ASD ISM 1438Ensure High Availability by Using CDNs
Official control statement
Where a high availability requirement exists for website hosting, CDNs that cache websites are used.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Use CDNs to keep websites running smoothly and available when needed.
What this means in practice
This control is about using Content Delivery Networks (CDNs) to make sure your website stays available even during high traffic, such as a big sale or a school online enrolment period. If you don't use CDNs and your website can't handle the traffic, it could crash, leading to missed sales or frustrated parents who can't enrol their children, which can harm your business or institution's reputation and finances.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Proactive
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2021
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for networkingTopic
Using content delivery networks
Why it matters
Without a caching CDN, traffic spikes or upstream issues can cause website unavailability and degraded performance for users.
Operational notes
Review CDN caching rules and origin health, and monitor CDN hit rates/latency so capacity and caching can be tuned for peak demand.
Implementation tips
- The IT team should set up a CDN service for the company website. They can do this by researching and selecting a reputable CDN provider, setting up an account, and following the provider's instructions to integrate the CDN with the website. This often involves updating domain settings to route traffic through the CDN.
- System owners should work closely with their IT team to identify peak traffic periods. This involves looking at historical website traffic data to anticipate when high demand might occur and ensuring the CDN can handle the load during these times.
- The IT manager should ensure the CDN service is monitored. They can use the CDN provider's tools to track website performance and receive alerts for any issues, which allows for quick responses if the CDN experiences any problems.
- The procurement team should review and finalise contracts with the CDN provider. This includes ensuring the service agreement covers support for high traffic scenarios and checking that the price fits within the allocated IT budget.
- The IT support team must test the CDN setup before peak periods occur. They should simulate high traffic conditions to see how the website performs, allowing them to make any necessary adjustments to ensure smooth operation during real events.
Audit / evidence tips
- AskThe CDN service agreement: Request a copy of the service contract with the CDN providerLook atThe terms concerning traffic management and supportGoodShould include a service level agreement (SLA) that covers handling high traffic loads
- AskHistorical website traffic reports: Request the reports that have been used to identify peak periodsLook atPatterns in traffic spikes and how they were managed. Good evidence shows consistent monitoring and an understanding of website usage patterns
- AskCDN performance reports: These should highlight performance metrics during peak loadsLook atResponse times and availability during those periodsGoodWill show stable performance and quick resolution of any issues
- AskTo see invoices or receipts for the CDN service: Verify payments to the CDN providerLook atRegular payments that match the service agreementGoodWill show up-to-date payment statuses and contract compliance
- AskA record of all communications with the CDN provider: This includes emails or logs of chats discussing performance and supportLook atInstances where issues were quickly addressedGoodDemonstrates a proactive relationship with the provider, with documented responses to any problems
Cross-framework mappings
How ISM-1438 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 5.30 | ISM-1438 requires organisations with a high availability requirement for website hosting to use CDNs that cache websites to improve resil... | |
| Annex A 8.14 | Annex A 8.14 requires information processing facilities to be implemented with redundancy sufficient to meet availability requirements | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Networking
See all Guidelines for networking controls, or browse the full ASD ISM library.