How to Enhance Cyber Resilience with the Cyber Assessment Framework

January 23, 2025

Cyber incidents present a significant risk to your operations, your safety, your reputation, and your bottom line.
Pramudi Perera outlines how organisations subject to the Network and Information (NIS) Regulations can use the Cyber Assessment Framework (CAF) to safeguard business-critical Operational Technology (OT).

What is CAF?
The Cyber Assessment Framework, developed by the UK’s National Cyber Security Centre (NCSC), provides a systematic and outcome-driven approach to evaluate and increase cyber resilience in companies. Designed to handle risks to key functions, CAF v3.2 is a comprehensive platform that blends governance, risk management, protection, and response capabilities to minimise cyber threats efficiently. The foundation of CAF consists of four overarching objectives, each of which incorporates a number of guiding principles that help organisations achieve quantifiable results.

What are the four CAF Objectives?

Objective A: Managing Security Risk

This goal highlights how crucial proactive risk management is to safeguard critical operations. Organisations can guarantee they detect and address vulnerabilities before they are exploited by applying a comprehensive approach to security risk management. The following principles form the foundation:

  1. Governance (A1): The board level is where security leadership demands to start. Senior management should own and guide an organization’s cyber security policies. The groundwork for efficient risk governance is laid by regular board-level engagement guided by professional advice. The organisation should establish roles and responsibilities with senior-level accountability for security networks and information systems for clear communications and risk escalations.

  2. Risk Management (A2): Procedures that are effective must recognise, evaluate, and rank the risks to critical systems. Risk assessments should be dynamic, taking into account changes in the environment, operations, and technology as well as new threat intelligence. The organisation should achieve the security assurance of its technology, personnel, and procedures for its primary functions.

  3. Asset Management (A3): Every asset that is essential to an organization’s operations, such as data, systems, and infrastructural dependencies, must be kept up to date. Proper asset lifecycle management is ensured through the assignment of distinct duties.

  4. Supply Chain (A4): It’s critical to identify and reduce risks associated with third-party suppliers. Companies should put policies in place to protect contacts with third parties, uphold security commitments in contracts, and evaluate the resilience of their supply chains.

Objective B: Protecting Against Cyber Attacks

The defensive actions necessary to safeguard network and information systems are the main emphasis of the objective. With a knowledgeable workforce and robust defensive procedures, Objective B establishes the foundation for preventing attacks. Among the core principles are:

  1. Service Protection Policies and Processes (B1): In order to safeguard systems, organisations should create, implement, and uphold policies. To promote adherence, these need to be easy to use and adapt to significant events or changes in the law.

  2. Identity and Access Control (B2): Users, devices, and systems must be verified, authenticated and authorised via strong mechanisms. The principles of least-privilege and multi-factor authentication (MFA) are essential and access to company network and information systems must be allowed for known trusted devices, where identity and access management rules are in place.

  3. Data Security (B3): It’s crucial to safeguard important data while it’s being stored, transported, and on mobile devices. Businesses should minimise needless data replication, sanitise data before reusing it, and keep safe backups.

  4. System Security (B4): Information and network systems need to be set up and developed safely. Attack chances are reduced by practices like vulnerability management, secure setups, and system segregation.

  5. Resilient Networks and Systems (B5): Systems need to be built to withstand cyberattacks and malfunctions. Redundancy procedures, recovery testing, and backup plans are crucial.

  6. Staff Awareness and Training (B6): Employees at all levels are ready to recognise and reduce risks when there is a strong cyber security culture and specialised training.

Objective C: Detecting Cyber Security Events

Timely reactions are ensured by early detection of cyber issues. The methods and resources needed for effective security monitoring are described in this objective. Organisations may prevent hazards from getting worse by putting in place strong detection capabilities, which will guarantee that vital operations continue.

  1. Security Monitoring (C1): In order to identify risks, organisations need to keep track of network activities using data sources that thoroughly cover essential functions. Logging Indicators of Compromise (IoCs) and comprehending unusual behaviours should be part of detection skills. Logs need to be kept in a secure location that only authorised staff can access. Integrity is ensured by tracking log access and synchronising it with a precise time source. Security incident evidence should be consistently identified via alerts generated by monitoring systems. Setting priorities guarantees that important events that impact vital operations are attended to promptly.

  2. Proactive Security Event Discovery (C2): To distinguish real incidents from false alarms, alerts need to be contextualised using threat intelligence and system knowledge. The efficacy of detection is increased by timely upgrades to defences like antivirus signatures and IoCs.

Objective D: Minimising the Impact of Cyber Security Incidents

Although incidents are unavoidable, their effects can be reduced with proper planning, maintaining stakeholder trust and operational integrity. Making sure organisations can react to incidents efficiently and bounce back fast is the main goal of this objective. Among its principles are:

  1. Response and Recovery Planning (D1): Comprehensive plans for disaster recovery and business continuity must encompass every aspect required to restore critical operations. Regular exercises such as table-top scenarios and red-teaming should be used to test plans.

  2. Lessons Learned (D2): Organisations can enhance their reaction skills and find defence weaknesses by conducting post-incident reviews. Resilience across the sector is promoted by sharing learning with stakeholders. Actions must be taken to identify root causes, remediate action tracking, and enhance security measures.

Conclusions
Indicators of Good Practice (IGPs) are the foundation of the Cyber Assessment Framework (CAF), acting as standards to direct evaluations for every principle. By classifying these indicators as “Achieved,” “Partially Achieved,” or “Not Achieved,” an organised yet adaptable method of assessing organisational performance is offered. IGPs promote expert judgement in contrast to strict checklists, enabling assessments to be tailored to particular organisational situations. IGPs promote focused improvement efforts that comply with best practices and legal requirements by recognising both strengths and weaknesses.

The CAF V 3.2 is a comprehensive and adaptable instrument for evaluating and constructing cyber resilience. Organisations can build defences, identify dangers, and recover from incidents with the help of their well-defined aims and guiding principles. Whether applied for internal development or regulatory compliance, CAF prepares businesses to handle the difficulties posed by a growingly complex cyber environment.

Taking a step further, Enhanced Cyber Assessment Framework (eCAF) by NCSC which will require compliance by 2028 focuses on strengthening the security and resilience of critical national infrastructure (CNI). This faces significant challenges posed by heavy reliance on legacy operational technology (OT) systems and lack of expertise of operational technology and industrial control systems (OT/ICS).