Ensure that alerts cannot be silenced, snoozed, or disabled by users other than authorized responders, or for an unbounded period.
Restrict Alert Suppression
CCC.Monitor.CN05 · Access Control
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP17 | Alerting | The service may be configured to emit a notification based on a user-defined condition related to the data published by a child or networked resource. |
| CCC.Monitor.CP13 | Alert Suppression | The service may be configured to suppress or snooze alert notifications for a period of time or for matching conditions, so that alerts are not delivered during maintenance or known incidents. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.TH08 | Alerts are Suppressed Without Expiry or Authorization | Alert suppression, snooze, or action-disable settings may be applied by a user with write access to alerting configuration while telemetry continues to be published. Alert conditions are still evaluated but no notification or action is delivered, so the activity that would have raised the alert proceeds undetected. This impacts the availability of security and operational information and delays incident response. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.Monitor.CN05.AR01 | When a user suppresses, snoozes, or disables an alert, the service MUST require a permission that is granted only to authorized responders. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.Monitor.CN05.AR02 | When an alert suppression is created, it MUST have an expiry time after which the alert is delivered again. | tlp-clear, tlp-green, tlp-amber, tlp-red |