Setting Cache-Control in IIS

Question

I am trying to set Cache-Control to no-cache, no-store, must-revalidate, private in the HTTP Response Headers section in IIS Manager (v7.5). If I add a new custom HTTP Response Header and paste above string in there, I am getting the following output inspecting the website:

Cache-Control: private, no-cache, no-store, must-revalidate, private

How come the private value is set twice? I guess it is set somewhere within ISS already, since it shows Cache-Control: private even if I remove my custom HTTP Request Header.

This leaves me with the following two questions:

1. What is the right way of setting the HTTP Response Header Cache-Control: no-cache, no-store, must-revalidate, private site-wide?
2. What would be the caveat of having set Cache-Control: no-cache, no-store, must-revalidate, private site-wide?

I found a good summary on the topic already but nothing specific to setting the HTTP Response Header for Cache-Control site-wide within IIS.

I am running a classic asp application. Could it be that the second private attribute is set there? Any starting point where I could look?

Thank you very much for you help :-)