service-name: gcpSecrets
plugin-name: ccc-behavioural-plugin
plugin-uri: https://github.com/finos/common-cloud-controls
plugin-version: 0.0.0-dev
evaluation-suites:
- name: gcpSecrets_CCC.SecMgmt
  result: Passed
  catalog-id: CCC.SecMgmt
  start-time: 2026-06-22 17:50:17.331271528 +0000 UTC m=+2.678366861
  end-time: 2026-06-22 17:50:17.331316956 +0000 UTC m=+2.678412289
  corrupted-state: false
  control-evaluations:
    metadata:
      id: ""
      type: Invalid
      gemara-version: ""
      description: ""
      author:
        id: ""
        name: ccc-behavioural-plugin
        type: Invalid
        version: 0.0.0-dev
        uri: https://github.com/finos/common-cloud-controls
    result: Not Run
    evaluations:
    - name: Enforce Automatic Secret Rotation
      result: Passed
      message: Stale secret version retrieve is denied
      control:
        reference-id: CCC.SecMgmt
        entry-id: CCC.SecMgmt.CN01
      assessment-logs:
      - requirement:
          reference-id: ""
          entry-id: CCC.SecMgmt.CN01.AR01
        description: |
          Ensure that secrets are automatically rotated on a defined schedule to
          reduce the risk of secret compromise and unauthorized access.
        result: Passed
        message: Stale secret version retrieve is denied
        applicability:
        - tlp-red
        - tlp-amber
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        steps-executed: 2
        start: "2026-06-22T17:50:17Z"
        end: "2026-06-22T17:50:17Z"
        confidence-level: Medium
    - name: Enforce Secret Replication Policies
      result: Passed
      message: Unauthorized region read is denied
      control:
        reference-id: CCC.SecMgmt
        entry-id: CCC.SecMgmt.CN02
      assessment-logs:
      - requirement:
          reference-id: ""
          entry-id: CCC.SecMgmt.CN02.AR01
        description: |
          Ensure that secrets are replicated only to authorized locations as per
          organizational data residency and compliance requirements.
        result: Passed
        message: Unauthorized region read is denied
        applicability:
        - tlp-red
        - tlp-amber
        steps:
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        - main.behaviouralStepsFromCollector.godogScenarioStep.func3
        steps-executed: 2
        start: "2026-06-22T17:50:17Z"
        end: "2026-06-22T17:50:17Z"
        confidence-level: Medium
    target:
      id: ""
      name: ""
      type: Invalid
