SC-5 Denial-of-service protection
Requires the effects of organization-defined denial of service event types to be protected against or limited, and requires organization-defined controls to be employed to achieve that objective for each event type.
4
artefacts
2
held by a system
1
at each review
easy
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration of the protective controls such as rate limiting, filtering or upstream scrubbing · Cloud console / configuration management
- Test or incident records showing the protection performing under load · Document repository
periodic reviewEvidence produced at each review
- Capacity and resilience evidence for the protected services · Cloud console / configuration management
governing documentDocuments that govern the control
- Documented denial of service event types considered in scope · Policy repository / GRC workspace
First move
Automate the pull from your Cloud console / configuration management. Configuration snapshots and change history from the cloud console or IaC repository, diffed against the baseline.
Common gaps auditors find
- Protection procured for volumetric attacks only, leaving application layer attacks untreated
- Controls in place upstream but the origin remains directly reachable
- Event types never defined, so nothing determines whether protection is adequate
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-4 Information in shared system resources · SC-6 Resource Availability. Protect the availability of resources by allocating [organization-defined] by [organization-defined]