Networking / VPC / Controls / v2026.11
Enforce Strong Encryption on Hybrid Connections
CCC.VPC.CN11 · Encryption
Ensure that traffic between the virtual network and on-premises networks cannot be read or modified in transit.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.VPC.CP10 | Connectivity Options - Private Connection | The service can be configured with a dedicated, private, high-speed connection between on-premises networks and the virtual network that does not traverse the public internet. |
| CCC.VPC.CP13 | Connectivity Options - Site-to-site VPN | The service can establish an encrypted site-to-site VPN connection over the public internet between the virtual network and an on-premises network. |
Related Threats
| ID | Title | Description |
|---|
| CCC.VPC.TH10 | Hybrid Connection Traffic is Unencrypted or Weakly Encrypted | Dedicated private connections may carry traffic without encryption, and VPN tunnels may be negotiated with deprecated protocol versions or weak key-exchange groups. Traffic traversing the connection can be read or modified by an entity with access to the transmission path, impacting the confidentiality and integrity of data. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.VPC.CN11.AR01 | When a site-to-site VPN tunnel is negotiated, the service MUST reject IKE version 1. | tlp-green, tlp-amber, tlp-red |
| CCC.VPC.CN11.AR02 | When a site-to-site VPN tunnel is negotiated, the service MUST reject Diffie-Hellman groups lower than group 14. | tlp-green, tlp-amber, tlp-red |
| CCC.VPC.CN11.AR03 | When traffic traverses a dedicated private connection, the service MUST encrypt it using MACsec or IPsec. | tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| NIST_800_53 | SC-8 | |
| NIST_800_53 | SC-13 | |