finos/common-cloud-controls

build-threat-catalog

Create a CCC threat catalog (threats.yaml) for a cloud service — import applicable core threats, define service-specific threats mapped to the service's capabilities, and map each to external frameworks (MITRE ATT&CK, MITRE D3FEND, CISA KEV, CWE, OWASP) via…

build-capability-catalog

Create a CCC capability catalog (metadata.yaml + capabilities.yaml) for a cloud service, mapping equivalent offerings across AWS, Azure, and GCP and placing them in the correct catalogs / category folder. Use whenever the user asks to "create a capability…

build-control-catalog

Create a CCC control catalog (controls.yaml) for a cloud service — import applicable core controls, define service-specific controls mapped to identified threats, and include testable assessment requirements that validate against schemas/controls-schema.json.…

build-features-and-cloud-api

Implement an approved modules/features/<service>/analysis.md: Gherkin features (reusing generic/ where planned), cloud-api Go package and factory wiring, modules/cloud-api-test/terraform fixtures per cloud, integration_calls.csv,…

build-service-behavioural-test-analysis

Analyse a CCC service control catalog and produce analysis.md plus a minimal cloud-api interface design for behavioural tests. Use when ingesting catalogs/*/*/controls.yaml, creating modules/features folders, or planning @Behavioural Gherkin scenarios before…