Ensure that a secret version cannot be destroyed before dependent systems have moved off it, and that disabling or scheduling the destruction of a version is observed.
Protect Secret Versions from Premature Loss
CCC.SecMgmt.CN04 · Data
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.SecMgmt.CP10 | Secret Version Disabling | The service can disable an individual secret version so that its value can no longer be retrieved, while retaining the version so that it may be re-enabled or destroyed later. Providers without a disable state revoke a version by removing its staging labels, after which the service deletes it without a recovery window. |
| CCC.Core.CP18 | Resource Versioning | The service automatically assigns versions to child resources which can be used to preserve, retrieve, and restore past iterations. |
| CCC.Core.CP32 | Deletion Protection | The service may be configured to block the deletion of a child resource, or to retain a deleted child resource for a recovery window during which it can be restored. |
| CCC.Core.CP11 | Backup | The service can generate copies of its data or configurations in the form of automated backups, snapshot-based backups, or incremental backups. |
| CCC.Core.CP34 | Data Lifecycle Policy | The service may be configured to automatically delete, archive, or transition data or child resources once a user-defined age or condition is reached. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.SecMgmt.TH04 | Secret Versions are Disabled While Systems Still Depend on Them | A secret version may be disabled, so that it still exists but its value can no longer be read, or scheduled for destruction while external systems still depend on it, and a destroyed version cannot be recovered once its recovery window elapses. Retrieval requests then fail or return no current version, and the credential material is lost if no other copy exists. The availability of every system that depends on the secret is affected. |
| CCC.Core.TH06 | Data is Lost or Corrupted | Services that rely on accurate data are susceptible to disruption in the event of data loss or corruption. Any actions that lead to the unintended deletion, alteration, or limited access to data can impact the availability of the service and the system it is part of. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.SecMgmt.CN04.AR01 | When a secret or secret version is deleted, the service MUST retain it in a recoverable state for at least 7 days before destruction. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.SecMgmt.CN04.AR02 | When a secret version is disabled or scheduled for destruction, an alert MUST be published to a monitored channel. | tlp-amber, tlp-red |