Hi,
On a practical point of view, a lot of DAA manufacturer provide applications note with schematic including lightning and surge protection in accordance to the more used standards or recommandation.
On a therical point of view, you need to read some mornative recommandations like UL60950, EN60950, FCC part 15, CE mark or CSA60950 and determine the category of equipement the terminal belongs to. This will give you information about the level of protection the terminal requires.
At the end of the design process, you will need to test the terminal in a certfication lab, allowing you to put it on the market with CE, UL, FCC or CSA marks.