Management / Monitoring / Controls / v2026.11
Restrict Monitoring Probe Reach
CCC.Monitor.CN03 · Access Control
Ensure that synthetic and uptime checks that reach non-public endpoints cannot be used as a path into other internal systems.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.Monitor.CP06 | Synthetic Monitoring | The service may be configured to run scripted sample user interactions against an application on a schedule from provider-operated locations, in order to identify issues before real users are impacted. |
| CCC.Monitor.CP07 | Uptime Monitoring | The service may be configured to probe an endpoint from external provider-operated locations on a schedule and record whether it is reachable and responding. |
Related Threats
| ID | Title | Description |
|---|
| CCC.Monitor.TH04 | Monitoring Probes are Used to Reach Internal Systems | Synthetic and uptime checks run with an identity, network placement, and stored credentials that allow them to reach endpoints not otherwise exposed. If the check definition or its script can be modified, the check becomes a trusted path through which arbitrary requests are issued against internal systems and their responses are recorded. This impacts the confidentiality and integrity of the internal systems reached. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.Monitor.CN03.AR01 | When a synthetic or uptime check targets an endpoint that is not publicly reachable, the check MUST run with an identity whose permissions are limited to that target endpoint. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.Monitor.CN03.AR02 | When a synthetic or uptime check is placed inside a private network, its network access MUST be limited to the network segment of the target endpoint. | tlp-clear, tlp-green, tlp-amber, tlp-red |