ASD ISM 1431 Strategies for mitigating denial-of-service attacks
What it says
Denial-of-service attack mitigation strategies are discussed with cloud service providers, specifically: - their capacity to withstand denial-of-service attacks - costs likely to be incurred as a result of denial-of-service attacks - availability monitoring and thresholds for notification of denial-of-service attacks - thresholds for turning off any online services or functionality during denial-of-service attacks - pre-approved actions that can be undertaken during denial-of-service attacks - any arrangements with upstream service providers to block malicious network traffic as far upstream as possible.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDiscuss with cloud providers how to handle costs and actions for denial-of-service attacks to maintain service continuity.
A denial-of-service attack happens when someone floods your online systems with too much traffic, making them slow or unavailable to your customers. This control is about planning with your cloud provider to handle such attacks, so your business can keep running smoothly, avoid unexpected costs, and maintain customer trust.
Free. Save your status, tasks and notes.
Why it matters
Without agreed DoS capacity, alert thresholds and pre-approved actions with the cloud provider, attacks may cause prolonged outages, unexpected costs and reputational harm.
How to implement
Business owners should meet with their cloud provider to discuss service capacity: Set up a meeting with your provider to understand how much traffic your system can handle before it starts to slow down.
Make sure they can manage a sudden spike in usage without interruptions.
IT managers should establish cost estimates with the provider: Discuss potential financial impacts if a denial-of-service attack occurs.
Have the cloud provider give you a detailed report of expected costs and possible savings if prevention plans are in place.
Office managers should set up availability monitoring alerts: Work with your IT provider to set up tools that alert you when your service starts to slow down due to unusual activity, so you can respond quickly.
System administrators should agree on limits for shutting down services: Collaborate with your provider to establish specific conditions under which certain services would be temporarily turned off to protect the entire system, without affecting all operations.
Business owners should approve pre-planned defensive actions: Pre-approve actions with your provider that they can take during an attack, such as using upstream providers to block bad traffic at the earliest point possible.
Ensure these actions are documented and you are notified when they are used.
Keep it running
Agree with the cloud provider on DoS alert thresholds, service shutoff triggers, pre-approved response actions, and upstream traffic blocking; review these arrangements regularly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The service capacity agreement: Request the document outlining your cloud provider's capability to handle large volumes of traffic.
Look at
Specific numbers and thresholds related to your service.
Good evidence
Has clear metrics showing the provider's resilience against high traffic.
- Check 2 of 5What an auditor asks for
Ask for
Cost estimation reports: Request documentation of the expected costs associated with denial-of-service attacks. Review the details of cost structures and protective measures discussed.
Good evidence
Includes cost figures and agreed protective scenarios.
- Check 3 of 5What an auditor asks for
Ask for
Availability monitoring logs: Request the logs that show alerts and response times related to service slowdowns.
Look at
Timestamps and types of notifications received.
Good evidence
Includes timely alerts sent before full service disruption.
- Check 4 of 5What an auditor asks for
Ask for
The shut-off thresholds documentation: Request the criteria defining when services might be temporarily disabled. Check for clear definitions and conditions under which these rules are applied.
Good evidence
Includes specific thresholds and clear authorisation steps.
- Check 5 of 5What an auditor asks for
Ask for
The pre-approved actions list: Request the documented procedures and actions approved for use during attacks.
Look at
Any agreements with upstream providers to manage traffic.
Good evidence
Includes detailed steps that match what your cloud provider implements.
Mappings
Closest match in ISO/IEC 27001: A.5.30, ICT readiness for business continuity, which this control covers in full and more.
ISO/IEC 27001: 3 mappings
This control is broader than A.5.30.
Annex A 5.30 requires organisations to ensure ICT readiness for business continuity through planning, implementation, maintenance and testing against continuity requirements. ISM-1431 requires organisations to discuss DoS mitigation strategies with cloud service providers, directly contributing to service availability and continuity planning for cloud-hosted services. ISM-1431 is narrower and provider-engagement specific, whereas Annex A 5.30 addresses broader ICT continuity governance and testing beyond DoS and beyond cloud-provider arrangements.
This control partially overlaps A.8.6.
ISM-1431 requires discussions with cloud service providers about DoS resilience, including capacity to withstand attacks and thresholds to disable services during an attack. Annex A 8.6 requires resource use to be monitored and adjusted in line with capacity requirements, which supports planning and scaling to absorb traffic surges consistent with DoS resilience. ISM-1431 goes further into provider coordination, notification thresholds and upstream filtering arrangements, whereas Annex A 8.6 focuses on capacity management generally (not attack-specific).
This control partially overlaps A.8.16.
ISM-1431 requires organisations to agree denial-of-service (DoS) mitigation arrangements with cloud service providers, including monitoring, notification thresholds and pre-approved response actions. Annex A 8.16 requires monitoring networks, systems and applications for anomalous behaviour and taking action to evaluate potential incidents, which includes detecting DoS conditions and triggering response. ISM-1431 is specifically about contractual/operational coordination with cloud providers and upstream blocking, while Annex A 8.16 is a general internal monitoring requirement not specific to cloud or DoS.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.