CAF Principle A1: Governance
CAF principle A1 asks whether cyber security is really led from board level, with clear roles and sound risk decisions. It matters for the Cyber Security and Resilience Bill (CSRB) because regulators can test the same governance when assessing whether security duties are met.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What A1 asks
Principle A1 sits at the top of the National Cyber Security Centre's Cyber Assessment Framework (CAF). It asks whether management policies, processes and procedures govern how you secure the systems behind your essential functions. For organisations preparing for the Cyber Security and Resilience Bill (CSRB), it is often the first place to look because weak governance tends to explain weaknesses elsewhere.
It has three contributing outcomes:
| Outcome | The question it asks |
|---|---|
| A1.a Board Direction | Is security led at board level and expressed in clear policy? |
| A1.b Roles and Responsibilities | Are the right roles filled, with time, authority and resources? |
| A1.c Decision-making | Are risk decisions delegated, escalated and justified properly? |
All three are rated only as achieved or not achieved, so there is no partial credit.
The test is whether the board can actually discuss it
A1.a is not met by a cyber item appearing on an agenda. The framework looks for regular discussion based on timely, accurate information and expert guidance. The board also needs enough understanding to discuss what a compromise would do to your essential functions.
One indicator is easily overlooked: senior management or other groups treating themselves as exempt from policy counts against you.
What can show it
These are our suggestions, not NCSC requirements:
- Board minutes showing recurring discussion, questions asked and decisions taken
- A named board-level accountable person, with the accountability written into their role
- A board report tying cyber risk to named essential functions rather than only listing tool metrics
- A role map showing who holds each security responsibility, reviewed on a set cycle
- A written risk appetite specific enough to guide a real decision
- A delegation scheme and a sample of risk decisions with their reasoning and review dates
Where organisations fall short
The framework names several warning signs that are useful to test yourself against:
- Vague risk appetite: decision-makers understand it only as "averse" or "cautious".
- Everything is amber: priorities are too similar to tell risks apart.
- Decisions in silos: engineering and IT do not talk to each other about risk, for example.
- Decisions pushed upwards: straightforward risk calls keep being referred up the chain, or never get made.
- Responsibility without authority: staff are given security duties but not the authority or resources to carry them out.
How A1 relates to the Bill
The text of the Bill as brought from the Commons does not name the CAF, and the CAF is not itself legislation. Its security duties use broader language: relevant managed service providers, for example, must take appropriate and proportionate measures under regulation 14B. Regulators may still use the CAF as a way of judging that, so A1 evidence is worth having ready.
Governance also has direct practical uses under the Bill. Reporting deadlines of 24 and 72 hours leave little time to work out who may decide whether an incident is reportable, or who may sign off a notification. A1.c is where that authority should be settled in advance. Registration details for RMSPs also include directors' names, and changes must be notified within seven days, so someone needs to own keeping them current.
Next, read CAF 4.0 explained, the CAF self-assessment guide and our overview of the framework.
Sources
Frequently asked questions
The achieved indicators for A1.a include a board-level individual with overall accountability for the security of network and information systems, who drives regular discussion at board level.
Not on its own. A CISO can inform and advise, but A1 looks for ownership at board level, informed discussion and clear delegation of decisions across the organisation.
No. In CAF 4.0, A1.a, A1.b and A1.c are each rated either achieved or not achieved.
The Bill as brought from the Commons directs penalties at the regulated organisation. Check the final Act, because Parliament has debated personal liability.