Assessment Objective

Determine if:

• SC-05a. the effects of [Assignment: types of denial-of-service events] are [Selection: protect against; limit];
• SC-05b. [Assignment: controls by type of denial-of-service event] are employed to achieve the denial-of-service protection objective.

Assessment Methods

Examine

• System and communications protection policy
• procedures addressing denial-of-service protection
• system design documentation
• list of denial-of-service attacks requiring employment of security safeguards to protect against or limit effects of such attacks
• list of security safeguards protecting against or limiting the effects of denial-of-service attacks
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• organizational personnel with incident response responsibilities
• system developer

Test

• Mechanisms protecting against or limiting the effects of denial-of-service attacks

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final