| CCC.Monitor.CN01 | Limit Monitoring Probe Load on Targets | Ensure that synthetic and uptime checks cannot consume the capacity of the endpoints they monitor. | Observability | 1 | 4 | 1 |
| CCC.Monitor.CN03 | Restrict Monitoring Probe Reach | Ensure that synthetic and uptime checks that reach non-public endpoints cannot be used as a path into other internal systems. | Access | 1 | 4 | 2 |
| CCC.Monitor.CN04 | Restrict Access to Dashboards and Health Status | Ensure that dashboards, uptime results, and service level objective status are visible only to authorized users. | Access | 1 | 4 | 1 |
| CCC.Monitor.CN05 | Restrict Alert Suppression | Ensure that alerts cannot be silenced, snoozed, or disabled by users other than authorized responders, or for an unbounded period. | Access | 1 | 3 | 2 |
| CCC.Monitor.CN06 | Scope Telemetry Publishing Permissions | Ensure that an identity can publish telemetry only for the resources it owns, so that a compromised workload or agent cannot fabricate telemetry about other systems or create unbounded metric series. | Access | 4 | 2 | 2 |
| CCC.Monitor.CN07 | Restrict Telemetry to Approved Fields | Ensure that only explicitly selected metrics, dimensions, and trace attributes are collected, so that sensitive data is neither captured in telemetry nor carried out through it. | Observability | 2 | 0 | 2 |
| CCC.Monitor.CN08 | Restrict Telemetry Destinations and Action Targets | Ensure that telemetry is forwarded only to approved external systems and that alerts can invoke only approved actions with least-privilege identities. | Access | 4 | 0 | 3 |
| CCC.Monitor.CN09 | Restrict Cross-Account Monitoring Scope | Ensure that telemetry is aggregated across accounts, subscriptions, or projects only with the authorization of each linked account. | Access | 2 | 0 | 2 |
| CCC.Monitor.CN10 | Alert on Telemetry Ingestion Volume | Ensure that a flood of metric series or data points is detected before the resulting charges accrue. | Observability | 1 | 0 | 1 |