| CCC.SecMgmt.CP01 | Secret Storage | The service always stores sensitive values such as API keys, passwords, and certificates as named secrets that can be retrieved only by authorized users and external systems. | 1 |
| CCC.SecMgmt.CP02 | Secret Creation - Plaintext | The service can create a secret whose value is a plain text string, for sensitive data such as API keys and database credentials. | 1 |
| CCC.SecMgmt.CP04 | Secret Creation - Binary Data | The service can create a secret whose value is binary data, such as a certificate or private key file. Providers that accept only string values require the binary content to be encoded before storage. | 1 |
| CCC.SecMgmt.CP05 | Update Secrets | The service can update the value or metadata of an existing secret after creation, and automatically stores an updated value as a new version of that secret. | 1 |
| CCC.SecMgmt.CP07 | Scheduled Secret Rotation | The service may be configured with a rotation schedule for a secret; when rotation is due it invokes a user-defined rotation function or publishes a notification so that an external system rotates the value. Providers that only notify leave the stale credential valid until an external system completes the rotation. | 1 |
| CCC.SecMgmt.CP10 | Secret Version Disabling | The service can disable an individual secret version so that its value can no longer be retrieved, while retaining the version so that it may be re-enabled or destroyed later. Providers without a disable state revoke a version by removing its staging labels, after which the service deletes it without a recovery window. | 1 |