| CCC.KeyMgmt.TH01 | Key Versions are Deleted or Disabled | Disabling, scheduling deletion, or permanently purging KMS key versions that protect sensitive data can prevent required decryption or signing operations. Service interruption or irreversible data loss may occur if the key material is no longer recoverable. | 0 | 2 | 1 |
| CCC.KeyMgmt.TH02 | A KMS Key is Used to Decrypt Data Without Restriction | Misconfigured permissions that allow broad invocation of the Decrypt API can expose plaintext data, enabling unintended disclosure or exfiltration of sensitive information. | 0 | 2 | 1 |
| CCC.KeyMgmt.TH03 | Key Rotation is Disabled or Delayed Beyond Policy Limits | Modification of automatic or manual rotation settings can keep older key material active longer than intended, decreasing cryptographic resilience and extending exposure in the event of key compromise. | 0 | 1 | 1 |
| CCC.KeyMgmt.TH04 | Weak or Compromised Key Material is Imported | Insufficient validation during the key-import process may allow weak, back-doored, or otherwise compromised key material to be introduced, reducing the overall strength of subsequent cryptographic operations. | 0 | 1 | 1 |
| CCC.KeyMgmt.TH05 | Keys are Created With Algorithms Not Permitted by Policy | Key creation accepts any supported algorithm and key length, so a key may be created with a curve or modulus that organizational policy or a regulatory baseline does not permit, such as a non-NIST curve or a modulus below the required size. Data or signatures protected by that key then rely on weaker cryptography than intended. Confidentiality and integrity of the protected data are reduced for the life of the ciphertext or signature. | 0 | 1 | 1 |
| CCC.KeyMgmt.TH06 | Key Material is Generated or Stored Outside a Hardware Security Module | Keys may be created with a software protection level instead of being generated and held in a validated hardware security module. Key material then exists in a form that can be extracted or copied by a compromised host or privileged operator. Confidentiality of every item protected by the key is lost if the material is exfiltrated. | 0 | 1 | 1 |
| CCC.KeyMgmt.TH07 | Signing or MAC Key is Used to Authenticate Unauthorized Content | Permission to invoke sign or MAC operations may be granted more broadly than intended, or a signing key may be reachable from a compromised workload. Signatures or authentication codes are then produced over content the key owner did not approve, and verifiers accept that content as genuine. Integrity of the code, tokens, or messages that trust the key is compromised, and the key owner cannot distinguish forged artifacts from legitimate ones. | 0 | 2 | 1 |
| CCC.KeyMgmt.TH08 | A Single Key is Used for Multiple Cryptographic Purposes | A key may be created without a usage restriction, or with a restriction that permits both encryption and signing operations. The same key material is then exposed through two different cryptographic protocols, enabling cross-protocol attacks in which an oracle from one operation reveals information about the other. Confidentiality of data encrypted with the key and integrity of signatures produced with it are both weakened. | 0 | 1 | 1 |
| CCC.KeyMgmt.TH09 | External Key Store is Unavailable or Compromised | When keys are held in an external key manager, every encrypt and decrypt request depends on a network path to, and the correct operation of, infrastructure outside the provider. Loss of that path or of the external system halts all operations with those keys, and compromise of the external system exposes the key material or the plaintext data keys that pass through it. Availability of every workload that depends on the keys and confidentiality of the data they protect are affected. | 0 | 1 | 1 |