CAF Principle A2: Risk Management

What A2 asks

The National Cyber Security Centre's Cyber Assessment Framework (CAF) uses A2 to ask whether you identify, assess and understand security risks to the systems supporting your essential functions. For the Cyber Security and Resilience Bill (CSRB), this matters because the duties are risk-based rather than a fixed control list.

Outcome	Focus	Ratings
A2.a Risk Management Process	Effective internal process, and clear communication of results	Not, partially or achieved
A2.b Understanding Threat	Attacker capabilities, methods and likely targets	Not, partially or achieved
A2.c Assurance	Justified confidence in security	Not achieved or achieved

A2.b: thinking like the attacker

The NCSC says CAF v4.0 adds a new section on attacker methods and motivations. At the achieved level, A2.b goes well beyond listing threats. It expects:

1. Detailed threat analysis in the context of your sector and wider national infrastructure
2. A view of your systems from an attacker's perspective, with plausible scenarios
3. An understanding of the steps a capable, well-resourced attacker would need to reach a likely target
4. Justified measures that could reduce the attacker's chances at each step
5. Current threat knowledge, for example through threat intelligence and research
6. Documented steps for doing this analysis

The partially achieved level focuses on common attacks. Decide which level your regulator or sector profile expects before investing heavily.

What can show it

These are our suggestions, not NCSC requirements:

• A written set of threat assumptions, with dates and the sources behind them
• Attack path models for your most important essential functions
• Risk assessments showing a clear line from a threat, through impact, to security requirements
• A record of reassessment triggered by events such as a system replacement or a new technology
• Assurance reports, such as penetration tests, with findings tracked through to resolution
• A short note explaining why each assurance method was chosen and what it cannot tell you

Where organisations fall short

• One-off assessments: done for a project or audit and then not revisited.
• Systems assessed in isolation: dependencies, such as those between IT and OT, are ignored.
• Reports nobody can use: outputs are too complex for decision-makers.
• Risks stuck on the register: they wait a long time for a senior decision or resources.
• Silver bullets: one product or service is assumed to solve the problem.
• No known problems, so no problem: assurance is assumed from the lack of incidents.

The achieved level of A2.a also expects you to anticipate technological developments that could be used against your systems, and it treats new or emergent technology as a trigger for updating risk assessments.

How A2 relates to the Bill

Taking the managed service provider duty as an example, regulation 14B requires measures appropriate to the risk posed, having regard to the state of the art, and regard to Information Commission guidance. The Bill's text does not name the CAF, and the CAF is not itself legislation, but a documented risk process is a natural way to explain why your measures are appropriate.

The reporting test also relies on this work. Deciding whether an incident is significant means considering likely disruption, users, duration and data, and that is much faster if you have already worked out how harm could arise.

Next, read CAF 4.0 explained, the CAF self-assessment guide and our overview of the framework.

Sources

• NCSC Cyber Assessment Framework 4.0 (PDF)
• NCSC CAF collection
• NCSC blog: CAF v4.0 released in response to growing threat
• Cyber Security and Resilience Bill as brought from the Commons, HL Bill 32 (PDF)