Skip to content
Communications systems
ASD ISMISM-1019

ASD ISM 1019 Develop a denial of service response plan

What it says

A denial of service response plan for video conferencing and IP telephony services is developed, implemented and maintained.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Create and maintain a plan to handle service disruptions for video calls and IP telephony.

Imagine you're having a team video call or trying to make a phone call over the internet, and suddenly, it's impossible because of a problem blocking the service. This control ensures that you have a plan to quickly and effectively handle such disruptions so your business can continue running smoothly and not lose valuable time or client trust.

Why it matters

Without a DoS response plan, attacks can disrupt video conferencing and IP telephony, preventing calls/meetings and delaying incident coordination.

How to implement

  1. The IT manager should work with team leads to develop a response plan targeting video conferencing and IP telephony disruptions.

    Start by identifying critical communication systems and brainstorming potential issues that could cause downtime, like internet outages or software glitches.

  2. Schedule regular training sessions: The IT team should hold workshops for staff on how to recognise when a service issue might be happening and who to notify.

    Use real-world scenarios to practise response steps, ensuring everyone knows their role in the plan.

  3. Create a clear communication protocol: The IT manager needs to set up a notification system that updates all employees when downtime occurs.

    This can be achieved by setting up group emails or a messaging platform to provide timely information and updates.

  4. Assign specific roles: Assign team members to handle different tasks during a service outage, ensuring that everyone knows their specific responsibility.

    Write down these roles and tasks in a document or shared online folder accessible to the team.

  5. Conduct regular testing: IT staff should perform scheduled simulations to test the response plan's effectiveness.

    This can include mock scenarios where services are deliberately disrupted, ensuring the team can respond quickly and make any necessary adjustments to the plan.

Keep it running

Exercise the DoS plan for VTC/SIP outages, including ISP/provider escalation, traffic filtering/rate-limits, failover routing, and comms to users.

Evidence and audit

  1. Check 1 of 4What an auditor asks for

    Ask for

    The written summary of the denial of service response plan: Request the current document that details the procedures for dealing with video conferencing and IP telephony disruptions.

    Look at

    Whether it includes clear steps and responsibilities.

    Good evidence

    Shows clear, actionable steps for all involved parties and regularly updated contact details.

  2. Check 2 of 4What an auditor asks for

    Ask for

    To see training records: Request a log or documentation of training sessions conducted with staff on handling service disruptions.

    Look at

    Records showing recent and regular training sessions attended by all relevant employees. Good documentation includes the date, list of attendees, and topics covered.

    Good evidence

    Displays efficient use of communication tools to keep all staff informed.

  3. Check 3 of 4What an auditor asks for

    Ask for

    To view files or reports documenting the testing of the response plan. Inspect whether these reports detail the scenarios tested, results, and any improvements made.

    Good evidence

    Provides evidence of regular testing and a commitment to refining the response approach.

  4. Check 4 of 4What an auditor asks for

    Look at

    Clear assignments and backups for each responsibility.

    Good evidence

    Has detailed descriptions and names easily understood by reviewing parties.

Mappings

Closest match in ISO/IEC 27001: A.5.30, ICT readiness for business continuity, which this control covers in full and more.

ISO 27001

ISO/IEC 27001: 2 mappings

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.