| CCC.ObjStor.CN01 | Prevent Requests to Buckets or Objects with Untrusted KMS Keys | Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption, or sensitive data decryption. | Encryption | 4 | 3 | 4 |
| CCC.ObjStor.CN02 | Enforce Bucket-Level-Only Access to Prevent Inconsistent Permissions | Ensure that a bucket-level-only access policy is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege. | Access Control | 2 | 1 | 2 |
| CCC.ObjStor.CN03 | Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy | Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset. | Data Resilience | 2 | 2 | 2 |
| CCC.ObjStor.CN04 | Apply a Default Retention Policy to All Objects | Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects. | Data Resilience | 2 | 2 | 2 |
| CCC.ObjStor.CN05 | Enable Versioning for All Objects in the Bucket | Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption. | Data Resilience | 1 | 2 | 4 |
| CCC.ObjStor.CN07 | Require Multi-Factor Authentication for Object Deletion | Ensure that deletion of objects stored in the object storage system is protected by multi-factor authentication (MFA), reducing the risk of accidental, unauthorized, or compromised-credential–based data destruction. | Access Control | 3 | 2 | 3 |
| CCC.ObjStor.CN08 | Enforce Constraints on Pre-Signed URL Generation | Ensure that pre-signed URLs are generated with minimum necessary permissions, limited expiry durations, and auditable generation events to prevent unauthorized access through leaked or overly permissive URLs. | Access Control | 3 | 3 | 5 |
| CCC.ObjStor.CN09 | Block Public Access by Default | Ensure that all buckets and objects are protected from public (unauthenticated or anonymous) access by default, requiring explicit and auditable action to override. | Access Control | 2 | 3 | 4 |
| CCC.ObjStor.CN10 | Restrict Storage Class Transitions to Approved Tiers | Ensure that objects cannot be transitioned to storage classes with lower durability or availability guarantees without explicit authorization, preventing degradation of data resilience through misconfigured lifecycle policies or unauthorized actions. | Data Resilience | 2 | 3 | 3 |
| CCC.ObjStor.CN11 | Expire Noncurrent Object Versions | Ensure that superseded and deleted object versions are permanently removed after a bounded period, so that data users consider removed does not remain readable indefinitely. | Data Resilience | 1 | 1 | 1 |
| CCC.ObjStor.CN12 | Restrict Cross-Origin Resource Sharing to Approved Origins | Ensure that browsers may only make cross-origin requests to a bucket from web origins the organization has approved. No provider rejects such rules natively, so a policy-as-code check on bucket configuration satisfies these requirements. | Access Control | 1 | 1 | 2 |
| CCC.ObjStor.CN13 | Bound the Period of Irrevocable Retention Locks | Ensure that an irrevocable retention lock cannot commit the organization to retaining data for longer than its retention policy permits. No provider bounds the period natively, so a policy-as-code check on lock requests satisfies this requirement. | Data Resilience | 1 | 1 | 1 |
| CCC.ObjStor.CN14 | Restrict Bucket Access to Organization-Owned Accounts | Ensure that requests from within the trust perimeter only reach buckets owned by accounts the organization controls, so that a reclaimed or look-alike bucket name cannot receive or serve the organization's data. | Access Control | 1 | 1 | 1 |
| CCC.ObjStor.CN15 | Restrict Bucket Listing to Explicitly Authorized Identities | Ensure that the set of object keys and listing metadata in a bucket is disclosed only to identities explicitly granted list permission, since keys and metadata may themselves carry sensitive information. | Access Control | 1 | 1 | 1 |