Control
Technology-specific, threat-informed security controls for protecting information systems.
Role
Controls are the safeguards: they mitigate threats, implement guidance, and carry verifiable assessment requirements that reflects policy plans and evaluation logs can reference.
Examples
Non-public information review
Before company-attributed publication, contribution material is reviewed so secrets, client data and other non-public information are not disclosed. The control mitigates the sensitive-disclosure threat and implements classification guidance; assessment requirements drive secret scanning and human review.
Source: Non-Public Information Review (foss-ctl-008-data-leakage-review) in FOSS Contribution Control Catalog.
Intellectual property review
Legal or IP review records an approval disposition before contribution proceeds. When PR #417 is evaluated, that disposition is checked as evidence the control was applied.
Source: Intellectual Property Review (foss-ctl-007-ip-review) in FOSS Contribution Control Catalog.
OSPO inventory registration and project approval
Engagements are registered and approved before contribution—so ungoverned activity is not the default path. Applicability groups distinguish company-moderated, company-interest and personal contribution contexts.
Source: OSPO Inventory Registration (foss-ctl-002-ospo-registration) and OSPO Project Approval (foss-ctl-003-ospo-approval) in FOSS Contribution Control Catalog.
Default object retention policy
Every uploaded object receives a default retention policy that blocks premature deletion or modification—mitigating data loss and the object-storage threat of exfiltration via insecure lifecycle policies. Assessment requirements spell out what must hold on upload and on delete/modify attempts.
Source: Objects have an Effective Retention Policy by Default (CCC.ObjStor.CN04) in FINOS CCC Object Storage.
Uniform bucket-level access on cloud storage
Uniform bucket-level access is enforced so ad-hoc object permissions cannot drift—centralising least-privilege management and reducing the chance that misconfigured access grants reach unauthorized users.
Source: Enforce Uniform Bucket-level Access (CCC.ObjStor.CN02) in FINOS CCC Object Storage.
MFA required for object deletion
Object deletion requires multi-factor authentication, with audit logs recording whether MFA was required and satisfied—reducing accidental or compromised-credential destruction and giving evaluation something concrete to check.
Source: Multi-Factor Authentication Is Required for Object Deletion (CCC.ObjStor.CN07) in FINOS CCC Object Storage.
Links upstream
Links downstream
- Policy assessment plans reference requirement ids
Anti-patterns
Controls without assessment requirements
A named safeguard that nothing can test. Evaluation and audit then invent ad-hoc checks.
Controls are too fine-grained
Splitting every check into its own control—“deny unencrypted PUT”, “deny unencrypted GET”, “deny unencrypted LIST”—until the catalog is unreadable and assessment plans become a checklist of trivia. Prefer a coherent safeguard with clear assessment requirements (and applicability where contexts differ) over a swarm of near-duplicate entries.