| CCC.LB.CN05 | Validate Session Affinity | Configure session persistence to minimise fixation and hijacking risks. | Networking | 1 | 2 | 1 |
| CCC.LB.CN07 | Scrub Sensitive Headers | Remove headers that disclose internal details or software versions from HTTP responses. | Networking | 2 | 2 | 1 |
| CCC.LB.CN10 | Protect Health-Check Endpoints | Ensure that health-check results cannot be influenced by entities other than the load balancer, so that healthy targets are not removed from service. | Networking | 1 | 0 | 2 |
| CCC.LB.CN11 | Attach a Web Application Firewall to Internet-Facing Listeners | Ensure that application-layer traffic from the internet is inspected and filtered before it reaches backend targets. | Networking | 2 | 0 | 2 |
| CCC.LB.CN12 | Encrypt Traffic to Backend Targets | Ensure that requests remain encrypted between the load balancer and its backend targets after TLS termination. | Encryption | 1 | 0 | 1 |
| CCC.LB.CN13 | Validate Client Certificates | Ensure that mutual TLS on a listener rejects clients that do not present a valid certificate from a trusted authority. | Access | 1 | 0 | 2 |
| CCC.LB.CN14 | Prevent Forwarded-Header Spoofing | Ensure that backend targets receive a trustworthy client source address. | Access | 1 | 0 | 1 |
| CCC.LB.CN15 | Apply Source Restrictions to Every Address Family | Ensure that access restrictions on a dual-stack frontend apply to IPv6 clients as well as IPv4 clients. | Access | 1 | 0 | 1 |
| CCC.LB.CN16 | Restrict Redirect Destinations | Ensure that redirect rules cannot send users to hosts outside the organization's control. | Networking | 1 | 0 | 1 |
| CCC.LB.CN17 | Enforce Minimum TLS Policy | Ensure that listeners negotiate only approved cipher suites with clients. | Encryption | 2 | 0 | 1 |
| CCC.LB.CN18 | Automate Listener Certificate Renewal | Ensure that certificates attached to listeners are renewed before expiry without manual intervention. | Encryption | 1 | 0 | 2 |
| CCC.LB.CN19 | Alert on Traffic Distribution Changes | Ensure that changes to how traffic is distributed across targets are published so that they cannot occur unobserved. | Observability | 1 | 0 | 1 |