Skip to main content

CCC.SvlsComp.CN02: Implement Function Invocation Rate Limits

Control ID:CCC.SvlsComp.CN02
Title:Implement Function Invocation Rate Limits
Objective:Ensure that function invocation is limited to a specified threshold from any single entity, preventing resource exhaustion and denial of service attacks.
Control Family:
Availability

Related Threats

IDTitleDescriptionExternal MappingsCapability MappingsControl Mappings
CCC.Core.TH12Resource Constraints are ExhaustedExceeding the resource constraints through excessive consumption, resource-intensive operations, or lowering of rate-limit thresholds can impact the availability of elements such as memory, CPU, or storage. This may disrupt availability of the service or child resources by denying the associated functionality to users. If the impacted system is not designed to expect such a failure, the effect could also cascade to other services and resources.
1
1
0

Related Capabilities

IDTitleDescription
CCC.Core.CP04Transaction Rate LimitsThe service can throttle, delay, or reject excess requests when transactions exceed a user-specified rate limit, and always provides industry-standard throughput up to that limit.
CCC.Core.CP16BudgetingThe service may be configured to take a user-specified action when a spending threshold is met or exceeded on a child or networked resource.
CCC.Core.CP19Resource ScalingThe service may be configured to scale child resources automatically or on-demand.

Guideline Mappings

Reference IDEntry IDStrengthRemarks
NIST-CSF
PR.DS-4
0
Adequate capacity to ensure availability
NIST_800_53
SC-5
0
Denial of Service Protection

Assessment Requirements

IDDescriptionApplicability
CCC.SvlsComp.CN02.AR01Send requests to invoke the function up to the allowed threshold and confirm they are successful; then send additional requests exceeding the threshold from the same entity and verify that they are denied.
tlp-red
tlp-amber