Teams often describe DDoS protection as a product decision. In practice, it is an ingress and routing design decision with security consequences.
If GRE tunnels are untested, upstream policies are unclear, or announcement changes require manual interpretation during an attack, your mitigation program is incomplete.
Preparedness means documenting protected prefixes, validating cutover paths, understanding asymmetric traffic risk, and confirming that support escalation does not depend on guesswork.
The point of DDoS readiness is operational composure. A live event should trigger a practiced workflow, not a fresh design conversation.