Free tool · no signup · about 5 minutes
DDoS Readiness Scorecard
Answer 24 questions across 8 areas to see how ready you are for a DDoS attack. You get a score per area, the gaps to fix first and a report to share.
Upstream and scrubbing
ISP and cloud DDoS protection contracts.
We know which DoS mitigations our ISP can enable on our account, and how to ask for them at any hour.
The NCSC advises understanding the mitigations your ISP can enable, because some traffic can only be stopped upstream.
Our internet-facing services are covered by a DDoS mitigation (scrubbing) service, from a provider, our cloud platform or our CDN.
CISA recommends considering a DDoS mitigation provider that can filter malicious traffic before it reaches your network.
We know when a provider might limit or block our traffic to protect its other customers, and what that would mean for us.
The NCSC notes that providers may limit your network access to protect other customers; that can take you offline as surely as the attack.
CDN, WAF and rate limiting
Filtering in front of your web services.
Our public websites and web APIs are served through a content delivery network (CDN).
Both the NCSC and CISA point to CDNs, which spread and absorb traffic across many locations.
A web application firewall (WAF) and request rate limits protect login, search, checkout and other expensive endpoints.
CISA recommends firewall filtering and rate limits; application-layer attacks aim at the pages that cost the most to serve.
We can switch on a bot challenge (such as a CAPTCHA) for a page or path within minutes.
CISA lists CAPTCHA challenges as a way to separate people from automated bots.
Architecture
Hidden origins, scaling, redundancy, anycast.
Our origin servers accept web traffic only from our CDN or scrubbing provider, and their addresses are not published.
If attackers can reach the origin directly, they can go around the protection in front of it.
Key services can scale quickly (autoscaling or spare capacity) across compute, network and storage.
The NCSC advises building services to scale rapidly for attacks that cannot be handled upstream.
Critical services are load-balanced across several servers or sites, with tested failover and no single point of failure.
CISA recommends load balancing, redundancy and failover so traffic can be moved to alternative resources.
Our public services and DNS are delivered over an anycast network, so traffic is spread across many locations.
Anycast lets one address be served from many sites, which spreads load instead of concentrating it.
DNS resilience
Keeping your names answering.
Our authoritative DNS is hosted by a provider built to withstand DDoS, or by more than one provider.
CISA notes that DNS servers can be targets too; if DNS stops answering, every service behind it disappears.
We can change DNS records quickly during an incident: registrar and DNS accounts are protected with MFA, we know our TTLs, and at least two people have access.
Rerouting traffic to a scrubbing service often needs a DNS change, and a locked-out account turns minutes into hours.
Monitoring and alerting
Baselines and alerts that reach a person.
We have a baseline of normal traffic, request rates and resource use for our key services.
CISA advises analysing traffic regularly to establish a baseline, so deviations stand out during an attack.
Alerts fire on unusual traffic, error rates or resource use, and reach a person who can act at any hour.
CISA lists unavailability, congestion, unusual traffic and high resource use as signs of an attack; they only help if someone sees them.
Runbook and contacts
Who does what, and who to call.
We have a written DDoS response plan with roles, decision rights and the steps to activate provider protection.
CISA says the plan should include roles and responsibilities, communication channels and predefined mitigation strategies.
We keep current 24/7 contacts and account numbers for our ISP, hosting, CDN or scrubbing and DNS providers.
CISA’s first response steps include notifying ISPs and hosting providers, who may be able to reroute or filter traffic.
We can keep administrative access to our systems during an attack, through a path that does not share the attacked links.
The NCSC recommends planning to retain administrative access during an attack.
We know which features we would switch off, and have a fallback for essential services, so we can run in a degraded mode.
The NCSC advises designing services to keep operating, albeit degraded, with a fallback plan for essential services.
The plan says what evidence to keep during an attack: timestamps, source addresses, logs and alerts.
CISA advises gathering evidence for law enforcement reports and later analysis.
Communications plan
Staff, customers, partners, authorities.
We have a communication plan for staff, customers and third parties, with pre-approved first messages and a status page hosted away from our main infrastructure.
CISA recommends a communication plan for internal teams, customers and third-party providers to manage expectations during an attack.
We know who decides on reporting to authorities, and where to report.
CISA and the FBI urge prompt reporting of DDoS incidents (a local FBI Field Office, or CISA at report@cisa.gov); UK organisations can report to the NCSC.
Testing and tabletop
Knowing, not assuming, you are ready.
We have run a DDoS tabletop exercise in the last 12 months with IT, security, communications and the business.
CISA publishes tabletop exercise packages; a discussion exercise finds gaps in the plan without touching production.
Our defences have been validated with our providers’ agreement, so we know which kinds and sizes of attack we can withstand.
The NCSC says thinking you are prepared is not the same as knowing, and advises testing your defences.
After any attack, outage or exercise, we review what happened and update the plan.
CISA’s recovery steps include a post-incident analysis and updating the incident response plan.
The three kinds of DDoS attack, in plain words
A denial-of-service attack tries to make a service unavailable to the people who should be able to use it. When it comes from many machines at once, often a botnet of compromised computers, it is a distributed denial-of-service (DDoS) attack. CISA, the FBI and MS-ISAC sort the techniques into three types:
Volumetric
Floods the target with so much traffic that the network link or the servers run out of capacity, so real requests cannot get through. Example: a reflection attack, where requests sent to many legitimate public servers bounce their replies onto the victim; CISA notes this traffic comes from real servers, not the attacker.
Protocol
Abuses the way network protocols work, at layers 3 and 4, to tie up firewalls, load balancers or servers. Example: a SYN flood, which, in CISA’s words, opens connection requests without finishing the handshake until legitimate users cannot connect.
Application layer
Targets a specific application at layer 7 and uses up its processing power rather than the network. Example: a high volume of requests aimed at one expensive page or URL, such as search or login, which CISA lists as a sign of an attack.
CISA notes the categories are not mutually exclusive: attackers combine them. The UK NCSC says it is not possible to fully remove the risk, but preparing lessens the impact: understand your service, understand your defences, create a response plan and test your response.
How the score works
- Yes = 1, Partly = 0.5, No or not answered = 0. Each question has a weight from 1 to 3.
- Area and overall scores are the weighted average out of 100.
- Bands: 80 and above well prepared, 60 to 79 partly prepared, 40 to 59 exposed, below 40 unprepared.
- Gaps are ranked by weight × what is missing, so a No on a weight-3 control comes first.
The weights are PlayCISO’s own rubric, not an industry benchmark. The questions are about readiness and controls only; any testing should be arranged in writing with your providers.
Questions
How do I prepare for a DDoS attack?
Know how your service can be overloaded, agree DDoS protection with your ISP or a mitigation provider, put web services behind a CDN with rate limits, make key services able to scale, set a traffic baseline with alerts, write a response plan with provider contacts, and test it in a tabletop exercise. These steps follow CISA’s joint guide and the UK NCSC’s denial of service guidance.
What are the three types of DDoS attacks?
CISA groups them as volume-based attacks, which flood the target with traffic to use up bandwidth or resources; protocol-based attacks, which abuse weaknesses in network protocols at layers 3 and 4; and application layer attacks, which target a specific application at layer 7 and use up its processing power. Attackers can combine all three.
What is the difference between DoS and DDoS?
A denial-of-service (DoS) attack comes from a single source or a few machines. A distributed denial-of-service (DDoS) attack comes from many sources at once, often a botnet of compromised computers, which makes it larger and harder to block.
What should we do during a DDoS attack?
CISA’s steps are to confirm the attack with monitoring, activate your incident response plan, notify your ISP and hosting providers, gather evidence, filter traffic and turn on DDoS mitigation services, use a CDN, and keep staff, customers and partners updated. Afterwards, review what happened and update the plan.
Who do I report a DDoS attack to?
In the US, CISA and the FBI ask organisations to report DDoS incidents to a local FBI Field Office or to CISA at report@cisa.gov; state, local, tribal and territorial governments can also report to the MS-ISAC. In the UK, report significant incidents to the NCSC.
How is the score calculated?
Each of the 24 questions has a weight from 1 to 3. Yes scores 1, Partly 0.5 and No or unanswered 0. Area and overall scores are the weighted average out of 100, and gaps are ranked by weight times what is missing. It is PlayCISO’s own rubric, not an industry benchmark.
Keep going
- IR Playbook Lab: practise putting an incident response in the right order.
- Incident Holding Statements: first messages for customers, staff and media during an outage.
- Denial of Service Attack Examples lab: name the attack from the evidence.
- Types of DDoS attacks and how to prepare: the guide behind this scorecard.
Sources
- CISA, FBI and MS-ISAC, Understanding and Responding to Distributed Denial-of-Service Attacks (version 2.0, March 21, 2024).
- UK National Cyber Security Centre, Denial of Service (DoS) guidance collection and Preparing for DoS attacks (2020).
- CISA, Understanding Denial-of-Service Attacks (archived tip, February 2021).
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.