Crypto / Secrets / Controls / v2026.11
Enforce Scheduled Secret Rotation
CCC.SecMgmt.CN01 · Access Control
Ensure that secrets are rotated on a defined schedule to reduce the risk of secret compromise and unauthorized access.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.SecMgmt.CP07 | Scheduled Secret Rotation | The service may be configured with a rotation schedule for a secret; when rotation is due it invokes a user-defined rotation function or publishes a notification so that an external system rotates the value. Providers that only notify leave the stale credential valid until an external system completes the rotation. |
| CCC.Core.CP07 | Event Publication | The service automatically publishes a structured state-change record upon creation, deletion, or modification of data, configuration, components, or child resources. |
| CCC.Core.CP18 | Resource Versioning | The service automatically assigns versions to child resources which can be used to preserve, retrieve, and restore past iterations. |
Related Threats
| ID | Title | Description |
|---|
| CCC.SecMgmt.TH03 | Secrets are Not Rotated or Rotation Fails | A rotation schedule may be absent, the rotation function may fail before it stores the new value as a new secret version, or a rotation-due notification may go unanswered where the provider only notifies an external system. A credential then remains valid for an unbounded period, so a compromise that is never detected keeps granting access, while a partially completed rotation can leave external systems holding a credential that the target no longer accepts. Confidentiality of the protected systems and availability of their consumers are affected. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.SecMgmt.CN01.AR01 | When a secret is stored, a rotation schedule MUST be configured with an interval of 90 days or less. | tlp-amber, tlp-red |
| CCC.SecMgmt.CN01.AR02 | When a scheduled rotation has not produced a new secret version within 24 hours of its due time, an alert MUST be published to a monitored channel. | tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| NIST-CSF | PR.AC-1 | Identities and credentials are issued, managed, verified, revoked, and audited |
| NIST_800_53 | IA-5 | Authenticator Management |