grc.store

Search / finos-ccc/ccc.blocstor.cn / v2026.07-rc

Release · v2026.07-rc

FINOS-CCC/CCC.BlocStor.CN Control Catalog

FINOS-CCC/CCC.BlocStor.CN

Controls for Block Storage technologies, as defined by the FINOS Common Cloud Controls project.

Published by FINOS Common Cloud Controls

License Community-Spec-1.0

Install

OCI v1.1
$grcli unpack --repository finos-ccc/ccc.blocstor.cn --version v2026.07-rc

grcli unpack verifies this signature against the recorded identity below and fails closed before writing any files — no separate verify step needed. Pass --no-verify to skip.

Coordinate
oci.grc.store/finos-ccc/ccc.blocstor.cn:v2026.07-rc
Manifest digest
sha256:371cf883e843c7b7c268aadc65dbd212b7557cf225c30a9bf4df1b169aa5cc69
Signed by
no signature recorded

Identity recorded by this hub when the version was published; unpack (above) checks the signature against it.

Verify in CI — check the signature without downloading
$grcli verify --repository finos-ccc/ccc.blocstor.cn --version v2026.07-rc

Read-only: downloads nothing and exits non-zero if the signature or the recorded identity doesn't match — use it as an admission/policy gate.

Provenance

1 layer
Digest Media type Size
32a149c1ae64… application/vnd.gemara.artifact.v1+yaml 10.8 KiB
Bundle config blob 
{
  "bundle-version": "1.0",
  "gemara-version": "v1.2.0",
  "metadata": {
    "provenance": {
      "buildDefinition": {
        "buildType": "https://grc.store/grcli/buildtype/v0",
        "externalParameters": {
          "artifact": {
            "id": "CCC.BlocStor.CN",
            "type": "ControlCatalog"
          },
          "target": {
            "registry": "oci.grc.store",
            "repository": "finos-ccc/ccc.blocstor.cn",
            "tag": "v2026.07-rc"
          }
        },
        "internalParameters": {
          "CI": "true",
          "GITHUB_ACTIONS": "true",
          "GITHUB_ACTOR": "eddie-knight",
          "GITHUB_REF": "refs/heads/main",
          "GITHUB_REPOSITORY": "eddie-knight/common-cloud-controls",
          "GITHUB_RUN_ATTEMPT": "1",
          "GITHUB_RUN_ID": "28763687249",
          "GITHUB_SHA": "3e4a2c0ef4b966fcf7c8e2f0fd4f8da3f6ae02e1",
          "GITHUB_WORKFLOW": "Batch Release All Catalogs",
          "RUNNER_OS": "Linux"
        },
        "resolvedDependencies": [
          {
            "name": "artifacts/storage/block/controls.yaml",
            "uri": "file://artifacts/storage/block/controls.yaml",
            "digest": {
              "sha256": "32a149c1ae64f3c4b69f2b2d434e3b82ec2853ea1e6ff66aff384c1ea4815315"
            }
          },
          {
            "name": "source",
            "uri": "git+https://github.com/eddie-knight/common-cloud-controls@3e4a2c0ef4b966fcf7c8e2f0fd4f8da3f6ae02e1",
            "digest": {
              "gitCommit": "3e4a2c0ef4b966fcf7c8e2f0fd4f8da3f6ae02e1"
            }
          }
        ]
      },
      "runDetails": {
        "builder": {
          "id": "https://github.com/eddie-knight/common-cloud-controls/actions/runs/28763687249",
          "version": {
            "go": "go1.25.0",
            "go-arch": "amd64",
            "go-os": "linux",
            "grcli": "v0.4.1"
          }
        },
        "metadata": {
          "invocationId": "28763687249-1",
          "startedOn": "2026-07-06T02:27:00.691990506Z",
          "finishedOn": "2026-07-06T02:27:01.179648122Z"
        },
        "byproducts": [
          {
            "name": "controls.yaml",
            "digest": {
              "sha256": "32a149c1ae64f3c4b69f2b2d434e3b82ec2853ea1e6ff66aff384c1ea4815315"
            }
          }
        ]
      }
    }
  },
  "artifacts": [
    {
      "name": "controls.yaml",
      "type": "ControlCatalog",
      "id": "CCC.BlocStor.CN",
      "role": "artifact"
    }
  ]
}

CCC Block Storage Controls

Controls for Block Storage technologies, as defined by the FINOS Common Cloud Controls project.

ID
CCC.BlocStor.CN
Version
v2026.07-rc
Gemara version
v1.2.0
Author
FINOS Common Cloud Controls

Encryption

The Encryption group covers entries related to protecting data confidentiality and integrity through cryptographic mechanisms. This includes encryption in transit and at rest, key management, and certificate lifecycle management.

  1. CCC.BlocStor.CN01 Enforce Volume Encryption and Cryptographic Erasure

    Objective

    Ensure that all block volumes and their snapshots are encrypted at rest from creation and that their encryption keys are destroyed on deletion, so that data on reallocated storage cannot be recovered by a later user.

    Assessment requirements

    1. When a block volume or snapshot is created, the service MUST encrypt its data at rest using a unique cryptographic key AND MUST reject the creation of an unencrypted volume or snapshot.

      Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

    2. When a block volume or snapshot is created from an existing encrypted source, the service MUST retain encryption on the resulting resource AND MUST NOT produce an unencrypted copy.

      Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

    3. When a block volume is deleted, the service MUST render the volume's data unrecoverable by destroying its encryption key or cryptographically erasing the underlying storage before those blocks are reallocated.

      Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

    References to Other Documents
    Threats
    • CCC.BlocStor.Threats
      • CCC.BlocStor.TH01 — Residual Data Remains on Reallocated Volume Storage
      • CCC.BlocStor.TH05 — Volumes are Provisioned Without Encryption
    • CCC.Core.Threats
      • CCC.Core.TH18 — Encryption Key is Misused

Data Resilience

The Data Resilience group covers entries related to ensuring data availability, integrity, and sovereignty across its lifecycle. This includes replication, backup, recovery, region restrictions, and protection against data loss or corruption.

  1. CCC.BlocStor.CN02 Prevent Public or Cross-Account Snapshot Sharing

    Objective

    Ensure that volume snapshots cannot be shared publicly or with accounts outside the organization's trust boundary, preventing exposure of the data captured in a snapshot.

    Assessment requirements

    1. When a snapshot sharing setting is configured to make the snapshot publicly accessible, the service MUST prevent the configuration from taking effect.

      Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

    2. When a snapshot is shared with another account, the service MUST deny sharing with any account not listed as trusted by the organization.

      Applicability: tlp-amber, tlp-red

    3. When a snapshot's sharing scope is created or modified, the service MUST record the event including the snapshot identifier and the target accounts.

      Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

    References to Other Documents
    Threats
    • CCC.BlocStor.Threats
      • CCC.BlocStor.TH02 — Snapshots are Exposed to Unauthorized Accounts
    • CCC.Core.Threats
      • CCC.Core.TH01 — Access is Granted to Unauthorized Users

  2. CCC.BlocStor.CN04 Govern Multi-Attach with Shared-Reservation Controls

    Objective

    Ensure that multi-attach is disabled by default and, when enabled, concurrent access is coordinated so that simultaneous writes do not corrupt the volume's file system or data.

    Assessment requirements

    1. When a block volume is created, the service MUST disable multi-attach by default, requiring explicit configuration to enable it.

      Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

    2. When multi-attach is enabled for a block volume, the service MUST support a write-coordination mechanism, such as persistent reservations, so that concurrent writes from multiple instances are serialized.

      Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

    References to Other Documents
    Threats
    • CCC.BlocStor.Threats
      • CCC.BlocStor.TH04 — Multi-Attached Volume is Corrupted by Uncoordinated Writes

Access Control

The Access Control group covers entries related to authentication, authorization, and trust perimeter enforcement. This includes multi-factor authentication, least privilege access, network access rules, and prevention of unauthorized access or reconnaissance.

  1. CCC.BlocStor.CN03 Restrict Volume Attachment to Authorized Instances

    Objective

    Ensure that a block volume can only be attached to compute instances authorized within the volume's trust boundary, preventing data access from instances outside that boundary.

    Assessment requirements

    1. When an attempt is made to attach a block volume to a compute instance, the service MUST deny the attachment unless the requesting identity is authorized to attach that volume to that instance.

      Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

    2. When a block volume is attached or detached, the service MUST record the event including the volume identifier, the target instance, and the requesting identity.

      Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

    References to Other Documents
    Threats
    • CCC.BlocStor.Threats
      • CCC.BlocStor.TH03 — Volume is Attached to an Unauthorized Compute Instance
    • CCC.Core.Threats
      • CCC.Core.TH01 — Access is Granted to Unauthorized Users