from Untrusted Entities

Identity and Access Management

The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration.

Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.

CCC.Core.CN05 Prevent Access from Untrusted Entities

Identity and Access Management

The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration.

Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.

CCC.Core.CN05 Prevent Access from Untrusted Entities

Identity and Access Management

The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration.

Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.

CCC.Core.CN04 Log All Access and Changes

Logging and Monitoring

The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements.

Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.

CCC.Core.CN04 Log All Access and Changes

Logging and Monitoring

The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements.

Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.

CCC.Core.CN04 Log All Access and Changes

Logging and Monitoring

The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements.

Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.

CCC.Core.CN07 Alert on Unusual Enumeration Activity

Logging and Monitoring

Implement event publication mechanisms and alerts for patterns indicative of enumeration activities, such as repeated access attempts, requests, or liveness probes. Configure alerts to notify security teams of any activities that merit further investigation.

The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements.

Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.

CCC.Core.CN07 Alert on Unusual Enumeration Activity

Logging and Monitoring

Implement logging mechanisms to capture details of enumeration activities, including client identity, timestamps, and activity nature. Retain logs according to organizational policies, and occasionally review them for patterns that may indicate reconnaissance activities.

The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements.

Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.

CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining

Integrity

Ensure hash of data is included in digital signature.

Controls designed to protected the integrity of Audit Log data.

Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.

CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining

Integrity

Ensure verification process includes a chained hash function.

Controls designed to protected the integrity of Audit Log data.

Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.

CCC.AuditLog.CN02 Enable And Validate All Audit Log Types

Integrity

Review audit log configuration

Controls designed to protected the integrity of Audit Log data.

Review audit log configuration and ensure that all audit log types are being generated and replicated to configured sinks

CCC.AuditLog.CN03 Alert On Audit Log Changes And Access

Integrity

Ensure alerting is correctly configured

Controls designed to protected the integrity of Audit Log data.

Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.

CCC.AuditLog.CN03 Alert On Audit Log Changes And Access

Integrity

Ensure alerting is correctly configured

Controls designed to protected the integrity of Audit Log data.

Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.

CCC.AuditLog.CN04 Ensure Access Logging Is Enabled on the Audit Log Bucket

Integrity

Configure the audit log bucket to enable server access logging. Ensure the target logging bucket is configured for appropriate security, including restricted access and immutability.

Controls designed to protected the integrity of Audit Log data.

Ensure that access logging is enabled for the audit log storage bucket to capture all requests made to the bucket, providing an audit trail of data access.

CCC.AuditLog.CN05 Export Audit Logs To Bucket

Availability

Configure audit log exporting.

Controls designed to protected the availability of Audit Log data.

Configure audit logs to be sent to a external bucket where they can be globally replicated and can be subject to greater access control and data retention polices.

CCC.AuditLog.CN06 Enforce Retention Policy on Audit Log Bucket

Availability

Configure the audit log bucket's lifecycle rules or object retention settings to enforce the required data retention period.

Controls designed to protected the availability of Audit Log data.

Configure a custom retention policy on the designated audit log bucket to ensure that logs are retained for the correct number of days as defined by your organization's policy.

CCC.AuditLog.CN07 Enforce MFA Delete on Audit Log Bucket

Availability

Enable MFA Delete (or equivalent multi-factor authentication for delete operations) on the audit log bucket.

Controls designed to protected the availability of Audit Log data.

Enable Multi-Factor Authentication (MFA) delete on the audit log bucket to provide greater protection against accidental or malicious deletion of audit data.

CCC.AuditLog.CN08 Enable Object Lock On Audit Log Bucket

Availability

Configure object lock policy.

Controls designed to protected the availability of Audit Log data.

Ensure that object log is enabled globally on all objects with the bucket. The lock time MUST be configured to meet your organization, legal and compliance goals. Deletion attempts before the lock period MUST be denied.

CCC.AuditLog.CN09 Restrict Field And Log Type Access

Confidentiality

Review field level access controls on audit data.

Controls designed to protected the confidentiality of Audit Log data.

Configure access to audit logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.

CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible

Confidentiality

Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted.

Controls designed to protected the confidentiality of Audit Log data.

Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.

CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible

Confidentiality

Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted.

Controls designed to protected the confidentiality of Audit Log data.

Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.

CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation

Data

Controls related to the confidentiality, integrity and availability of log data.

Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.

CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation

Data

Controls related to the confidentiality, integrity and availability of log data.

Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.

CCC.Logging.CN02 Enforce Data Retention Policy for Logs

Data

Controls related to the confidentiality, integrity and availability of log data.

Ensure that the retention period configured for logs aligns with the organization's data retention policy.

CCC.Logging.CN02 Enforce Data Retention Policy for Logs

Data

Controls related to the confidentiality, integrity and availability of log data.

Ensure that the retention period configured for logs aligns with the organization's data retention policy.

CCC.Logging.CN03 Enable Object Lock On Log Bucket

Data

Configure object lock policy.

Controls related to the confidentiality, integrity and availability of log data.

Ensure log immutability by enabling Write Once, Read Many (WORM) protection using object lock on log storage buckets. This prevents logs from being modified or deleted during the defined retention period, supporting compliance and forensic integrity.

CCC.Logging.CN04 Restrict Field And Log Type Access

Identity and Access Management

Review field level access controls on log data.

Controls that restrict who can access and modify logs.

Configure access to logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.

CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible

Identity and Access Management

Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted.

Controls that restrict who can access and modify logs.

Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.

CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible

Identity and Access Management

Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted.

Controls that restrict who can access and modify logs.

Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.

CCC.Logging.CN06 Detect and Alert on Potential Log Exfiltration

Logging and Monitoring

Controls that collect, alert, and retain logging-related events.

Identify and alert on anomalous data access patterns that may indicate an attempt to exfiltrate log data.

CCC.Logging.CN07 Detect and Alert on Log Service Tampering

Logging and Monitoring

Controls that collect, alert, and retain logging-related events.

Alert when any component of the critical logging infrastructure is disabled, modified, or deleted, indicating a defense evasion attempt.

CCC.Monitor.CN01 Rate Limiting on External Monitoring

Logging and Monitoring

Controls that collect, alert, and retain events from other monitoring services.

Prevent DoS attacks using External Monitoring tools.

CCC.Monitor.CN02 Rate Limiting on Metric Generation

Logging and Monitoring

Controls that collect, alert, and retain events from other monitoring services.

Prevent Malicious Actor or misconfiguration from flooding services with metric data.

CCC.Monitor.CN03 Access External Monitoring

Identity and Access Management

Controls designed to prevent unauthorised access to monitoring features.

Control access to Synthetic monitoring solutions using API keys or Certificate based authentication to ensure they don't become an attack path, preventing monitoring systems from forging network requests to gain access to internal systems.

CCC.Monitor.CN04 Restrict access to Monitoring Dashboards

Identity and Access Management

Controls designed to prevent unauthorised access to monitoring features.

Control access to Monitoring Dashboards and reports to ensure they don't highlight an attack path.

CCC.Monitor.CN05 Restrict access to silence or acknowledge an alert

Identity and Access Management

Controls designed to prevent unauthorised access to monitoring features.

Ensure only a subset of users can silence or acknowledge alerts to prevent attackers hiding their activity.

CCC.Monitor.CN06 Metrics pushed for authorised services only

Identity and Access Management

Controls designed to prevent unauthorised access to monitoring features.

Use IAM to control which types of metrics or traces can be pushed by different system to avoid a compromised system pushing fabricated metrics about a different service

CCC.ObjStor.CN01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption, or sensitive data decryption.

CCC.ObjStor.CN01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption, or sensitive data decryption.

CCC.ObjStor.CN01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption, or sensitive data decryption.

CCC.ObjStor.CN01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption, or sensitive data decryption.

CCC.ObjStor.CN03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.

CCC.ObjStor.CN03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.

CCC.ObjStor.CN04 Objects have an Effective Retention Policy by Default

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects.

CCC.ObjStor.CN04 Objects have an Effective Retention Policy by Default

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects.

CCC.ObjStor.CN05 Versioning is Enabled for All Objects in the Bucket

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.

CCC.ObjStor.CN05 Versioning is Enabled for All Objects in the Bucket

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.

CCC.ObjStor.CN05 Versioning is Enabled for All Objects in the Bucket

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.

CCC.ObjStor.CN05 Versioning is Enabled for All Objects in the Bucket

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.

CCC.ObjStor.CN07 Multi-Factor Authentication Is Required for Object Deletion

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Ensure that deletion of objects stored in the object storage system is protected by multi-factor authentication (MFA), reducing the risk of accidental, unauthorized, or compromised-credential–based data destruction.

CCC.ObjStor.CN07 Multi-Factor Authentication Is Required for Object Deletion

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Ensure that deletion of objects stored in the object storage system is protected by multi-factor authentication (MFA), reducing the risk of accidental, unauthorized, or compromised-credential–based data destruction.

CCC.ObjStor.CN07 Multi-Factor Authentication Is Required for Object Deletion

Data

The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle.

Ensure that deletion of objects stored in the object storage system is protected by multi-factor authentication (MFA), reducing the risk of accidental, unauthorized, or compromised-credential–based data destruction.

CCC.ObjStor.CN02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions

Identity and Access Management

The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources.

Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.

CCC.ObjStor.CN02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions

Identity and Access Management

The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources.

Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.

CCC.LB.CN01 Enforce and Detect Rate Limiting

Logging and Monitoring

Implement per-IP token-bucket limits with and verify via synthetic traffic tests.

Controls that detect anomalous traffic and record load-balancer activity.

Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.

CCC.LB.CN01 Enforce and Detect Rate Limiting

Logging and Monitoring

Enable access logging and configure metric filters on HTTP 429 counts to trigger alerts.

Controls that detect anomalous traffic and record load-balancer activity.

Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.

CCC.LB.CN06 Secure Health-Check Telemetry

Logging and Monitoring

Instrument metrics for health check results and target removal events. Configure monitoring alarms to alert on abnormal spikes in unhealthy targets.

Controls that detect anomalous traffic and record load-balancer activity.

Monitor health-check endpoints for tampering and alert on abnormal status changes.

CCC.LB.CN04 Enforce Distribution Policies

Identity and Access Management

Define a list of trusted principals allowed to modify routing configurations. Enforce via conditional access policies, and log changes using audit logging.

Controls that restrict who can change or query load-balancer resources.

Ensure traffic-splitting weights and algorithms are modified only by trusted identities.

CCC.LB.CN05 Validate Session Affinity

Identity and Access Management

Audit CCC.LB.CP15 parameters via configuration scans.

Controls that restrict who can change or query load-balancer resources.

Configure session persistence to minimise fixation and hijacking risks.

CCC.LB.CN09 Restrict Management API Access

Identity and Access Management

Combine VPC endpoints with IAM condition-key filters for protected APIs.

Controls that restrict who can change or query load-balancer resources.

Limit load-balancer API calls to authorised identities and trusted networks.

CCC.LB.CN02 Auto-Scale Load Balancer Capacity

Data

Enable autoscaling policies.

Controls that preserve availability and confidentiality of traffic processed by the load balancer.

Expand load-balancer capacity to maintain availability during traffic spikes.

CCC.LB.CN07 Scrub Sensitive Headers

Data

Configure header-transformation rules.

Controls that preserve availability and confidentiality of traffic processed by the load balancer.

Remove headers that disclose internal details or software versions from HTTP responses.

CCC.LB.CN08 Automate Certificate Renewal

Encryption

Use certificate-manager auto-renewal workflows.

Controls that ensure trustworthy TLS certificates and ciphers.

Maintain valid TLS certificates by automating renewal and deployment before expiry.

CCC.VPC.CN01 Restrict Default Network Creation

Network Security

TODO: Describe this control family

Restrict the automatic creation of default virtual networks and related resources during subscription initialization to avoid insecure default configurations and enforce custom network policies.

CCC.VPC.CN02 Limit Resource Creation in Public Subnet

Network Security

TODO: Describe this control family

Restrict the creation of resources in the public subnet with direct access to the internet to minimize attack surfaces.

CCC.VPC.CN03 Restrict VPC Peering to Authorized Accounts

Network Security

TODO: Describe this control family

Ensure VPC peering connections are only established with explicitly authorized destinations to limit network exposure and enforce boundary controls.

CCC.VPC.CN04 Enforce VPC Flow Logs on VPCs

Network Security

TODO: Describe this control family

Ensure VPCs are configured with flow logs enabled to capture traffic information.

CCC.KeyMgmt.CN01 Alert on Key-version Changes

Logging and Monitoring

Use native event services (e.g., CloudWatch Events, Azure Monitor, Cloud Audit Logs) to route notifications to an incident-response channel.

Controls that collect, alert, and retain key-management events.

Generate near-real-time alerts when a KMS key version is disabled or scheduled for deletion, enabling rapid investigation and recovery.

CCC.KeyMgmt.CN02 Limit Decrypt Permissions

Identity and Access Management

Periodically audit policy documents via automated tooling and report any deviations.

Controls that enforce least-privilege use of KMS operations.

Restrict the Decrypt operation to authorised principals only, applying the principle of least privilege to protect sensitive data.

CCC.KeyMgmt.CN03 Enforce Automatic Rotation

Key Lifecycle Management

Use cloud-provider rotation features and verify via configuration scanning.

Controls that govern creation, rotation, import, and retirement of cryptographic keys.

Ensure symmetric keys rotate automatically within policy intervals to reduce exposure of key material.

CCC.KeyMgmt.CN04 Validate Imported Keys