| CCC.KeyMgmt.CN02 | Limit Cryptographic Operation Grants | Restrict the decrypt, sign, and MAC-generation operations to authorised principals only, applying the principle of least privilege to protect sensitive data and the integrity of signed content. | Access Control | 2 | 2 | 2 |
| CCC.KeyMgmt.CN03 | Enforce Automatic Rotation | Ensure symmetric keys rotate automatically within policy intervals to reduce exposure of key material. | Encryption | 2 | 2 | 2 |
| CCC.KeyMgmt.CN04 | Validate Imported Keys | Accept only externally generated keys that meet approved cryptographic strength and provenance requirements. | Encryption | 1 | 2 | 2 |
| CCC.KeyMgmt.CN05 | Enforce a Key Deletion Recovery Window | Ensure that destroyed key material remains recoverable long enough to detect and reverse an unintended deletion. | Data Resilience | 2 | 0 | 2 |
| CCC.KeyMgmt.CN06 | Restrict Key Algorithms to the Approved List | Ensure that every key created in the service uses an algorithm and key length permitted by organizational cryptographic policy. | Encryption | 2 | 0 | 1 |
| CCC.KeyMgmt.CN07 | Require HSM Protection for Key Material | Ensure that key material is generated and held only inside validated hardware security modules. | Encryption | 1 | 0 | 1 |
| CCC.KeyMgmt.CN09 | Bind Each Key to a Single Cryptographic Purpose | Ensure that no key is exposed through more than one cryptographic protocol. | Encryption | 1 | 0 | 1 |
| CCC.KeyMgmt.CN10 | Alert on External Key Store Failures | Ensure that loss of connectivity to an external key manager is detected before dependent workloads fail silently. Compromise of the external key manager is outside the scope of a service-side control. | Observability | 1 | 0 | 1 |