CAF Principle A3: Asset Management
CAF principle A3 asks whether you know everything needed to deliver and support the systems behind your essential functions, including data, people and infrastructure such as power and cooling. Under the Cyber Security and Resilience Bill (CSRB), that knowledge also helps with incident reporting and customer notices.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What A3 asks
A3 has one contributing outcome, A3.a Asset Management, within the National Cyber Security Centre's Cyber Assessment Framework (CAF). It is rated only as achieved or not achieved. For anyone preparing for the Cyber Security and Resilience Bill (CSRB), it can look like basic IT housekeeping, but it goes wider than a list of laptops and servers.
To achieve it, all of these need to be true:
- All relevant assets are identified, inventoried at a suitable level of detail and kept up to date.
- Dependencies on supporting infrastructure, such as power and cooling, are recorded.
- Assets are prioritised by importance.
- Responsibility is assigned for managing them, including physical assets.
- Assets are managed with cyber security in mind from creation to disposal.
Think in services, not hardware
A strong A3 inventory starts from an essential function and works outward. Take one function and ask what would stop it working: which applications, data stores, identity systems, network links, suppliers, facilities and named people. An inventory built from a discovery scan alone will find devices, but it will not tell you what depends on them.
A short example shows the difference. A scan may list a database server. A useful record also shows which service relies on it, who owns it, which cooling and power systems it needs, and who knows how to recover it.
What can show it
These are our suggestions, not NCSC requirements:
- An asset register mapped to essential functions, with owners and priority
- Dependency maps covering IT, OT, facilities and suppliers
- Evidence the inventory is maintained, such as change records and last-reviewed dates
- A data retention schedule covering important and personal data
- A succession or knowledge-sharing plan for critical skills
- Decommissioning and disposal records
Where organisations fall short
The CAF's warning signs point to some common problems:
- Only certain domains or asset types are documented, leaving gaps such as OT or cloud.
- Dependencies between assets, such as between IT and OT, are not understood.
- Information assets are kept for long periods with no clear business need or retention policy.
- Critical knowledge sits with one or two key people and there is no succession plan.
- The inventory has been neglected and is out of date.
Any one of these statements being true is enough for a not achieved rating, so a partial inventory will not get you part of the way there.
How A3 relates to the Bill
The CAF is not itself legislation, and the Bill's text does not name it. A good inventory still supports several things the Bill expects:
- Incident assessment: the significance factors include disruption, users affected and geographical area, all of which are easier to judge when you know what depends on what.
- Full notifications: these include the service affected, and details of the incident's impact so far as known.
- Customer notices: RMSPs, RDSPs and data centres must take reasonable steps to establish which UK customers are likely to be adversely affected. That needs a mapping from systems to customers.
- Data centres: the Bill's definition of a data centre service refers to supporting infrastructure, including electricity and environmental control, which echoes A3's interest in power and cooling.
Next, read CAF 4.0 explained, the CAF self-assessment guide and our overview of the framework.
Sources
Frequently asked questions
The principle covers everything required to deliver, maintain or support the relevant systems, including data, people, systems and supporting infrastructure such as power or cooling.
Yes. One warning sign is critical management, operation or recovery knowledge being held by one or two people with no succession plan.
No. A3.a is rated achieved or not achieved in CAF 4.0.
The framework says assets should be inventoried at a suitable level of detail and kept up to date. Decide the right level from what you need for security and recovery decisions.