GRC Store

Search / finos-ccc/ccc.lb.cn / v2026.06-rc5

Release · v2026.06-rc5

FINOS-CCC/CCC.LB.CN Control Catalog

FINOS-CCC/CCC.LB.CN

Controls for Load Balancer Capabilities technologies, as defined by the FINOS Common Cloud Controls project.

Published by FINOS Common Cloud Controls

Install

OCI v1.1
$grcli unpack --repository finos-ccc/ccc.lb.cn --tag v2026.06-rc5
Coordinate
oci.grc.store/finos-ccc/ccc.lb.cn:v2026.06-rc5
Manifest digest
sha256:576e2fd1d5893076c576f38681a74f1aa2132cadaa858d03601f383dfa7dd405

Provenance

1 layer
Digest Media type Size
110235a45434… application/vnd.gemara.artifact.v1+yaml 13.1 KiB
Bundle config blob 
{
  "bundle-version": "1.0",
  "gemara-version": "v1.2.0",
  "metadata": {
    "provenance": {
      "buildDefinition": {
        "buildType": "https://grc.store/grcli/buildtype/v0",
        "externalParameters": {
          "artifact": {
            "id": "CCC.LB.CN",
            "type": "ControlCatalog"
          },
          "target": {
            "registry": "oci.grc.store",
            "repository": "finos-ccc/ccc.lb.cn",
            "tag": "v2026.06-rc5"
          }
        },
        "internalParameters": {
          "CI": "true",
          "GITHUB_ACTIONS": "true",
          "GITHUB_ACTOR": "eddie-knight",
          "GITHUB_REF": "refs/heads/main",
          "GITHUB_REPOSITORY": "eddie-knight/common-cloud-controls",
          "GITHUB_RUN_ATTEMPT": "1",
          "GITHUB_RUN_ID": "26771723499",
          "GITHUB_SHA": "a9503345caf59a144d8ab9b4bede212b393ca56a",
          "GITHUB_WORKFLOW": "Batch Release All Catalogs",
          "RUNNER_OS": "Linux"
        },
        "resolvedDependencies": [
          {
            "name": "artifacts/networking/loadbalancer/controls.yaml",
            "uri": "file://artifacts/networking/loadbalancer/controls.yaml",
            "digest": {
              "sha256": "110235a4543485139d7e13f37ca1adc12c02150e1bb9a1ec739540fcb290cc46"
            }
          },
          {
            "name": "source",
            "uri": "git+https://github.com/eddie-knight/common-cloud-controls@a9503345caf59a144d8ab9b4bede212b393ca56a",
            "digest": {
              "gitCommit": "a9503345caf59a144d8ab9b4bede212b393ca56a"
            }
          }
        ]
      },
      "runDetails": {
        "builder": {
          "id": "https://github.com/eddie-knight/common-cloud-controls/actions/runs/26771723499",
          "version": {
            "go": "go1.25.0",
            "go-arch": "amd64",
            "go-os": "linux",
            "grcli": "v0.2.2"
          }
        },
        "metadata": {
          "invocationId": "26771723499-1",
          "startedOn": "2026-06-01T17:48:39.016966097Z",
          "finishedOn": "2026-06-01T17:48:39.105051839Z"
        },
        "byproducts": [
          {
            "name": "controls.yaml",
            "digest": {
              "sha256": "110235a4543485139d7e13f37ca1adc12c02150e1bb9a1ec739540fcb290cc46"
            }
          }
        ]
      }
    }
  },
  "artifacts": [
    {
      "name": "controls.yaml",
      "type": "ControlCatalog",
      "id": "CCC.LB.CN",
      "role": "artifact"
    }
  ]
}

CCC Load Balancer Capabilities Controls

Controls for Load Balancer Capabilities technologies, as defined by the FINOS Common Cloud Controls project.

ID
CCC.LB.CN
Version
v2026.06-rc5
Gemara version
v1.2.0
Author
FINOS Common Cloud Controls

Networking

The Networking group covers entries related to network infrastructure, connectivity, and traffic management. This includes virtual networks, subnets, load balancing, DNS, routing, peering, and network-level access controls.

  1. CCC.LB.CN01 Enforce and Detect Rate Limiting

    Objective

    Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.

    Assessment requirements

    1. When a single client sends more than 2000 requests within any 5-minute sliding window, the load balancer MUST throttle all subsequent requests from that client for at least 60 seconds.

      Applicability: tlp-green, tlp-amber, tlp-red

    2. When throttling is invoked, the load balancer MUST record the event in the access log within 5 minutes for alerting and trend analysis.

      Applicability: tlp-green, tlp-amber, tlp-red

    Guidelines
    • NIST-CSF
      • DE.CM-1 — Monitor to detect events
      • PR.AC-7 — Prevent brute-force
      • PR.PT-4 — Protective technology
    • NIST_800_53
      • AU-6 — Audit review, analysis, reporting
      • SC-5 — Denial-of-Service protection
      • AC-7 — Unsuccessful logon attempts
    Threats
    • CCC.LB.Threats
      • CCC.LB.TH01 — Malicious Traffic
      • CCC.LB.TH09 — Resource Exhaustion

  2. CCC.LB.CN05 Validate Session Affinity

    Objective

    Configure session persistence to minimise fixation and hijacking risks.

    Assessment requirements

    1. When stickiness is enabled, session cookies MUST expire within 30 minutes of inactivity.

      Applicability: tlp-green, tlp-amber, tlp-red

    Guidelines
    • NIST-CSF
      • PR.AC-7 — Least functionality is enforced
    • NIST_800_53
      • SC-23 — Session authenticity
    Threats
    • CCC.LB.Threats
      • CCC.LB.TH04 — Session Persistence Exploited

  3. CCC.LB.CN07 Scrub Sensitive Headers

    Objective

    Remove headers that disclose internal details or software versions from HTTP responses.

    Assessment requirements

    1. When responses pass through the load balancer, the "Server" header MUST be replaced with "lb".

      Applicability: tlp-green, tlp-amber, tlp-red

    Guidelines
    • NIST-CSF
      • PR.DS-2 — Data in transit is protected
    • NIST_800_53
      • SC-13 — Cryptographic protection
    Threats
    • CCC.Core.Threats
      • CCC.Core.TH15 — Automated Enumeration and Reconnaissance by Non-human

Observability

The Observability group covers entries related to logging, monitoring, metrics, alerting, and event publication. This includes audit trail integrity, enumeration detection, and protection against tampering or unauthorized access to operational telemetry.

  1. CCC.LB.CN06 Secure Health-Check Telemetry

    Objective

    Monitor health-check endpoints for tampering and alert on abnormal status changes.

    Assessment requirements

    1. When more than 10 percent of targets change from healthy to unhealthy within five minutes, an alert MUST be issued.

      Applicability: tlp-green, tlp-amber, tlp-red

    Guidelines
    • NIST-CSF
      • DE.AE-2 — Detected events are analyzed
    • NIST_800_53
      • SI-4 — System monitoring
    Threats
    • CCC.LB.Threats
      • CCC.LB.TH05 — Health Checks Exploited

Access Control

The Access Control group covers entries related to authentication, authorization, and trust perimeter enforcement. This includes multi-factor authentication, least privilege access, network access rules, and prevention of unauthorized access or reconnaissance.

  1. CCC.LB.CN04 Enforce Distribution Policies

    Objective

    Ensure traffic-splitting weights and algorithms are modified only by trusted identities.

    Assessment requirements

    1. When routing weights change, the request MUST originate from an explicitly defined and trusted identity and MUST be logged.

      Applicability: tlp-green, tlp-amber, tlp-red

    Guidelines
    • NIST-CSF
      • PR.AC-1 — Identities and credentials are managed
    • NIST_800_53
      • AC-3 — Access enforcement
    Threats
    • CCC.LB.Threats
      • CCC.LB.TH03 — Traffic Distribution Manipulated

  2. CCC.LB.CN09 Restrict Management API Access

    Objective

    Limit load-balancer API calls to authorised identities and trusted networks.

    Assessment requirements

    1. When an API call originates outside the approved CIDR set, the request MUST be denied.

      Applicability: tlp-green, tlp-amber, tlp-red

    Guidelines
    • NIST-CSF
      • PR.AC-5 — Network integrity is protected
    • NIST_800_53
      • SC-7 — Boundary protection
    Threats
    • CCC.LB.Threats
      • CCC.LB.TH08 — API Exposed and Attacked

Resource Management

The Resource Management group covers entries related to the lifecycle, configuration, and operational integrity of cloud resources. This includes resource exhaustion, tag manipulation, version rollback, scaling, and cost management.

  1. CCC.LB.CN02 Auto-Scale Load Balancer Capacity

    Objective

    Expand load-balancer capacity to maintain availability during traffic spikes.

    Assessment requirements

    1. When concurrent connections reach 80 percent of capacity, the autoscaling group MUST add at least one instance within five minutes.

      Applicability: tlp-green, tlp-amber, tlp-red

    Guidelines
    • NIST-CSF
      • ID.BE-5 — Resilience requirements are established
    • NIST_800_53
      • CP-10 — System recovery and reconstitution
    Threats
    • CCC.LB.Threats
      • CCC.LB.TH09 — Resource Exhaustion

Encryption

The Encryption group covers entries related to protecting data confidentiality and integrity through cryptographic mechanisms. This includes encryption in transit and at rest, key management, and certificate lifecycle management.

  1. CCC.LB.CN08 Automate Certificate Renewal

    Objective

    Maintain valid TLS certificates by automating renewal and deployment before expiry.

    Assessment requirements

    1. When a certificate is within 30 days of expiry, automated renewal MUST complete and deploy a new certificate within 24 hours.

      Applicability: tlp-green, tlp-amber, tlp-red

    Guidelines
    • NIST-CSF
      • PR.DS-6 — Integrity checking mechanisms are used
    • NIST_800_53
      • SC-17 — PKI certificates
    Threats
    • CCC.LB.Threats
      • CCC.LB.TH07 — Certificates Expired or Invalid