What must the monitoring scope cover in addition to the deployed assets?

The data plane handles forwarding of actual network traffic and is inherently covered when monitoring deployed assets, so it does not represent an additional scope gap.

The application plane refers to workloads running within the cloud environment, which falls under the category of deployed assets already being monitored.

The service plane is not a standard term in cloud monitoring scope frameworks and does not identify a distinct monitoring domain beyond deployed assets.

The access plane is not a recognized monitoring scope category in standard cloud security frameworks and does not represent a distinct additional monitoring requirement.

The management plane encompasses the administrative interfaces, APIs, and control mechanisms used to provision and configure cloud resources. Because an attacker who compromises the management plane can alter or destroy all deployed assets, monitoring must explicitly cover this plane in addition to the workloads themselves. Omitting management plane visibility creates a critical blind spot for detecting unauthorized administrative activity such as privilege escalation or resource deletion.