Networking / VPC / Controls / v2026.11
Prevent Default Exposure of Resources to the Internet
CCC.VPC.CN02 · Networking
Ensure that resources in the virtual network are not reachable from the public internet unless explicitly configured, to minimize attack surfaces.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.VPC.CP03 | IPv6 CIDR Block | The service can be configured with an IPv6 CIDR block in addition to IPv4 so that resources in the virtual network are addressable over IPv6. |
| CCC.VPC.CP08 | Connectivity Options - Internet Gateway | The service can route traffic between resources in the virtual network and the public internet through an internet gateway, enabling direct internet access for those resources. |
Related Threats
| ID | Title | Description |
|---|
| CCC.VPC.TH02 | Resources are Exposed to the Public Internet | Assignment of external IP addresses to resources, including globally routable IPv6 addresses, exposes resources to the public internet, increasing the risk of attacks such as brute force, exploitation of vulnerabilities, or unauthorized access. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.VPC.CN02.AR01 | When a resource is created in the virtual network, that resource MUST NOT be assigned an external IP address by default. | tlp-red |
| CCC.VPC.CN02.AR02 | When a resource in the virtual network holds an external IPv4 or IPv6 address, the service MUST deny inbound traffic from the public internet unless a network access rule explicitly allows it. | tlp-green, tlp-amber, tlp-red |