CCC Secret Management Controls
Controls for Secret Management technologies, as defined by the FINOS Common Cloud Controls project.
- ID
- CCC.SecMgmt.CN
- Version
- v2026.06-rc3
- Gemara version
- v1.2.0
- Author
- FINOS Common Cloud Controls
Access Control
The Access Control group covers entries related to authentication, authorization, and trust perimeter enforcement. This includes multi-factor authentication, least privilege access, network access rules, and prevention of unauthorized access or reconnaissance.
CCC.SecMgmt.CN01 Enforce Automatic Secret Rotation
Objective
Ensure that secrets are automatically rotated on a defined schedule to reduce the risk of secret compromise and unauthorized access.
Assessment requirements
Attempt to use an outdated version of a secret after its rotation period has passed and verify that access is denied.
Applicability: tlp-red, tlp-amber
Guidelines
- NIST-CSF
- PR.DS-6
- NIST_800_53
- SC-12
- SC-28
Threats
- CCC.Core.Threats
- CCC.Core.TH01
- CCC.Core.TH14
Data Resilience
The Data Resilience group covers entries related to ensuring data availability, integrity, and sovereignty across its lifecycle. This includes replication, backup, recovery, region restrictions, and protection against data loss or corruption.
CCC.SecMgmt.CN02 Enforce Secret Replication Policies
Objective
Ensure that secrets are replicated only to authorized locations as per organizational data residency and compliance requirements.
Assessment requirements
Attempt to retrieve a secret from an unauthorized region and verify that access is denied.
Applicability: tlp-red, tlp-amber
Guidelines
- NIST-CSF
- PR.DS-5
- NIST_800_53
- AC-3
- SC-7
Threats
- CCC.Core.Threats
- CCC.Core.TH03
- CCC.Core.TH04