Crypto / Key
Controls Version: v2026.11 (latest) DEV Download file from GitHub
ID Title Objective Control Family Threat Mappings Guideline Mappings Assessment Requirements CCC.KeyMgmt.CN02 Limit Cryptographic Operation Grants Restrict the decrypt, sign, and MAC-generation operations to authorised principals only, applying the principle of least privilege to protect sensitive data and the integrity of signed content. Access Control 2 2 2 CCC.KeyMgmt.CN03 Enforce Automatic Rotation Ensure symmetric keys rotate automatically within policy intervals to reduce exposure of key material. Encryption 2 2 2 CCC.KeyMgmt.CN04 Validate Imported Keys Accept only externally generated keys that meet approved cryptographic strength and provenance requirements. Encryption 1 2 2 CCC.KeyMgmt.CN05 Enforce a Key Deletion Recovery Window Ensure that destroyed key material remains recoverable long enough to detect and reverse an unintended deletion. Data Resilience 2 0 2 CCC.KeyMgmt.CN06 Restrict Key Algorithms to the Approved List Ensure that every key created in the service uses an algorithm and key length permitted by organizational cryptographic policy. Encryption 2 0 1 CCC.KeyMgmt.CN07 Require HSM Protection for Key Material Ensure that key material is generated and held only inside validated hardware security modules. Encryption 1 0 1 CCC.KeyMgmt.CN09 Bind Each Key to a Single Cryptographic Purpose Ensure that no key is exposed through more than one cryptographic protocol. Encryption 1 0 1 CCC.KeyMgmt.CN10 Alert on External Key Store Failures Ensure that loss of connectivity to an external key manager is detected before dependent workloads fail silently. Compromise of the external key manager is outside the scope of a service-side control. Observability 1 0 1