Skip to main content

Governance artifact

Gemara Layer 2

ControlCatalog

Control

Purpose

Technology-specific, threat-informed security controls for protecting information systems.

Role

Controls are the safeguards: they mitigate threats, implement guidance, and carry verifiable assessment requirements that reflects policy plans and evaluation logs can reference.

Examples

Non-public information review

Before company-attributed publication, contribution material is reviewed so secrets, client data and other non-public information are not disclosed. The control mitigates the sensitive-disclosure threat and implements classification guidance; assessment requirements drive secret scanning and human review.

Source: Non-Public Information Review (foss-ctl-008-data-leakage-review) in FOSS Contribution Control Catalog.

Intellectual property review

Legal or IP review records an approval disposition before contribution proceeds. When PR #417 is evaluated, that disposition is checked as evidence the control was applied.

Source: Intellectual Property Review (foss-ctl-007-ip-review) in FOSS Contribution Control Catalog.

OSPO inventory registration and project approval

Engagements are registered and approved before contribution—so ungoverned activity is not the default path. Applicability groups distinguish company-moderated, company-interest and personal contribution contexts.

Source: OSPO Inventory Registration (foss-ctl-002-ospo-registration) and OSPO Project Approval (foss-ctl-003-ospo-approval) in FOSS Contribution Control Catalog.

Default object retention policy

Every uploaded object receives a default retention policy that blocks premature deletion or modification—mitigating data loss and the object-storage threat of exfiltration via insecure lifecycle policies. Assessment requirements spell out what must hold on upload and on delete/modify attempts.

Source: Objects have an Effective Retention Policy by Default (CCC.ObjStor.CN04) in FINOS CCC Object Storage.

Uniform bucket-level access on cloud storage

Uniform bucket-level access is enforced so ad-hoc object permissions cannot drift—centralising least-privilege management and reducing the chance that misconfigured access grants reach unauthorized users.

Source: Enforce Uniform Bucket-level Access (CCC.ObjStor.CN02) in FINOS CCC Object Storage.

MFA required for object deletion

Object deletion requires multi-factor authentication, with audit logs recording whether MFA was required and satisfied—reducing accidental or compromised-credential destruction and giving evaluation something concrete to check.

Source: Multi-Factor Authentication Is Required for Object Deletion (CCC.ObjStor.CN07) in FINOS CCC Object Storage.

Anti-patterns

Controls without assessment requirements

A named safeguard that nothing can test. Evaluation and audit then invent ad-hoc checks.

Controls are too fine-grained

Splitting every check into its own control—“deny unencrypted PUT”, “deny unencrypted GET”, “deny unencrypted LIST”—until the catalog is unreadable and assessment plans become a checklist of trivia. Prefer a coherent safeguard with clear assessment requirements (and applicability where contexts differ) over a swarm of near-duplicate entries.

References