CCC Container Registry Controls
Controls for Container Registry technologies, as defined by the FINOS Common Cloud Controls project.
- ID
- CCC.CntrReg.CN
- Version
- v2026.06-rc5
- Gemara version
- v1.2.0
- Author
- FINOS Common Cloud Controls
Orchestration
The Orchestration group covers entries related to coordinating and managing workloads across distributed systems. This includes container orchestration, job scheduling, CI/CD pipelines, build automation, and service mesh management.
CCC.CntrReg.CN01 Implement Vulnerability Scanning for Artifacts
Objective
Ensure that container images and artifacts stored in the container registry are scanned for vulnerabilities to identify and remediate security issues before deployment.
Assessment requirements
Attempt to push an artifact with known vulnerabilities to the registry and observe if it is flagged or rejected by the vulnerability scanning process.
Applicability: tlp-red, tlp-amber
Guidelines
- NIST-CSF
- ID.RA-1
- NIST_800_53
- RA-5
- SI-5
Threats
- CCC.CntrReg.Threats
- CCC.CntrReg.TH01
Resource Management
The Resource Management group covers entries related to the lifecycle, configuration, and operational integrity of cloud resources. This includes resource exhaustion, tag manipulation, version rollback, scaling, and cost management.
CCC.CntrReg.CN02 Implement Cleanup Policies for Artifacts
Objective
Ensure that unused or outdated artifacts are cleaned up according to defined policies to manage storage effectively and reduce security risks associated with outdated versions.
Assessment requirements
Confirm that artifacts older than the specified retention period are automatically deleted from the registry.
Applicability: tlp-red, tlp-amber
Guidelines
- NIST-CSF
- PR.IP-6
- NIST_800_53
- SI-12
Threats
- CCC.Core.Threats
- CCC.Core.TH14