ASD ISM 1019 Develop a denial of service response plan
What it says
A denial of service response plan for video conferencing and IP telephony services is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate and maintain a plan to handle service disruptions for video calls and IP telephony.
Imagine you're having a team video call or trying to make a phone call over the internet, and suddenly, it's impossible because of a problem blocking the service. This control ensures that you have a plan to quickly and effectively handle such disruptions so your business can continue running smoothly and not lose valuable time or client trust.
Free. Save your status, tasks and notes.
Why it matters
Without a DoS response plan, attacks can disrupt video conferencing and IP telephony, preventing calls/meetings and delaying incident coordination.
How to implement
The IT manager should work with team leads to develop a response plan targeting video conferencing and IP telephony disruptions.
Start by identifying critical communication systems and brainstorming potential issues that could cause downtime, like internet outages or software glitches.
Schedule regular training sessions: The IT team should hold workshops for staff on how to recognise when a service issue might be happening and who to notify.
Use real-world scenarios to practise response steps, ensuring everyone knows their role in the plan.
Create a clear communication protocol: The IT manager needs to set up a notification system that updates all employees when downtime occurs.
This can be achieved by setting up group emails or a messaging platform to provide timely information and updates.
Assign specific roles: Assign team members to handle different tasks during a service outage, ensuring that everyone knows their specific responsibility.
Write down these roles and tasks in a document or shared online folder accessible to the team.
Conduct regular testing: IT staff should perform scheduled simulations to test the response plan's effectiveness.
This can include mock scenarios where services are deliberately disrupted, ensuring the team can respond quickly and make any necessary adjustments to the plan.
Keep it running
Exercise the DoS plan for VTC/SIP outages, including ISP/provider escalation, traffic filtering/rate-limits, failover routing, and comms to users.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The written summary of the denial of service response plan: Request the current document that details the procedures for dealing with video conferencing and IP telephony disruptions.
Look at
Whether it includes clear steps and responsibilities.
Good evidence
Shows clear, actionable steps for all involved parties and regularly updated contact details.
- Check 2 of 4What an auditor asks for
Ask for
To see training records: Request a log or documentation of training sessions conducted with staff on handling service disruptions.
Look at
Records showing recent and regular training sessions attended by all relevant employees. Good documentation includes the date, list of attendees, and topics covered.
Good evidence
Displays efficient use of communication tools to keep all staff informed.
- Check 3 of 4What an auditor asks for
Ask for
To view files or reports documenting the testing of the response plan. Inspect whether these reports detail the scenarios tested, results, and any improvements made.
Good evidence
Provides evidence of regular testing and a commitment to refining the response approach.
- Check 4 of 4What an auditor asks for
Look at
Clear assignments and backups for each responsibility.
Good evidence
Has detailed descriptions and names easily understood by reviewing parties.
Mappings
Closest match in ISO/IEC 27001: A.5.30, ICT readiness for business continuity, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control is broader than A.5.30.
ISM-1019 requires a documented and maintained DoS response plan for video conferencing and IP telephony services. Annex A 5.30 focuses on ICT readiness for business continuity, covering broader continuity scenarios including DoS. ISM-1019 is narrower as it targets specific services and threats.
This control partially meets A.5.24.
ISM-1019 requires a maintained DoS response plan for specific services to handle availability disruptions. Annex A 5.24 covers broader incident management processes, under which a DoS response plan would sit as a playbook. ISM-1019 is narrower as it is service- and threat-specific.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.




