ASD ISM 1805 Develop a denial of service response plan
What it says
A denial of service response plan for video conferencing and IP telephony services contains the following: - how to identify signs of a denial-of-service attack - how to identify the source of a denial-of-service attack - how capabilities can be maintained during a denial-of-service attack - what actions can be taken to respond to a denial-of-service attack.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate a plan to detect, maintain, and respond to service disruptions in video and telephony systems.
A Denial of Service (DoS) response plan is like having a backup plan for when your video calls and internet phone services get disrupted by a cyber-attack. It's important because without it, your business could suffer downtime, making it hard to communicate with clients or run operations smoothly.
Free. Save your status, tasks and notes.
Why it matters
Without a DoS response plan, video conferencing and IP telephony outages may last longer, disrupting calls and business continuity.
How to implement
Business managers should organise a workshop with IT staff to identify signs that could indicate a DoS attack, such as unusual slowness in making calls or interruptions in video conferencing.
Note these signs in an easy-to-read guide for quick staff reference.
IT teams should establish clear procedures to trace potential sources of these disruptions.
This could involve using tools to monitor network traffic and identify unexpected influxes of data from unknown locations.
System administrators should work on ensuring that essential services like video and telephony can be maintained, even in the event of a DoS attack.
This may involve setting up backup servers or having secondary communication platforms ready.
IT staff should draft actionable steps that staff can follow when a DoS attack is detected.
This should include instructions for reporting the incident and contacting any external support services needed.
The Human Resources team should train employees on what a DoS attack is and encourage them to report any service disruptions quickly.
Provide examples of what to look for and how to report issues efficiently.
Keep it running
Regularly exercise and update the DoS response plan, including indicators, source tracing steps, service continuity measures, and response actions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The documented DoS response plan: Request to see the plan that outlines steps for detecting and handling DoS attacks on video and telephony services.
Look at
Clear processes and assigned responsibilities.
Good evidence
The plan includes detailed detection methods, action steps, and contact information for critical team members.
- Check 2 of 5What an auditor asks for
Ask for
To see logs of past disruptions: Request records of any service disruptions over the past year.
Look at
Patterns or indications that potential DoS attacks were considered.
Good evidence
Logs reflect a consistent reporting and action-taking approach, with all incidents assessed for potential DoS involvement.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of resource allocation for maintaining services: Request to see how the organisation ensures continuous service during attacks.
Look at
Backup systems or alternative services mentioned in records.
Good evidence
The organisation can demonstrate functional backup solutions that were tested and operational.
- Check 4 of 5What an auditor asks for
Ask for
Training records for staff on DoS awareness: Request training material or attendance lists.
Look at
A structured training program and employee understanding of procedures.
Good evidence
Evidence of regular training including all relevant staff, with materials explaining DoS response clearly.
- Check 5 of 5What an auditor asks for
Ask for
Records of simulations or tests of the DoS response plan: Request documentation of any drills carried out.
Look at
Results and improvements made following test outcomes.
Good evidence
Simulation results show realistic scenarios were tested, with outcomes analysed and the plan updated based on findings.
Mappings
Closest match in ISO/IEC 27001: A.5.30, ICT readiness for business continuity, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.30.
ISM-1805 requires organisations to plan for DoS scenarios affecting video conferencing and IP telephony, including maintaining service capabilities during an attack and defining response actions. Annex A 5.30 focuses on ICT readiness for business continuity, requiring planning, implementation, maintenance and testing of ICT continuity aligned to business continuity objectives. ISM-1805 is a specific continuity/response plan for one disruption type and service set, while Annex A 5.30 is broader across ICT services and disruption scenarios.
ASD Essential Eight: 1 mapping
- E8-MF-ML2.12Cyber security incident response plan enacted after incident identificationPartially meets
This control partially meets E8-MF-ML2.12.
ISM-1805 requires a denial-of-service (DoS) response plan specifically for video conferencing and IP telephony, including identification, source tracing, maintaining capability, and response actions. E8-MF-ML2.12 requires that an incident response plan is enacted once a cybersecurity incident is identified, which would include enacting the DoS response plan when a DoS is confirmed. E8-MF-ML2.12 is broader on incident type but narrower on the DoS-specific planning detail that ISM-1805 mandates.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.