Bug Report
... however this breaks the core / specific mapping system - those service specific threats would end up being pulled into the core catalog too.
Examples (from FileStor)
CN07 — Protect Runtime Metrics (TH08, weak TH09)
Fully generic. Any service with CP09 (Metrics Publication) needs this. Core today has no control mapped to TH08; CN09 (log integrity) only partially touches TH09.
CN07.AR02 (block unauthorized changes to metric publication config) also overlaps thematically with CN15 — that’s fine; CN15 is about disabling alerts/events, CN07 is about read access and config tampering.
Suggested core ID: CCC.Core.CN16 — Protect Runtime Metrics from Unauthorized Access
CN08 — Restrict Access to State-Change Events (TH10)
Fully generic. Maps to CP07 (Event Publication). Wording is already almost core-ready — swap “file system” for “service or a child resource”.
CCC.Monitor has related controls (e.g. who can silence alerts), but that’s a different angle on TH10. This is the resource-side “who can read published events” control, which no core control covers today.
Suggested core ID: CCC.Core.CN17 — Restrict Access to State-Change Events
CN09 — Prevent Unauthorized Modification of Resource Tags (TH13)
Fully generic. Any service with CP20 (Resource Tagging) should inherit this. Object storage imports TH13 but has no equivalent control — same gap CN15 filled for TH11/TH16.
Suggested core ID: CCC.Core.CN18 — Prevent Unauthorized Modification of Resource Tags
CN05 — Restrict Snapshot and Replica Access (FileStor.TH05, Core.TH05)
Substance is not file-storage-specific — it’s “copies must not be more open than primary.” That applies anywhere CP08/CP11/CP12 exist.
Peer evidence: CCC.RDMS.CN05 (Restrict Snapshot Sharing to Authorized Accounts) is the same pattern, still service-local. Promoting a generalized version would deduplicate RDMS + FileStor + future backup-capable services.
Generalize:
“snapshot, replica, or backup copy of the service or a child resource”
keep cross-account allowlist AR
Suggested core ID: CCC.Core.CN19 — Restrict Snapshot and Replica Access
Bug Report
... however this breaks the core / specific mapping system - those service specific threats would end up being pulled into the core catalog too.
Examples (from FileStor)
CN07 — Protect Runtime Metrics (TH08, weak TH09)
Fully generic. Any service with CP09 (Metrics Publication) needs this. Core today has no control mapped to TH08; CN09 (log integrity) only partially touches TH09.
CN07.AR02 (block unauthorized changes to metric publication config) also overlaps thematically with CN15 — that’s fine; CN15 is about disabling alerts/events, CN07 is about read access and config tampering.
Suggested core ID: CCC.Core.CN16 — Protect Runtime Metrics from Unauthorized Access
CN08 — Restrict Access to State-Change Events (TH10)
Fully generic. Maps to CP07 (Event Publication). Wording is already almost core-ready — swap “file system” for “service or a child resource”.
CCC.Monitor has related controls (e.g. who can silence alerts), but that’s a different angle on TH10. This is the resource-side “who can read published events” control, which no core control covers today.
Suggested core ID: CCC.Core.CN17 — Restrict Access to State-Change Events
CN09 — Prevent Unauthorized Modification of Resource Tags (TH13)
Fully generic. Any service with CP20 (Resource Tagging) should inherit this. Object storage imports TH13 but has no equivalent control — same gap CN15 filled for TH11/TH16.
Suggested core ID: CCC.Core.CN18 — Prevent Unauthorized Modification of Resource Tags
CN05 — Restrict Snapshot and Replica Access (FileStor.TH05, Core.TH05)
Substance is not file-storage-specific — it’s “copies must not be more open than primary.” That applies anywhere CP08/CP11/CP12 exist.
Peer evidence: CCC.RDMS.CN05 (Restrict Snapshot Sharing to Authorized Accounts) is the same pattern, still service-local. Promoting a generalized version would deduplicate RDMS + FileStor + future backup-capable services.
Generalize:
“snapshot, replica, or backup copy of the service or a child resource”
keep cross-account allowlist AR
Suggested core ID: CCC.Core.CN19 — Restrict Snapshot and Replica Access