Avoid treating DDoS protection as a one-time purchase or checklist item. Tie it to the intended outcome—absorbs or filters excessive traffic intended to exhaust service capacity—assign accountability, measure coverage and effectiveness, review exceptions, and update it when threats, systems or business requirements change.

CIS Critical Security Controls v8: https://www.cisecurity.org/controls/v8