Cyber Assessment Framework V3.

Version as of 15th April 2024

 Crown Copyright 2024

Contents

The CAF - A tool for assessing cyber resilience ................................................................................... 3

CAF Requirements .............................................................................................................................. 3
CAF Principles and contributing outcomes ......................................................................................... 3
Using IGPs ........................................................................................................................................... 4
Setting target levels of cyber security and resilience ......................................................................... 5
Making the CAF sector specific ........................................................................................................... 5
The Cyber Assessment Framework ..................................................................................................... 6
CAF - Objective A - Managing security risk ..................................................................................... 6
CAF - Objective B - Protecting against cyber attack ...................................................................... 12
CAF - Objective C - Detecting cyber security events ..................................................................... 31
CAF - Objective D - Minimising the impact of cyber security incidents ........................................ 37

Please Note: A list of all changes made between CAF V3.1 and V3.2, and all previous versions of the
CAF are available on the NCSC website.

2 of 40
The CAF - A tool for assessing cyber resilience
The Cyber Assessment Framework (CAF) provides a systematic and comprehensive approach to
assessing the extent to which cyber risks to essential function(s) are being managed by the
organisation responsible. CAF-based assessments can be carried out either by the responsible
organisation itself (self-assessment) or by an independent external entity, possibly a regulator /
cyber oversight body or a suitably qualified organisation acting on behalf of a regulator, such as an
NCSC assured commercial service provider.

The NCSC CAF cyber security and resilience objective and principles provide the foundations of the
CAF. The 4 high-level objectives and the 14 principles are written in terms of outcomes, i.e.
specification of what needs to be achieved rather than a checklist of what needs to be done. The
CAF adds additional levels of detail to the top-level principles, including a collection of structured
sets of Indicators of Good Practice (IGPs) as described in more detail below.

It should be noted that NCSC developed the CAF in its role as national technical authority for cyber
security, with an expectation that it would be used, amongst other things, as a tool to support
effective cyber regulation. NCSC itself has no regulatory responsibilities, and organisations subject to
cyber regulation should consult with their regulators to learn whether they should use the CAF in the
context of meeting regulatory requirements.

CAF Requirements
The CAF has been developed to meet the following set of requirements:

1. provide a suitable framework to assist in carrying out cyber resilience assessments.

2. maintain the outcome-focused approach of the NCSC cyber security and resilience principles
and discourage assessments being carried out as tick-box exercises.

3. be compatible with the use of appropriate existing cyber security guidance and standards.

4. enable the identification of effective cyber security and resilience improvement activities.

5. exist in a common core version which is sector-agnostic.

6. be extensible to accommodate sector-specific elements as may be required.

7. enable the setting of meaningful target security levels for organisations to achieve, possibly
reflecting a regulator view of appropriate and proportionate security.

8. be as straightforward and cost-effective to apply as possible.

CAF Principles and contributing outcomes

Each top-level NCSC security and resilience principle defines a broad cyber security outcome. The
precise approach organisations should adopt to achieve each principle is not specified as this will
vary according to organisational circumstances. However, each principle can be broken down into a
collection of lower-level contributing cyber security and resilience outcomes, all of which will
normally need to be achieved to fully satisfy the top-level principle.

3 of 40
An assessment of the extent to which an organisation is meeting a particular principle is
accomplished by assessing all the contributing outcomes for that principle. In order to inform
assessments at the level of contributing outcomes:

1. each contributing outcome is associated with a set of indicators of good practice (IGPs) and,

2. using the relevant IGPs, the circumstances under which the contributing outcome is judged
‘achieved’, ’not achieved’ or (in some cases) ‘partially achieved’ are described.

For each contributing outcome the relevant IGPs have conveniently been arranged into table format.
The resulting tables, referred to as IGP tables, constitute the basic building blocks of the CAF. In this
way, each principle is associated with several tables of IGPs, one table per contributing outcome.

Using IGPs
Assessment of contributing outcomes is primarily a matter of expert judgement and the IGPs do not
remove the requirement for the informed use of cyber security expertise and sector knowledge.
IGPs will usually provide good starting points for assessments but should be used flexibly and in
conjunction with the NCSC guidance associated with the top-level cyber security and resilience
principles. Conclusions about an organisation’s cyber security and resilience should only be drawn
after considering additional relevant factors and special circumstances.

The ‘achieved’ (GREEN) column of an IGP table defines the typical characteristics of an
organisation fully achieving that outcome. It is intended that all the indicators would normally be
present to support an assessment of ‘achieved’. The exception would be when an IGP may not be
applicable if there are compensating measures that would meet the requirements of the relevant
objective.

The ‘not achieved’ (RED) column of an IGP table defines the typical characteristics of an
organisation not achieving that outcome. It is intended that the presence of any one indicator would
normally be sufficient to justify an assessment of ‘not achieved’.

When present, the ‘partially achieved’ (AMBER) column of an IGP table defines the typical
characteristics of an organisation partially achieving that outcome. It is also important that the
partial achievement is delivering specific worthwhile cyber security and resilience benefits. An
assessment of ‘partially achieved’ should represent more than giving credit for doing something
vaguely relevant.

The following table summarises the key points relating to the purpose and nature of IGPs.

IGPs are… IGPs are not…

Purpose …intended to help inform expert …a checklist to be used in an inflexible

judgement. assessment process.

Scope …important examples of what an … an exhaustive list covering everything

assessor will normally need to consider, an assessor needs to consider.
which may need to be supplemented in
some cases.

Applicability …designed to be widely applicable …guaranteed to apply verbatim to all

across different organisations, but organisations.
applicability needs to be established.

4 of 40
Setting target levels of cyber security and resilience
The result of applying the CAF is 39 individual assessments, each one derived from making a
judgement on the extent to which a set of IGPs reflects the circumstances of the organisation being
assessed. The CAF has been designed in such a way that a result in which all 39 contributing
outcomes were assessed as ‘achieved’ would indicate a level of cyber security some way beyond the
bare minimum ‘basic cyber hygiene’ level.

A cyber oversight body will need to set target levels of cyber resilience for organisations within their
sector. One way of setting these target levels is in relation to the ability to withstand specified
categories of cyber attacks (e.g. resilience to basic capability attacks, moderate capability attacks
etc.) and the CAF has been designed to support this approach via the idea of CAF profiles.
The NCSC has worked with regulators and other organisations with a cyber resilience oversight role
on an approach to interpreting CAF output based on identifying those contributing outcomes
considered most important to achieve in order to manage security risks to that organisation’s
essential functions. Those prioritised contributing outcomes would correspond to an initial view of
appropriate and proportionate cyber security for that organisation. The subset of contributing
outcomes identified as the most important in this way would represent an example of a CAF
profile – something that could be used as the basis for setting a target for organisations to achieve.
In practice a CAF profile consists of a mixture of some contributing outcomes to be met at
‘achieved’, some at ‘partially achieved’ and perhaps some (representing cyber security capabilities
not appropriate at the level of the profile) identified as ‘not applicable’.
It is not the responsibility of the NCSC to mandate what represents appropriate and proportionate
(as defined in the NIS Regulations) cyber security and resilience. Any target set for organisations to
achieve in terms of CAF results is for the relevant cyber oversight body to define.

Making the CAF sector specific

The common core of the CAF (consisting of principles, contributing outcomes and indicators of good
practice) is sector agnostic in the sense that it is designed to be generally applicable to all
organisations responsible for essential functions across all key sectors. It is possible that there will be
a need for some sector specific aspects of the CAF, which could include the following:

i) Sector-specific CAF Profiles

Some target profiles may well be sector specific. As mentioned in the section on setting target levels,
it will be a decision for the relevant cyber oversight body to put an interpretation on CAF results,
which may be from a regulatory perspective.

ii) Sector-specific Interpretations of Contributing Outcomes/IGPs

It may be necessary in some cases for a sector-specific interpretation of contributing outcomes
and/or IGPs to better clarify meaning within the sector.

iii) Sector-specific Additional Contributing Outcomes/IGPs

There may be circumstances in which sector-specific cyber security requirements cannot be
adequately covered by an interpretation of a generic contributing outcome or IGP. In these cases, an
additional sector-specific contributing outcome or IGP may need to be defined.

The NCSC will continue to work with the full range of CAF stakeholders to determine if sector-
specific aspects of the CAF are required, and to assist in introducing changes as necessary.

5 of 40
The Cyber Assessment Framework
CAF - Objective A - Managing security risk
Appropriate organisational structures, policies, processes and procedures in place to understand,
assess and systematically manage security risks to the network and information systems supporting
essential functions.

Principle A1 Governance
The organisation has appropriate management policies, processes and procedures in place to govern its
approach to the security of network and information systems.

A1.a Board Direction

You have effective organisational security management led at board level and articulated clearly in
corresponding policies.

Not Achieved Achieved

At least one of the following statements is true All the following statements are true

The security of network and information systems Your organisation's approach and policy relating
related to the operation of essential function(s) is to the security of network and information systems
not discussed or reported on regularly at board- supporting the operation of your essential
level. function(s) are owned and managed at board-level.
These are communicated, in a meaningful way, to
Board-level discussions on the security of network risk management decision-makers across the
and information systems are based on partial or organisation.
out-of-date information, without the benefit of
expert guidance. Regular board-level discussions on the security of
network and information systems supporting the
The security of network and information systems operation of your essential function(s) take place,
supporting your essential function(s) are not driven based on timely and accurate information and
effectively by the direction set at board-level. informed by expert guidance.
Senior management or other pockets of the There is a board-level individual who has overall
organisation consider themselves exempt from accountability for the security of network and
some policies or expect special accommodations to information systems and drives regular discussion
be made. at board-level.
Direction set at board-level is translated into
effective organisational practices that direct and
control the security of the network and information
systems supporting your essential function(s).

6 of 40
A1.b Roles and Responsibilities
Your organisation has established roles and responsibilities for the security of network and information
systems at all levels, with clear and well-understood channels for communicating and escalating risks.

Not Achieved Achieved

At least one of the following statements is true All the following statements are true

Key roles are missing, left vacant, or fulfilled on an Key roles and responsibilities for the security of
ad-hoc or informal basis. network and information systems supporting your
essential function(s) have been identified. These
Staff are assigned security responsibilities but are reviewed regularly to ensure they remain fit for
without adequate authority or resources to fulfil purpose.
them.
Appropriately capable and knowledgeable staff fill
Staff are unsure what their responsibilities are for those roles and are given the time, authority, and
the security of the essential function(s). resources to carry out their duties.
There is clarity on who in your organisation has
overall accountability for the security of the
network and information systems supporting your
essential function(s).

A1.c Decision-making
You have senior-level accountability for the security of network and information systems, and delegate
decision-making authority appropriately and effectively. Risks to network and information systems related
to the operation of your essential function(s) are considered in the context of other organisational risks.

Not Achieved Achieved

At least one of the following statements is true All the following statements are true

What should be relatively straightforward risk Senior management have visibility of key risk
decisions are constantly referred up the chain, or decisions made throughout the organisation.
not made.
Risk management decision-makers understand
Risks are resolved informally (or ignored) at a local their responsibilities for making effective and
level when the use of a more formal risk reporting timely decisions in the context of the risk appetite
mechanism would be more appropriate. regarding the essential function(s), as set by senior
management.
Decision-makers are unsure of what senior
management's risk appetite is, or only understand Risk management decision-making is delegated and
it in vague terms such as "averse" or "cautious". escalated where necessary, across the
organisation, to people who have the skills,
Organisational structure causes risk decisions to be knowledge, tools and authority they need.
made in isolation. (e.g. engineering and IT don't
talk to each other about risk). Risk management decisions are regularly reviewed
to ensure their continued relevance and validity.
Risk priorities are too vague to make meaningful
distinctions between them. (e.g. almost all risks are
rated 'medium' or 'amber').

7 of 40
Principle A2 Risk Management
The organisation takes appropriate steps to identify, assess and understand security risks to the network
and information systems supporting the operation of essential functions. This includes an overall
organisational approach to risk management.

A2.a Risk Management Process

Your organisation has effective internal processes for managing risks to the security of network and
information systems related to the operation of your essential function(s) and communicating associated
activities.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements All the following statements are
statements is true are true true

Risk assessments are not based on Your organisational process Your organisational process
a clearly defined set of threat ensures that security risks to ensures that security risks to
assumptions. network and information network and information systems
systems relevant to essential relevant to essential function(s)
Risk assessment outputs are too function(s) are identified, are identified, analysed,
complex or unwieldy to be analysed, prioritised, and prioritised, and managed.
consumed by decision-makers managed.
and are not effectively Your approach to risk is focused
communicated in a clear and timely Your risk assessments are on the possibility of adverse
manner. informed by an impact to your essential
understanding of the function(s), leading to a detailed
Risk assessments for network and vulnerabilities in the network understanding of how such
information systems supporting and information systems impact might arise as a
your essential function(s) are a supporting your essential consequence of possible attacker
"one-off" activity or not done at all. function(s). actions and the security
The security elements of projects or properties of your network and
The output from your risk information systems.
programmes are solely dependent management process is a
on the completion of a risk clear set of security Your risk assessments are based
management assessment without requirements that will on a clearly understood set of
any regard to the outcomes. address the risks in line with threat assumptions, informed by
There is no systematic process in your organisational approach an up-to-date understanding of
place to ensure that identified to security. security threats to your essential
security risks are managed function(s) and your sector.
Significant conclusions
effectively. reached in the course of your Your risk assessments are
Systems are assessed in isolation, risk management process are informed by an understanding of
without consideration of communicated to key the vulnerabilities in the network
dependencies and interactions with security decision-makers and and information systems
other systems. (e.g. interactions accountable individuals. supporting your essential
between IT and OT environments). function(s).
You conduct risk assessments
Security requirements and when significant events The output from your risk
mitigations are arbitrary or are potentially affect the management process is a clear
applied from a control catalogue essential function(s), such as set of security requirements that
without consideration of how they replacing a system or a will address the risks in line with
contribute to the security of the change in the cyber security your organisational approach to
essential function(s). threat. security.

8 of 40
 Risks remain unresolved on a You perform threat analysis Significant conclusions reached in
register for prolonged periods of and understand how generic the course of your risk
time awaiting senior decision- threats apply to your management process are
making or resource allocation to organisation. communicated to key security
resolve. decision-makers and accountable
individuals.
Your risk assessments
are dynamic and updated in the
light of relevant changes which
may include technical changes to
network and information
systems, change of use and new
threat information.
The effectiveness of your risk
management process is reviewed
regularly, and improvements
made as required.
You perform detailed threat
analysis and understand how this
applies to your organisation in
the context of the threat to your
sector and the wider CNI.

A2.b Assurance
You have gained confidence in the effectiveness of the security of your technology, people, and processes
relevant to your essential function(s).

Not Achieved Achieved

At least one of the following statements is true All the following statements are true

A particular product or service is seen as a "silver You validate that the security measures in place to
bullet" and vendor claims are taken at face value. protect the network and information systems
are effective and remain effective for the lifetime
Assurance methods are applied without over which they are needed.
appreciation of their strengths and limitations,
such as the risks of penetration testing in You understand the assurance methods available
operational environments. to you and choose appropriate methods to gain
confidence in the security of essential function(s).
Assurance is assumed because there have been no
known problems to date. Your confidence in the security as it relates to your
technology, people, and processes can be
justified to, and verified by, a third party.
Security deficiencies uncovered by assurance
activities are assessed, prioritised and remedied
when necessary in a timely and effective way.
The methods used for assurance are reviewed to
ensure they are working as intended and remain
the most appropriate method to use.

9 of 40
Principle A3 Asset Management
Everything required to deliver, maintain or support network and information systems necessary for the
operation of essential functions is determined and understood. This includes data, people and systems, as
well as any supporting infrastructure (such as power or cooling).

A3.a Asset Management

Not Achieved Achieved

At least one of the following statements is true All the following statements are true

Inventories of assets relevant to the essential All assets relevant to the secure operation of
function(s) are incomplete, non-existent, or essential function(s) are identified and inventoried
inadequately detailed. (at a suitable level of detail). The inventory is kept
up-to-date.
Only certain domains or types of asset are
documented and understood. Dependencies Dependencies on supporting infrastructure (e.g.
between assets are not understood (such as the power, cooling etc) are recognised and recorded.
dependencies between IT and OT).
You have prioritised your assets according to their
Information assets, which could include personally importance to the operation of the essential
identifiable information and / or important / critical function(s).
data, are stored for long periods of time with no
clear business need or retention policy. You have assigned responsibility for managing all
assets, including physical assets, relevant to the
Knowledge critical to the management, operation, operation of the essential function(s).
or recovery of the essential function(s) is held by
one or two key individuals with no succession plan. Assets relevant to the essential function(s) are
managed with cyber security in mind throughout
Asset inventories are neglected and out of date. their lifecycle, from creation through to eventual
decommissioning or disposal.

Principle A4 Supply Chain

The organisation understands and manages security risks to network and information systems supporting
the operation of essential functions that arise as a result of dependencies on external suppliers. This
includes ensuring that appropriate measures are employed where third party services are used.

A4.a Supply Chain

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

You do not know what data You understand the general risks You have a deep understanding of
belonging to you is held by suppliers may pose to your your supply chain, including sub-
suppliers, or how it is essential function(s). contractors and the wider risks it
managed. faces. You consider factors such as
You know the extent of your supplier’s partnerships,
Elements of the supply chain supply chain that supports your competitors, nationality and other
for essential function(s) are essential function(s), including organisations with which they sub-
subcontracted and you have sub-contractors. contract. This informs your risk

10 of 40
little or no visibility of the assessment and procurement
sub-contractors. You understand which contracts processes.
are relevant and you include
You have no understanding appropriate security obligations in Your approach to supply chain risk
of which contracts are relevant contracts. management considers the risks to
relevant and / or relevant your essential function(s) arising
contracts do not specify You are aware of all third-party from supply chain subversion by
appropriate security connections and have assurance capable and well-resourced
obligations. that they meet your attackers.
organisation’s security
Suppliers have access to requirements. You have confidence that
systems that provide your information shared with suppliers
essential function(s) that is Your approach to security that is essential to the operation of
unrestricted, not monitored incident management considers your function(s) is appropriately
or bypasses your own incidents that might arise in your protected from sophisticated
security controls. supply chain. attacks.
You have confidence that You understand which contracts are
information shared with suppliers relevant and you include
that is necessary for the appropriate security obligations in
operation of your essential relevant contracts. You have a
function(s) is proactive approach to contract
appropriately protected from management which may include a
well-known attacks and known contract management plan for
vulnerabilities. relevant contracts.
Customer / supplier ownership of
responsibilities is laid out in
contracts.
All network connections and data
sharing with third parties are
managed effectively and
proportionately.
When appropriate, your
incident management process and
that of your suppliers provide
mutual support in the resolution of
incidents.

11 of 40
CAF - Objective B - Protecting against cyber attack
Proportionate security measures are in place to protect the network and information systems
supporting essential functions from cyber attack.

Principle B1 Service Protection Policies, Processes and Procedures

The organisation defines, implements, communicates and enforces appropriate policies, processes and
procedures that direct its overall approach to securing systems and data that support operation of
essential functions.

B1.a Policy, Process and Procedure Development

You have developed and continue to improve a set of cyber security and resilience policies, processes and
procedures that manage and mitigate the risk of adverse impact on your essential function(s).

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

Your policies, processes and Your policies, processes and You fully document your
procedures are absent or procedures document your overarching security governance
incomplete. overarching security governance and risk management approach,
and risk management approach, technical security practice and
Policies, processes and technical security practice and specific regulatory compliance.
procedures are not applied specific regulatory compliance. Cyber security is integrated and
universally or consistently. embedded throughout policies,
You review and update policies, processes and procedures and
People often or routinely processes and procedures in
circumvent policies, processes key performance indicators are
response to major cyber security reported to your executive
and procedures to achieve incidents.
business objectives. management.

Your organisation’s security Your organisation’s policies,

governance and risk processes and procedures are
management approach has no developed to be practical, usable
bearing on your policies, and appropriate for your
processes and procedures. essential function(s) and your
technologies.
System security is totally reliant
on users' careful and consistent Policies, processes and
application of manual security procedures that rely on user
processes. behaviour are practical,
appropriate and achievable.
Policies, processes and
procedures have not been You review and update policies,
reviewed in response to major processes and procedures at
changes (e.g. technology or suitably regular intervals to
regulatory framework), or within ensure they remain relevant.
a suitable period. This is in addition to reviews
following a major cyber security
Policies, processes and incident.
procedures are not readily
available to staff, too detailed to Any changes to the essential
function(s) or the threat it faces

12 of 40
 remember, or too hard to triggers a review of policies,
understand. processes and procedures.
Your systems are designed so
that they remain secure even
when user security policies,
processes and procedures
are not always followed.

B1.b Policy, Process and Procedure Implementation

You have successfully implemented your security policies, processes and procedures and can demonstrate
the security benefits achieved.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

Policies, processes and Most of your policies, processes All your policies, processes and
procedures are ignored or only and procedures are followed and procedures are followed, their
partially followed. their application is monitored. correct application and
security effectiveness is
How your policies, processes and Your policies, processes and evaluated.
procedures support the procedures are integrated with
resilience of your essential other organisational policies, Your policies, processes and
function(s) is not well processes and procedures, procedures are integrated with
understood. including HR assessments of other organisational policies,
individuals' trustworthiness. processes and procedures,
Staff are unaware of their including HR assessments of
responsibilities under your All staff are aware of their individuals' trustworthiness.
policies, processes and responsibilities under your
procedures. policies, processes and Your policies, processes and
procedures. procedures are effectively
You do not attempt to detect and appropriately
breaches of policies, processes All breaches of policies, communicated across all levels
and procedures. processes and procedures with of the organisation resulting in
the potential to adversely impact good staff awareness of their
Policies, processes and the essential function(s) are fully
procedures lack integration with responsibilities.
investigated. Other breaches are
other organisational policies, tracked, assessed for trends and Appropriate action is taken to
processes and procedures. action is taken to understand address all breaches of policies,
Your policies, processes and and address. processes and procedures with
procedures are not well potential to adversely impact
communicated across your the essential function(s)
organisation. including aggregated breaches.

13 of 40
Principle B2 Identity and Access Control
The organisation understands, documents and manages access to network and information systems
supporting the operation of essential functions. Users (or automated functions) that can access data or
systems are appropriately verified, authenticated and authorised.

B2.a Identity Verification, Authentication and Authorisation

You robustly verify, authenticate and authorise access to the network and information systems supporting
your essential function(s).

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

Initial identity verification is not Your process of initial identity Your process of initial identity
robust enough to provide an verification is robust enough to verification is robust enough to
acceptable level of confidence of provide a reasonable level of provide a high level of
a user’s identity profile. confidence of a user’s identity confidence of a user’s identity
profile before allowing an profile before allowing an
Authorised users and systems authorised user access to authorised user access to
with access to networks or network and information network and information
information systems on which systems that support your systems that support your
your essential function(s) essential function(s). essential function(s).
depends cannot be individually
identified. All authorised users and systems Only authorised and individually
Unauthorised individuals or with access to network or authenticated users can
devices can access your network information systems on which physically access and logically
or information systems on which your essential function(s) connect to your network or
your essential function(s) depends are individually information systems on which
depends. identified and authenticated. your essential function(s)
depends.
The number of authorised users The number of authorised users
and systems that have access to and systems that have access to The number of authorised users
your network and information essential function(s) network and systems that have access to
systems are not limited to the and information systems is all your network and information
minimum necessary. limited to the minimum systems supporting the essential
necessary. function(s) is limited to the
Your approach to authenticating
You use additional minimum necessary.
users, devices and systems does
not follow up to date best authentication mechanisms, You use additional
practice. such as multi-factor (MFA), authentication mechanisms,
for privileged access to all such as multi-factor
network and information (MFA), for all user access,
systems that operate or support including remote access, to all
your essential function(s). network and information
You individually authenticate systems that operate or support
and authorise all remote access your essential function(s).
to all your network and The list of users and systems
information systems that with access to network and
support your essential information systems supporting
function(s). and delivering the essential
function(s) is reviewed on a

14 of 40
 regular basis, at least every six
The list of users and systems months.
with access to network and
information systems supporting Your approach to authenticating
and delivering the essential users, devices and systems
function(s) is reviewed on a follows up to date best practice.
regular basis, at least annually.
Your approach to authenticating
users, devices and systems
follows up to date best practice.

B2.b Device Management

You fully know and have trust in the devices that are used to access your networks, information systems
and data that support your essential function(s).

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

Users can connect to your Only corporately owned and All privileged operations
network and information managed devices can access performed on your network and
systems supporting your your essential function(s) information systems supporting
essential function(s) using network and information your essential function(s) are
devices that are not corporately systems. conducted from highly trusted
owned and managed. devices, such as Privileged
All privileged operations are Access Workstations, dedicated
Privileged users can perform performed from corporately solely to those operations.
privileged operations from owned and managed devices.
devices that are not corporately These devices provide sufficient You either obtain independent
owned and managed. separation, using a risk-based and professional assurance of
approach, from the activities of the security of third-party
You have not gained assurance standard users. devices or networks before they
in the security of any third-party connect to your network and
devices or networks connected You have sought to understand information systems, or you only
to your systems. the security properties of third- allow third-party devices or
party devices and networks networks that are dedicated to
Physically connecting a device to before they can be connected to
your network and information supporting your network and
your systems. You have taken information systems to connect.
systems gives that device access appropriate steps to mitigate
without device or user any risks identified. You perform certificate-based
authentication. device identity management and
The act of connecting to a only allow known devices to
network port or cable does not access systems necessary for the
grant access to any systems. operation of your essential
You are able to detect unknown function(s).
devices being connected to your You perform regular scans to
network and information detect unknown devices and
systems and investigate such investigate any findings.
incidents.

15 of 40
B2.c Privileged User Management

You closely manage privileged user access to network and information systems supporting your essential
function(s).

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

The identities of the individuals All privileged user access to Privileged user access to
with privileged access to network and information network and information
network and information systems supporting your systems supporting your
systems (infrastructure, essential function(s) requires essential function(s) is carried
platforms, software, strong authentication, such as out from dedicated separate
configuration etc) supporting multi-factor (MFA). accounts that are closely
your essential function(s) are not monitored and managed.
known or not managed. The identities of the individuals
with privileged access to The issuing of temporary, time-
Privileged user access to network and information bound rights for privileged user
network and information systems (infrastructure, access and / or external third-
systems supporting your platforms, software, party support access is in place.
essential function(s) is via weak configuration etc) supporting
authentication mechanisms (e.g. your essential function(s) are Privileged user access rights are
only simple passwords). known and managed. This regularly reviewed and always
includes third parties. updated as part of your joiners,
The list of privileged users has movers and leavers process.
not been reviewed recently (e.g. Activity by privileged users is
within the last 12 months). routinely reviewed and validated All privileged user activity is
(e.g. at least annually). routinely reviewed, validated
Privileged user access is granted and recorded for offline analysis
on a system-wide basis rather Privileged users are only granted and investigation.
than by role or function(s). specific privileged user access
rights which are essential to
Privileged user access to your their business role or function.
essential function(s) is via
generic, shared or default name
accounts.
Where there are “always on”
terminals which can perform
privileged actions (such as in a
control room), there are no
additional controls (e.g. physical
controls) to ensure access is
appropriately restricted.
There is no logical separation
between roles that an individual
may have and hence the actions
they perform (e.g. access to
corporate email and
privilege user actions).

16 of 40
B2.d Identity and Access Management (IdAM)

You closely manage and maintain identity and access control for users, devices and systems accessing the
network and information systems supporting your essential function(s).

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

Greater access rights are granted You follow a robust procedure to You follow a robust procedure to
than necessary. verify each user and issue the verify each user and issue the
minimum required access rights. minimum required access rights,
Identity validation and and the application of the
requirement for access of a user, You regularly review access procedure is regularly audited.
device or systems is not carried rights and those no longer
out. needed are revoked. User access rights are reviewed
both when people change roles
User access rights are not User access rights are reviewed via your joiners, leavers and
reviewed when users change when users change roles via your movers process and at regular
roles. joiners, leavers and movers intervals - at least annually.
process.
User access rights remain active All user, device and systems
when users leave your All user, device and system access to the systems supporting
organisation. access to the systems supporting the essential function(s) is
the essential function(s) is logged and monitored.
Access rights granted to devices logged and monitored, but it is
or systems to access other not compared to other log data You regularly review access logs
devices and systems are not or access records. and correlate this data with
reviewed on a regular basis (at other access records and
least annually). expected activity.
Attempts by unauthorised users,
devices or systems to connect to
the systems supporting the
essential function(s) are alerted,
promptly assessed and
investigated.

17 of 40
Principle B3 Data Security
Data stored or transmitted electronically is protected from actions such as unauthorised access,
modification, or deletion that may cause an adverse impact on essential functions. Such protection
extends to the means by which authorised users, devices and systems access critical data necessary for
the operation of essential functions. It also covers information that would assist an attacker, such as
design details of network and information systems.

B3.a Understanding Data

You have a good understanding of data important to the operation of your essential function(s), where it
is stored, where it travels and how unavailability or unauthorised access, modification or deletion would
adversely impact the essential function(s). This also applies to third parties storing or accessing data
important to the operation of your essential function(s).

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

You have incomplete knowledge You have identified and You have identified and
of what data is used by and catalogued all the data catalogued all the data
produced in the operation of the important to the operation of important to the operation of
essential function(s). the essential function(s), or that the essential function(s), or that
would assist an attacker. would assist an attacker.
You have not identified the
important data on which your You have identified and You have identified and
essential function(s) relies. catalogued who has access to catalogued who has access to
the data important to the the data important to the
You have not identified who has operation of the essential operation of the essential
access to data important to the function(s). function(s).
operation of the essential
function(s). You regularly review location, You maintain a current
transmission, quantity and understanding of the location,
You have not clearly articulated quality of data important to the quantity and quality of data
the impact of data compromise operation of the essential important to the operation of
or lack of availability. function(s). the essential function(s).
You have identified all mobile You take steps to remove or
devices and media that hold minimise unnecessary copies or
data important to the operation unneeded historic data.
of the essential function(s).
You have identified all mobile
You understand and document devices and media that may hold
the impact on your essential data important to the operation
function(s) of all relevant of the essential function(s).
scenarios, including
unauthorised data access, You maintain a current
modification or deletion, understanding of the data links
or when authorised users are used to transmit data that is
unable to appropriately access important to your essential
this data. function(s).

You occasionally validate these You understand the context,

documented impact statements. limitations and dependencies of
your important data.

18 of 40
 You understand and document
the impact on your essential
function(s) of all relevant
scenarios, including
unauthorised data access,
modification or deletion,
or when authorised users are
unable to appropriately
access this data.
You validate these documented
impact statements regularly, at
least annually.

B3.b Data in Transit

You have protected the transit of data important to the operation of your essential function(s). This
includes the transfer of data to third parties.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

You do not know what all your You have identified and You have identified and
data links are, or which carry protected (effectively and protected (effectively and
data important to the operation proportionately) all the data proportionately) all the data
of the essential function(s). links that carry data important to links that carry data important to
the operation of your essential the operation of your essential
Data important to the operation function(s). function(s).
of the essential function(s)
travels without technical You apply appropriate technical You apply appropriate physical
protection over non-trusted or means (e.g. cryptography) to and / or technical means to
openly accessible carriers. protect data that travels protect data that travels over
over non-trusted or openly non-trusted or openly accessible
Critical data paths that could fail, accessible carriers, but you have carriers, with justified
be jammed, be overloaded, etc. limited or no confidence in the confidence in the robustness of
have no alternative path. robustness of the protection the protection applied.
applied.
Suitable alternative transmission
paths are available where there
is a significant risk of impact on
the operation of the essential
function(s) due to resource
limitation (e.g. transmission
equipment or function failure, or
important data being blocked or
jammed).

19 of 40
B3.c Stored Data

You have protected stored soft and hard copy data important to the operation of your essential
function(s).

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

You have no, or limited, All copies of data important to All copies of data important to
knowledge of where data the operation of your essential the operation of your essential
important to the operation of function(s) are necessary. Where function(s) are necessary. Where
the essential function(s) is this important data is this important data is
stored. transferred to less secure transferred to less secure
systems, the data is provided systems, the data is provided
You have not protected
with limited detail and / or as with limited detail and / or as
vulnerable stored data
a read-only copy. a read-only copy.
important to the operation of
the essential function(s) in a You have applied suitable You have applied suitable
suitable way. physical and / or technical physical and / or technical
means to protect this important means to protect this important
Backups are incomplete,
stored data from unauthorised stored data from unauthorised
untested, not adequately
access, modification or deletion. access, modification or deletion.
secured or could be inaccessible
in a disaster recovery or business If cryptographic protections are If cryptographic protections are
continuity situation. used, you apply suitable used you apply suitable
technical and procedural technical and procedural means,
means, but you have limited or and you have justified
no confidence in the robustness confidence in the robustness of
of the protection applied. the protection applied.
You have suitable, secured You have suitable, secured
backups of data to allow backups of data to allow
the operation of the essential the operation of the essential
function(s) to continue should function(s) to continue should
the original data not be the original data not be
available. This may include off- available. This may include off-
line or segregated backups, line or segregated backups,
or appropriate alternative forms or appropriate alternative forms
such as paper copies. such as paper copies.
Necessary historic or archive
data is suitably secured in
storage.

20 of 40
B3.d Mobile Data

You have protected data important to the operation of your essential function(s) on mobile devices.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

You don’t know which mobile You know which mobile devices Mobile devices that hold data
devices may hold data important hold data important to the that is important to the
to the operation of the essential operation of the essential operation of the essential
function(s). function(s). function(s) are catalogued, are
under your organisation's
You allow data important to the Data important to the operation control and configured according
operation of the essential of the essential function(s) is to best practice for the platform,
function(s) to be stored on stored on mobile devices only with appropriate technical and
devices not managed by your when they have at least the procedural policies in place.
organisation, or to at least security standard aligned to your
equivalent standard. overarching security policies. Your organisation can remotely
wipe all mobile devices holding
Data on mobile devices is not Data on mobile devices is data important to the operation
technically secured, or only technically secured. of the essential function(s).
some is secured.
You have minimised this data on
these mobile devices. Some
data may be automatically
deleted off mobile devices after
a certain period.

21 of 40
B3.e Media / Equipment Sanitisation

Before reuse and / or disposal you appropriately sanitise devices, equipment and removable media
holding data important to the operation of your essential function(s).

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements All the following statements are
statements is true are true true

Some or all devices, equipment Data important to the You catalogue and track all devices
or removable media that hold operations of the essential that contain data important to the
data important to the operation function(s) is removed from all operation of the essential
of the essential function(s) are devices, equipment and function(s) (whether a specific
reused or disposed of without removable media before reuse storage device or one with integral
sanitisation of that data. and / or disposal. storage).
Data important to the operation of
the essential function(s) is removed
from all devices, equipment and
removable media before reuse and
/ or disposal using an assured
product or service.

Principle B4 System Security

Network and information systems and technology critical for the operation of essential functions are
protected from cyber attack. An organisational understanding of risk to essential functions informs the
use of robust and reliable protective security measures to effectively limit opportunities for attackers to
compromise networks and systems.

B4.a Secure by Design

You design security into the network and information systems that support the operation of your essential
function(s). You minimise their attack surface and ensure that the operation of your essential function(s)
should not be impacted by the exploitation of any single vulnerability.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

Systems essential to the You employ appropriate You employ appropriate

operation of the essential expertise to design network and expertise to design network and
function(s) are not appropriately information systems. information systems.
segregated from other systems.
You design strong boundary Your network and information
Internet access is available from defences where your network systems are segregated into
network and information and information systems appropriate security zones (e.g.
systems supporting your interface with other systems supporting the essential
essential function(s). organisations or the world at function(s) are segregated in a
large.

22 of 40
 highly trusted, more secure
Data flows between network You design simple data flows zone).
and information systems between your network and
supporting your essential information systems and any The network and information
function(s) and other systems external interface to enable systems supporting your
are complex, making it hard effective monitoring. essential function(s) are
to discriminate between designed to have simple data
legitimate and illegitimate / You design to make network and flows between components to
malicious traffic. information system recovery support effective security
simple. monitoring.
Remote or third-party accesses
circumvent some network All inputs to network and The network and information
controls to gain more direct information systems supporting systems supporting your
access to network and your essential function(s) are essential function(s) are
information systems supporting checked and validated at the designed to be easy to recover.
the essential function(s). network boundary where
possible, or additional Content-based attacks are
monitoring is in place for mitigated for all inputs to
content-based attacks. network and information
systems that affect the essential
function(s) (e.g. via
transformation and inspection).

B4.b Secure Configuration

You securely configure the network and information systems that support the operation of your essential
function(s).

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

You haven't identified the assets You have identified and You have identified,
that need to be carefully documented the assets that documented and actively
configured to maintain the need to be carefully configured manage (e.g. maintain security
security of the essential to maintain the security of the configurations, patching,
function(s). essential function(s). updating according to good
practice) the assets that need to
Policies relating to the security Secure platform and device be carefully configured to
of operating system builds or builds are used across the maintain the security of the
configuration are not applied estate. essential function(s).
consistently across your network
and information systems relating Consistent, secure and minimal All platforms conform to your
to your essential function(s). system and device secure, defined baseline build,
configurations are applied across or the latest known good
Configuration details are not the same types of environment. configuration version for that
recorded or lack enough environment.
information to be able to rebuild Changes and adjustments to
the system or device. security configuration at security You closely and effectively
boundaries with the network manage changes in your
The recording of security and information systems environment, ensuring that
changes or adjustments that supporting your essential network and system

23 of 40
 affect your essential function(s) function(s) are approved and configurations are secure and
is lacking or inconsistent. documented. documented.
Generic, shared, default name You verify software before You regularly review and
and built-in accounts have not installation is permitted. validate that your network and
been removed or disabled. information systems have the
Generic, shared, default name expected, secure settings and
and built-in accounts have been configuration.
removed or disabled. Where this
is not possible, credentials to Only permitted software can be
these accounts have been installed.
changed.
Standard users are not able to
change settings that would
impact security or the business
operation.
If automated decision-making
technologies are in use, their
operation is well understood,
and decisions can be replicated.
Generic, shared, default name
and built-in accounts have been
removed or disabled. Where this
is not possible, credentials to
these accounts have been
changed.

B4.c Secure Management

You manage your organisation's network and information systems that support the operation of your
essential function(s) to enable and maintain security.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

Your systems and devices Your systems and devices Your systems and devices
supporting the operation of the supporting the operation of the supporting the operation of the
essential function(s) are essential function(s) are only essential function(s) are only
administered or maintained administered or maintained by administered or maintained by
from devices that are not authorised privileged users from authorised privileged users from
corporately owned and devices sufficiently separated, highly trusted devices, such as
managed. using a risk-based approach, Privileged Access Workstations,
from the activities of standard dedicated solely to those
You do not have good or current users. operations.
technical documentation of your
network and information Technical knowledge about You regularly review and update
systems. network and information technical knowledge about
systems, such as documentation network and information
and network diagrams, is systems, such as documentation
regularly reviewed and updated.

24 of 40
 and network diagrams, and
You prevent, detect and remove ensure they are securely stored.
malware, and unauthorised
software. You use technical, You prevent, detect and remove
procedural and physical malware, and unauthorised
measures as necessary. software. You use technical,
procedural and physical
measures as necessary.

B4.d. Vulnerability Management

You manage known vulnerabilities in your network and information systems to prevent adverse impact on
your essential function(s).

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements All the following statements are
statements is true below are true true

You do not understand the You maintain a current You maintain a current
exposure of your essential understanding of the exposure understanding of the exposure
function(s) to publicly-known of your essential function(s) to of your essential function(s) to
vulnerabilities. publicly-known vulnerabilities. publicly-known vulnerabilities.
You do not mitigate externally Announced vulnerabilities for all Announced vulnerabilities for all
exposed vulnerabilities software packages, network and software packages, network and
promptly. information systems used to information systems used to
support your essential support your essential
You have not recently tested to function(s) are tracked, function(s) are tracked,
verify your understanding of the prioritised and externally prioritised and mitigated (e.g. by
vulnerabilities of the network exposed vulnerabilities are patching) promptly.
and information systems that mitigated (e.g. by patching)
support your essential promptly. You regularly test to fully
function(s). understand the vulnerabilities of
Some vulnerabilities that are not the network and information
You have not suitably mitigated externally exposed have systems that support the
systems or software that is no temporary mitigations for an operation of your essential
longer supported. extended period. function(s) and verify this
You are not pursuing understanding with third-party
You have temporary mitigations testing.
replacement for unsupported for unsupported systems and
systems or software. software while pursuing You maximise the use of
migration to supported supported software, firmware
technology. and hardware in your network
and information systems
You regularly test to fully supporting your essential
understand the vulnerabilities of function(s).
the network and information
systems that support the
operation of your essential
function(s).

25 of 40
Principle B5 Resilient Networks and Systems
The organisation builds resilience against cyber attack and system failure into the design,
implementation, operation and management of systems that support the operation of essential functions.

B5.a Resilience Preparation

You are prepared to restore the operation of your essential function(s) following adverse impact.

Not Achieved Partially Achieved Achieved

Any of the following statements All the following statements are All the following statements are
are true true true

You have limited understanding You know all network and You have business continuity
of all the elements that are information systems, and and disaster recovery plans that
required to restore operation of underlying technologies, that are have been tested for practicality,
the essential function(s). necessary to restore the effectiveness and completeness.
operation of the essential Appropriate use is made
You have not completed function(s) and understand of different test methods (e.g.
business continuity and disaster their interdependence. manual fail-over, table-top
recovery plans for network and exercises, or red-teaming).
information systems, including You know the order in which
their dependencies, supporting systems need to be recovered You use your security awareness
the operation of the essential to efficiently and effectively and threat intelligence sources
function(s). restore the operation of the to identify new or heightened
essential function(s). levels of risk, which result in
You have not fully assessed the immediate and potentially
practical implementation of your temporary security measures to
business continuity and disaster enhance the security of your
recovery plans. network and information
systems (e.g. in response to a
widespread outbreak of very
damaging malware).

26 of 40
B5.b Design for Resilience

You design the network and information systems supporting your essential function(s) to be resilient to
cyber security incidents. Systems are appropriately segregated and resource limitations are mitigated.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

Network and information Network and information Network and information

systems supporting the systems supporting the systems supporting the
operation of your essential operation of your essential operation of your essential
function(s) are not appropriately function(s) are logically function(s) are segregated from
segregated. separated from your business other business and external
systems (e.g. they reside on the systems by appropriate technical
Internet services, such as same network as the rest of the and physical means (e.g.
browsing and email, are organisation but within a DMZ). separate network and system
accessible from network and Internet services are not infrastructure with independent
information systems supporting accessible from network and user administration). Internet
the essential function(s). information systems supporting services are not accessible from
You do not understand or lack the essential function(s). network and information
plans to mitigate all resource systems supporting the essential
Resource limitations (e.g. function(s).
limitations that could adversely network bandwidth, single
affect your essential function(s). network paths) have been You have identified and
identified but not fully mitigated. mitigated all resource limitations
(e.g. bandwidth limitations and
single network paths).
You have identified and
mitigated any geographical
constraints or weaknesses. (e.g.
systems that your essential
function(s) depends upon
are replicated in another
location, important network
connectivity has alternative
physical paths and service
providers).
You review and update
assessments of dependencies,
resource and geographical
limitations and mitigations when
necessary.

27 of 40
B5.c Backups

You hold accessible and secured current backups of data and information needed to recover operation of
your essential function(s).

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

Backup coverage is incomplete You have appropriately secured Your comprehensive, automatic
and does not include all relevant backups (including data, and tested technical and
data and information needed to configuration information, procedural backups are secured
restore the operation of your software, equipment, processes at centrally accessible or
essential function(s). and knowledge). These backups secondary sites to recover from
will be accessible to recover an extreme event.
Backups are not frequent from an extreme event.
enough for the operation of your Backups of all important data
essential function(s) to be You routinely test backups to and information needed to
restored effectively. ensure that the backup process recover the essential function(s)
function(s) correctly and the are made, tested, documented
Your restoration process does backups are usable. and routinely reviewed.
not restore your essential
function(s) in a suitable time
frame.

28 of 40
Principle B6 Staff Awareness and Training
Staff have appropriate awareness, knowledge and skills to carry out their organisational roles effectively
in relation to the security of network and information systems supporting the operation of essential
functions.

B6.a Cyber Security Culture

You develop and maintain a positive cyber security culture.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

People in your organisation Your executive management Your executive management

don't understand what they understand and widely clearly and effectively
contribute to the cyber security communicate the importance of communicates the organisation's
of the essential function(s). a positive cyber security culture. cyber security priorities and
Positive attitudes, behaviours objectives to all staff. Your
People in your organisation and expectations are described organisation displays positive
don't know how to raise a for your organisation. cyber security attitudes,
concern about cyber security. behaviours and expectations.
All people in your organisation
People believe that reporting understand the contribution People in your organisation
issues may get them into they make to the essential raising potential cyber security
trouble. function(s) cyber security. incidents and issues are treated
Your organisation's approach to positively.
All individuals in your
cyber security is perceived by organisation know who to Individuals at all levels in your
staff as hindering the business of contact and where to access organisation routinely report
the organisation. more information about cyber concerns or issues about cyber
security. They know how to raise security and are recognised for
a cyber security issue. their contribution to keeping the
organisation secure.
Your management is seen to be
committed to and actively
involved in cyber security.
Your organisation communicates
openly about cyber security,
with any concern being taken
seriously.
People across your organisation
participate in cyber security
activities and improvements,
building joint ownership and
bringing knowledge of their area
of expertise.

29 of 40
B6.b Cyber Security Training

The people who support the operation of your essential function(s) are appropriately trained in cyber
security. A range of approaches to cyber security training, awareness and communications are employed.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

There are teams who operate You have defined appropriate All people in your organisation,
and support your essential cyber security training and from the most senior to the
function(s) that lack any cyber awareness activities for all roles most junior, follow appropriate
security training. in your organisation, from cyber security training paths.
executives to the most junior
Cyber security training is roles. Each individuals cyber security
restricted to specific roles in training is tracked and refreshed
your organisation. You use a range of teaching and at suitable intervals.
communication techniques for
Cyber security training records cyber security training and You routinely evaluate your
for your organisation are lacking awareness to reach the widest cyber security training and
or incomplete. audience effectively. awareness activities to ensure
they reach the widest audience
Cyber security information is and are effective.
easily available.
You make cyber security
information and good practice
guidance easily accessible,
widely available and you know it
is referenced and used within
your organisation.

30 of 40
CAF - Objective C - Detecting cyber security events
Capabilities exist to ensure security defences remain effective and to detect cyber security events
affecting, or with the potential to affect, essential function(s).

Principle C1 Security Monitoring

The organisation monitors the security status of the network and information systems supporting the
operation of essential functions in order to detect potential security problems and to track the ongoing
effectiveness of protective security measures.

C1.a Monitoring Coverage

The data sources that you include in your monitoring allow for timely identification of security events
which might affect the operation of your essential function(s).

Not Achieved Partially Achieved Achieved

At least one of the following All the following All the following statements are true
statements is true statements are true

Data relating to the security Data relating to the Monitoring is based on an

and operation of your security and operation of understanding of your networks,
essential function(s) is not some areas of your common cyber attack methods and
collected. essential function(s) is what you need awareness of in order
collected but coverage is to detect potential security incidents
You do not confidently not comprehensive. that could affect the operation of your
detect the presence or essential function(s) (e.g. presence of
absence of Indicators of You easily detect the malware, malicious emails, user policy
Compromise (IoCs) on your presence or absence of violations).
essential function(s), such as IoCs on your essential
known malicious command function(s), such as Your monitoring data provides enough
and control signatures (e.g. known malicious detail to reliably detect security
because applying the command and control incidents that could affect the
indicator is difficult or your signatures. operation of your essential function(s).
log data is not sufficiently
detailed). Some user monitoring is You easily detect the presence or
done, but not covering a absence of IoCs on your essential
You are not able to audit the fully agreed list of function(s), such as known malicious
activities of users in relation suspicious or undesirable command and control signatures.
to your essential function(s). behaviour.
Extensive monitoring of user activity in
You do not capture any You monitor traffic relation to the operation of your
traffic crossing your network crossing your network essential function(s) enables you to
boundary including as a boundary (including IP detect policy violations and an agreed
minimum IP connections. address connections as a list of suspicious or undesirable
minimum). behaviour.
You have extensive monitoring
coverage that includes host-based
monitoring and network gateways.
All new systems are considered as
potential monitoring data sources to
maintain a comprehensive monitoring
capability.

31 of 40
C1.b Securing Logs
You hold log data securely and grant appropriate access only to accounts with business a need. No system
or user should ever need to modify or delete master copies of log data within an agreed retention period,
after which it should be deleted.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

It is possible for log data to be Only authorised staff can view log The integrity of log data is
easily edited or deleted by data for investigations. protected, or any modification is
unauthorised users or detected and attributed.
malicious attackers. Authorised users and systems can
appropriately access log data. The logging architecture has
There is no controlled list mechanisms, policies, processes
of the users and systems that There is some monitoring of and procedures to ensure that it
can view and query log data. access to log data (e.g. copying, can protect itself from threats
deleting, modifying or viewing). comparable to those it is trying to
There is no monitoring of the identify. This includes protecting
access to log data. the essential function(s) itself,
There is no policy for accessing and the data within it.
log data. Log data analysis and
Log data is not synchronised, normalisation is only performed
using an accurate common on copies of the data keeping the
time source. master copy unaltered.
Log data is synchronised, using an
accurate common time source, so
that separate datasets can be
correlated in different ways.
Access to log data is limited to
those with business need and no
others.
All actions involving all log data
(e.g. copying, deleting, modifying
or viewing) can be traced back to
a unique user.
Legitimate reasons for accessing
log data are given in use policies.

32 of 40
C1.c Generating Alerts
Evidence of potential security incidents contained in your monitoring data is reliably identified
and triggers alerts.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements All the following statements are
statements is true are true true

Alerts from third party security Alerts from third party Log data is enriched with other
software are not investigated (e.g. security software are network knowledge and data
Anti-Virus (AV) providers). investigated, and action when investigating certain
taken. suspicious activity or alerts.
Logs are distributed across devices
with no easy way to access them Some, but not all, log data can A wide range of signatures and
other than manual login or be easily queried with search indicators of compromise is used
physical action. tools to aid investigations. for investigations of suspicious
activity and alerts.
The resolution of alerts to a The resolution of alerts to a
network asset or system is not network asset or system is Alerts can be easily resolved to
performed. performed regularly. network assets using knowledge
of networks and systems. The
Security alerts relating to essential Security alerts relating to resolution of these alerts is
function(s) are not prioritised. some essential function(s) are performed in almost real time.
prioritised.
Logs are reviewed infrequently. Security alerts relating to all
Logs are reviewed at regular essential function(s) are
intervals. prioritised and this information
is used to support incident
management.
Logs are reviewed almost
continuously, in real time.
Alerts are tested to ensure that
they are generated reliably and
that it is possible to distinguish
genuine security incidents from
false alarms.

33 of 40
C1.d Identifying Security Incidents
You contextualise alerts with knowledge of the threat and your systems, to identify those security
incidents that require some form of response.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

Your organisation has no sources Your organisation uses some You have selected threat
of threat intelligence. threat intelligence services, but intelligence sources or services
you don't necessarily choose using risk-based and threat-
You do not apply updates in a sources or providers specifically informed decisions based
timely way, after receiving them because of your business needs, on your business needs and
(e.g. AV signature updates, other or specific threats in your sector sector (e.g. vendor reporting
threat signatures or Indicators of (e.g. sector-based infoshare, ICS and patching, strong anti-virus
Compromise (IoCs)). software vendors, anti-virus providers, sector and
You do not receive signature providers, specialist threat intel community-based infoshare,
updates for all protective firms, special interest groups). special interest groups).
technologies such as AV and IDS You receive updates for all your You apply all new signatures
or other software in use. signature based protective and IoCs within a reasonable
You do not evaluate the technologies (e.g. AV, IDS). (risk-based) time of receiving
usefulness of your threat them.
You apply some updates,
intelligence or share feedback signatures and IoCs in a timely You receive signature updates
with providers or other users. way. for all your protective
technologies (e.g. AV, IDS).
You know how effective your
threat intelligence is (e.g. by You track the effectiveness of
tracking how threat intelligence your intelligence feeds and
helps you identify security actively share feedback on the
problems). usefulness of IoCs and any
other indicators with the threat
community (e.g. sector
partners, threat intelligence
providers, government
agencies).

34 of 40
C1.e Monitoring Tools and Skills

Monitoring staff skills, tools and roles, including any that are outsourced, should reflect governance and
reporting requirements, expected threats and the complexities of the network or system data they need to
use. Monitoring staff have knowledge of the essential function(s) they need to protect.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

There are no staff who perform a Monitoring staff have some You have monitoring staff, who
monitoring function. investigative skills and a basic are responsible for the analysis,
understanding of the data they investigation and reporting of
Monitoring staff do not have the need to work with. monitoring alerts covering both
correct specialist skills. security and performance.
Monitoring staff can report to
Monitoring staff are not capable other parts of the organisation Monitoring staff have defined
of reporting against governance (e.g. security directors, roles and skills that cover all
requirements. resilience managers). parts of the monitoring and
Monitoring staff lack the skills to investigation process.
Monitoring staff are capable of
successfully perform some following most of the required Monitoring staff follow policies,
significant parts of the defined workflows. processes and procedures that
workflow. address all governance reporting
Your monitoring tools can make requirements, internal and
Monitoring tools are only able to use of logging that would
make use of a fraction of log data external.
capture most unsophisticated
being collected. and untargeted attack types. Monitoring staff are empowered
Monitoring tools cannot be to look beyond the fixed process
Your monitoring tools work with to investigate and understand
configured to make use of new most log data, with some
logging streams, as they come non-standard threats, by
configuration. developing their own
online.
Monitoring staff are aware of investigative techniques and
Monitoring staff have a lack of some essential function(s) and making new use of data.
awareness of the essential can manage alerts relating to
function(s) the organisation Your monitoring tools make use
them. of all log data collected to
provides, what assets relate to
those functions and hence the pinpoint activity within an
importance of the log data and incident.
security events. Monitoring staff and tools drive
and shape new log data
collection and can make wide
use of it.
Monitoring staff are aware of
the operation of essential
function(s) and related assets
and can identify and prioritise
alerts or investigations that
relate to them.

35 of 40
Principle C2 Proactive Security Event Discovery
The organisation detects, within network and information systems, malicious activity affecting, or with
the potential to affect, the operation of essential functions even when the activity evades standard
signature based security prevent/detect solutions (or when standard solutions are not deployable).
C2.a System Abnormalities for Attack Detection
You define examples of abnormalities in system behaviour that provide practical ways of detecting
malicious activity that is otherwise hard to identify.

Not Achieved Achieved

At least one of the following statements is true All the following statements are true

Normal system behaviour is insufficiently Normal system behaviour is fully understood to such
understood to be able to use system an extent that searching for system abnormalities is a
abnormalities to detect malicious activity. potentially effective way of detecting malicious activity
(e.g. You fully understand which systems should and
You have no established understanding of what should not communicate and when).
abnormalities to look for that might signify
malicious activities. System abnormality descriptions from past attacks and
threat intelligence, on yours and other networks, are
used to signify malicious activity.
The system abnormalities you search for consider the
nature of attacks likely to impact on the network and
information systems supporting the operation of your
essential function(s).
The system abnormality descriptions you use are
updated to reflect changes in your network and
information systems and current threat intelligence.

C2.b Proactive Attack Discovery

You use an informed understanding of more sophisticated attack methods and of normal system
behaviour to monitor proactively for malicious activity.

Not Achieved Achieved

At least one of the following statements is true All the following statements are true

You do not routinely search for system You routinely search for system abnormalities
abnormalities indicative of malicious activity. indicative of malicious activity on the network and
information systems supporting the operation of your
essential function(s), generating alerts based on the
results of such searches.
You have justified confidence in the effectiveness of
your searches for system abnormalities indicative of
malicious activity.

36 of 40
CAF - Objective D - Minimising the impact of cyber security incidents
Capabilities exist to minimise the adverse impact of a cyber security incident on the operation of
essential functions, including the restoration of those function(s) where necessary.

Principle D1 Response and Recovery Planning

There are well-defined and tested incident management processes in place, that aim to ensure continuity
of essential function(s) in the event of system or service failure. Mitigation activities designed to contain
or limit the impact of compromise are also in place.

D1.a Response Plan

You have an up-to-date incident response plan that is grounded in a thorough risk assessment that takes
account of your essential function(s) and covers a range of incident scenarios.

Not Achieved Partially Achieved Achieved

At least one of the following All the following statements are All the following statements are
statements is true true true

Your incident response plan Your incident response plan Your incident response plan is
is not documented. covers your essential function(s). based on a clear understanding of
the security risks to the network
Your incident response plan Your incident response plan and information systems
does not include your comprehensively covers scenarios supporting your essential
organisations identified that are focused on likely impacts function(s).
essential function(s). of known and well understood
attacks only. Your incident response plan is
Your incident response plan comprehensive (i.e. covers the
is not well understood by Your incident response plan is complete lifecycle of an incident,
relevant staff. understood by all staff who are roles and responsibilities, and
involved with your organisation's reporting) and covers likely
response function. impacts of both known attack
Your incident response plan is patterns and of possible attacks,
documented and shared with all previously unseen.
relevant stakeholders. Your incident response plan is
documented and integrated with
wider organisational business
plans and supply chain response
plans, as well as dependencies on
supporting infrastructure (e.g.
power, cooling etc).
Your incident response plan is
communicated and understood by
the business areas involved with
the operation of your essential
function(s).

37 of 40
D1.b Response and Recovery Capability
You have the capability to enact your incident response plan, including effective limitation of impact on
the operation of your essential function(s). During an incident, you have access to timely information on
which to base your response decisions.

Not Achieved Achieved

At least one of the following statements is true All the following statements are true

Inadequate arrangements have been made to You understand the resources that will likely be
make the right resources available to implement needed to carry out any required response activities,
your response plan. and arrangements are in place to make these resources
available.
Your response team members are not equipped
to make good response decisions and put them You understand the types of information that will likely
into effect. be needed to inform response decisions and
arrangements are in place to make this information
Inadequate back-up mechanisms exist to allow available.
the continued operation of your essential
function(s) during an incident. Your response team members have the skills and
knowledge required to decide on the response actions
necessary to limit harm, and the authority to carry
them out.
Key roles are duplicated, and operational delivery
knowledge is shared with all individuals involved in the
operations and recovery of the essential function(s).
Back-up mechanisms are available that can be readily
activated to allow continued operation of your
essential function(s), although possibly at a reduced
level, if primary network and information systems fail
or are unavailable.
Arrangements exist to augment your organisation’s
incident response capabilities with external support if
necessary (e.g. specialist cyber incident responders).

38 of 40
D1.c Testing and Exercising
Your organisation carries out exercises to test response plans, using past incidents that affected your (and
other) organisation, and scenarios that draw on threat intelligence and your risk assessment.

Not Achieved Achieved

At least one of the following statements is true All the following statements are true

Exercises test only a discrete part of the process Exercise scenarios are based on incidents experienced
(e.g. that backups are working), but do not by your and other organisations or are composed
consider all areas. using experience or threat intelligence.
Incident response exercises are not routinely Exercise scenarios are documented, regularly
carried out or are carried out in an ad-hoc way. reviewed, and validated.
Outputs from exercises are not fed into the Exercises are routinely run, with the findings
organisation's lessons learned process. documented and used to refine incident response
plans and protective security, in line with the lessons
Exercises do not test all parts of the response learned.
cycle.
Exercises test all parts of your response cycle relating
to your essential function(s) (e.g. restoration of
normal function(s) levels).

Principle D2 Lessons Learned

When an incident occurs, steps are taken to understand its root causes and to ensure appropriate
remediating action is taken to protect against future incidents.

D2.a Incident Root Cause Analysis

When an incident occurs, steps must be taken to understand its root causes and ensure appropriate
remediating action is taken.

Not Achieved Achieved

At least one of the following statements is true All the following statements are true

You are not usually able to resolve incidents to a Root cause analysis is conducted routinely as a key
root cause. part of your lessons learned activities following an
incident.
You do not have a formal process for investigating
causes. Your root cause analysis is comprehensive, covering
organisational process issues, as well as
vulnerabilities in your networks, systems or software.
All relevant incident data is made available to the
analysis team to perform root cause analysis.

39 of 40
D2.b Using Incidents to Drive Improvements
Your organisation uses lessons learned from incidents to improve your security measures.

Not Achieved Achieved

At least one of the following statements is true All the following statements are true

Following incidents, lessons learned are not You have a documented incident review
captured or are limited in scope. process/policy which ensures that lessons learned
from each incident are identified, captured,
Improvements arising from lessons learned and acted upon.
following an incident are not implemented or not
given sufficient organisational priority. Lessons learned cover issues with reporting, roles,
governance, skills and organisational processes as
well as technical aspects of network and
information systems.
You use lessons learned to improve security
measures, including updating and retesting
response plans when necessary.
Security improvements identified as a result of
lessons learned are prioritised, with the highest
priority improvements completed quickly.
Analysis is fed to senior management and
incorporated into risk management and continuous
improvement.

40 of 40