Skip to content
Networking
ASD ISMISM-1438

ASD ISM 1438 Ensure high availability by using CDNs

What it says

Where a high availability requirement exists for website hosting, CDNs that cache websites are used.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Use CDNs to keep websites running smoothly and available when needed.

This control is about using Content Delivery Networks (CDNs) to make sure your website stays available even during high traffic, such as a big sale or a school online enrolment period. If you don't use CDNs and your website can't handle the traffic, it could crash, leading to missed sales or frustrated parents who can't enrol their children, which can harm your business or institution's reputation and finances.

Why it matters

Without a caching CDN, traffic spikes or upstream issues can cause website unavailability and degraded performance for users.

How to implement

  1. The IT team should set up a CDN service for the company website.

    They can do this by researching and selecting a reputable CDN provider, setting up an account, and following the provider's instructions to integrate the CDN with the website. This often involves updating domain settings to route traffic through the CDN.

  2. System owners should work closely with their IT team to identify peak traffic periods.

    This involves looking at historical website traffic data to anticipate when high demand might occur and ensuring the CDN can handle the load during these times.

  3. The IT manager should ensure the CDN service is monitored.

    They can use the CDN provider's tools to track website performance and receive alerts for any issues, which allows for quick responses if the CDN experiences any problems.

  4. The procurement team should review and finalise contracts with the CDN provider.

    This includes ensuring the service agreement covers support for high traffic scenarios and checking that the price fits within the allocated IT budget.

  5. The IT support team must test the CDN setup before peak periods occur.

    They should simulate high traffic conditions to see how the website performs, allowing them to make any necessary adjustments to ensure smooth operation during real events.

Keep it running

Review CDN caching rules and origin health, and monitor CDN hit rates/latency so capacity and caching can be tuned for peak demand.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The CDN service agreement: Request a copy of the service contract with the CDN provider.

    Look at

    The terms concerning traffic management and support.

    Good evidence

    Should include a service level agreement (SLA) that covers handling high traffic loads.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Historical website traffic reports: Request the reports that have been used to identify peak periods.

    Look at

    Patterns in traffic spikes and how they were managed. Good evidence shows consistent monitoring and an understanding of website usage patterns.

  3. Check 3 of 5What an auditor asks for

    Ask for

    CDN performance reports: These should highlight performance metrics during peak loads.

    Look at

    Response times and availability during those periods.

    Good evidence

    Will show stable performance and quick resolution of any issues.

  4. Check 4 of 5What an auditor asks for

    Ask for

    To see invoices or receipts for the CDN service: Verify payments to the CDN provider.

    Look at

    Regular payments that match the service agreement.

    Good evidence

    Will show up-to-date payment statuses and contract compliance.

  5. Check 5 of 5What an auditor asks for

    Ask for

    A record of all communications with the CDN provider: This includes emails or logs of chats discussing performance and support.

    Look at

    Instances where issues were quickly addressed.

    Good evidence

    Demonstrates a proactive relationship with the provider, with documented responses to any problems.

Mappings

Closest match in ISO/IEC 27001: A.5.30, ICT readiness for business continuity, which this control partially meets.

ISO 27001

ISO/IEC 27001: 2 mappings

  • A.5.30ICT readiness for business continuityPartially meets
  • A.8.14Redundancy of information processing facilitiesPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.