| CCC.VPC.CN01 | Restrict Default Network Creation | Restrict the automatic creation of default virtual networks and related resources during subscription initialization to avoid insecure default configurations and enforce custom network policies. | Networking | 1 | 4 | 1 |
| CCC.VPC.CN02 | Prevent Default Exposure of Resources to the Internet | Ensure that resources in the virtual network are not reachable from the public internet unless explicitly configured, to minimize attack surfaces. | Networking | 1 | 4 | 2 |
| CCC.VPC.CN03 | Restrict Peering and Transit Attachments to Authorized Accounts | Ensure VPC peering connections and transit hub attachments are only established with explicitly authorized destinations to limit network exposure and enforce boundary controls. | Networking | 1 | 4 | 2 |
| CCC.VPC.CN04 | Enforce VPC Flow Logs on VPCs | Ensure VPCs are configured with flow logs enabled to capture traffic information. | Observability | 1 | 4 | 1 |
| CCC.VPC.CN05 | Restrict Private Endpoints to Authorized Targets and Principals | Ensure that private endpoints only reach resources inside the trust perimeter and only serve authorized principals, so that an endpoint cannot become a path for data exfiltration or unauthorized access. | Networking | 1 | 2 | 2 |
| CCC.VPC.CN06 | Prevent Overlapping Address Ranges | Ensure that connected networks never share address space, so that traffic is always delivered to the intended network. | Networking | 1 | 1 | 1 |
| CCC.VPC.CN07 | Alert on Changes That Redirect or Expose Traffic | Ensure that a route change exposing a private subnet or a change to the DNS servers used by resources is published to a monitored channel, so that traffic cannot be redirected or exposed unobserved. | Observability | 2 | 2 | 2 |
| CCC.VPC.CN08 | Restrict Outbound Internet Traffic | Ensure that resources can only reach explicitly allowed internet destinations, so that a compromised resource cannot exfiltrate data or reach command-and-control infrastructure. | Networking | 1 | 2 | 1 |
| CCC.VPC.CN09 | Filter and Log DNS Queries | Ensure that the built-in resolver refuses queries to blocked domains and records every query, so that DNS cannot be used as an unobserved exfiltration channel. | Networking | 1 | 2 | 2 |
| CCC.VPC.CN10 | Restrict Traffic Over Hybrid Connections | Ensure that private connections, VPNs, and transit hubs only carry explicitly allowed traffic, so that a compromise on one side cannot propagate to the other. | Networking | 1 | 2 | 1 |
| CCC.VPC.CN11 | Enforce Strong Encryption on Hybrid Connections | Ensure that traffic between the virtual network and on-premises networks cannot be read or modified in transit. | Encryption | 1 | 2 | 3 |
| CCC.VPC.CN12 | Restrict Traffic Mirroring Targets | Ensure that mirrored packet copies are only delivered to authorized monitoring destinations and that every mirroring session is visible. | Observability | 1 | 2 | 2 |
| CCC.VPC.CN13 | Deploy Network Resources Across Availability Zones | Ensure that the loss of a single availability zone does not remove connectivity for workloads in the virtual network. | Networking | 1 | 1 | 2 |