Core Controls Should somehow be able to mitigate service-specific threats

## Bug Report

... however this breaks the core / specific mapping system - those service specific threats would end up being pulled into the core catalog too.

## Examples (from FileStor)

_CN07 — Protect Runtime Metrics (TH08, weak TH09)_

Fully generic. Any service with CP09 (Metrics Publication) needs this. Core today has no control mapped to TH08; CN09 (log integrity) only partially touches TH09.

CN07.AR02 (block unauthorized changes to metric publication config) also overlaps thematically with CN15 — that’s fine; CN15 is about disabling alerts/events, CN07 is about read access and config tampering.

Suggested core ID: CCC.Core.CN16 — Protect Runtime Metrics from Unauthorized Access

_CN08 — Restrict Access to State-Change Events (TH10)_

Fully generic. Maps to CP07 (Event Publication). Wording is already almost core-ready — swap “file system” for “service or a child resource”.

CCC.Monitor has related controls (e.g. who can silence alerts), but that’s a different angle on TH10. This is the resource-side “who can read published events” control, which no core control covers today.

Suggested core ID: CCC.Core.CN17 — Restrict Access to State-Change Events

_CN09 — Prevent Unauthorized Modification of Resource Tags (TH13)_

Fully generic. Any service with CP20 (Resource Tagging) should inherit this. Object storage imports TH13 but has no equivalent control — same gap CN15 filled for TH11/TH16.

Suggested core ID: CCC.Core.CN18 — Prevent Unauthorized Modification of Resource Tags

_CN05 — Restrict Snapshot and Replica Access (FileStor.TH05, Core.TH05)_

Substance is not file-storage-specific — it’s “copies must not be more open than primary.” That applies anywhere CP08/CP11/CP12 exist.

Peer evidence: CCC.RDMS.CN05 (Restrict Snapshot Sharing to Authorized Accounts) is the same pattern, still service-local. Promoting a generalized version would deduplicate RDMS + FileStor + future backup-capable services.

Generalize:

“snapshot, replica, or backup copy of the service or a child resource”
keep cross-account allowlist AR
Suggested core ID: CCC.Core.CN19 — Restrict Snapshot and Replica Access