Networking / VPC / Controls / v2026.11
Restrict Private Endpoints to Authorized Targets and Principals
CCC.VPC.CN05 · Networking
Ensure that private endpoints only reach resources inside the trust perimeter and only serve authorized principals, so that an endpoint cannot become a path for data exfiltration or unauthorized access.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.VPC.CP17 | Private Endpoints | The service can be configured with private endpoints that allow resources within the virtual network to reach other cloud services without traversing the public internet. |
Related Threats
| ID | Title | Description |
|---|
| CCC.VPC.TH05 | Private Endpoint Policies Permit Access by Unintended Principals | Private endpoint policies that are overly permissive may inadvertently expose resources within the VPC to unintended principals or external threats. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.VPC.CN05.AR01 | When a private endpoint is created, the service MUST restrict the endpoint to target resources owned by accounts inside the organization's trust perimeter. | tlp-green, tlp-amber, tlp-red |
| CCC.VPC.CN05.AR02 | When a request through a private endpoint originates from a principal outside the organization's trust perimeter, the service MUST deny the request. | tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| NIST_800_53 | AC-4 | |
| NIST_800_53 | SC-7 | |