Storage / Object / Controls / v2026.11
Restrict Storage Class Transitions to Approved Tiers
CCC.ObjStor.CN10 · Data Resilience
Ensure that objects cannot be transitioned to storage classes with lower durability or availability guarantees without explicit authorization, preventing degradation of data resilience through misconfigured lifecycle policies or unauthorized actions.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.Core.CP34 | Data Lifecycle Policy | The service may be configured to automatically delete, archive, or transition data or child resources once a user-defined age or condition is reached. |
| CCC.ObjStor.CP12 | Storage Classes | The service always offers multiple storage classes with differing durability, availability and retrieval latency, and an object may be configured to use a class other than the default. |
| CCC.Core.CP11 | Backup | The service can generate copies of its data or configurations in the form of automated backups, snapshot-based backups, or incremental backups. |
| CCC.Core.CP18 | Resource Versioning | The service automatically assigns versions to child resources which can be used to preserve, retrieve, and restore past iterations. |
| CCC.Core.CP32 | Deletion Protection | The service may be configured to block the deletion of a child resource, or to retain a deleted child resource for a recovery window during which it can be restored. |
Related Threats
| ID | Title | Description |
|---|
| CCC.ObjStor.TH03 | Objects are Transitioned to a Lower-Durability Storage Class | An authorized entity or misconfigured lifecycle policy may transition objects from a high-durability or high-availability storage class to a lower-durability or single-zone class. This degradation manifests only when a subsequent failure occurs (e.g., availability zone outage). Objects may also be transitioned to archival tiers, rendering them effectively inaccessible for extended retrieval periods during incidents. |
| CCC.Core.TH06 | Data is Lost or Corrupted | Services that rely on accurate data are susceptible to disruption in the event of data loss or corruption. Any actions that lead to the unintended deletion, alteration, or limited access to data can impact the availability of the service and the system it is part of. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.ObjStor.CN10.AR01 | When a lifecycle policy is configured to transition objects to a different storage class, the service MUST prevent transitions to any storage class not included in an organization-defined list of approved tiers. | tlp-green, tlp-amber, tlp-red |
| CCC.ObjStor.CN10.AR02 | When a manual request is made to change an object's storage class to a tier with lower durability or availability, the service MUST require explicit approval from an identity with elevated privileges. | tlp-amber, tlp-red |
| CCC.ObjStor.CN10.AR03 | When a storage class transition occurs, the service MUST publish an auditable log entry including the identity that initiated the transition, the source and destination classes, and the affected objects. | tlp-green, tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| CCM | DSP-16 | Data Retention and Deletion |
| CCM | DSP-17 | Sensitive Data Protection |
| CCM | LOG-08 | Log Records |