CAF Principle B1: Service Protection Policies, Processes and Procedures
CAF principle B1 asks whether your security policies, processes and procedures are practical, followed and effective, not just written down. Under the Cyber Security and Resilience Bill (CSRB), a policy nobody follows will not help show that your security measures are appropriate.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What B1 asks
B1 opens the protective objective in the National Cyber Security Centre's Cyber Assessment Framework (CAF). Its full name is Service Protection Policies, Processes and Procedures. For organisations preparing for the Cyber Security and Resilience Bill (CSRB), its main lesson is that having documents is only the first step.
| Outcome | Asks | Warning sign |
|---|---|---|
| B1.a Development | Do you have a practical, improving set of policies? | People routinely bypass them to get work done |
| B1.b Implementation | Are they followed, and do they deliver security benefit? | No attempt to detect breaches |
Design for how people really work
B1.a repeatedly returns to whether a policy is usable. Policies that are hard to find, too detailed to remember or too hard to understand count against you. At the achieved level, procedures that rely on user behaviour must be practical and achievable, and systems should remain secure even when people do not always follow them.
That changes the question from "have we told people?" to "what happens when somebody makes a mistake?" If a single missed step can expose an essential function, the design needs fixing as much as the training does.
Reviews need real triggers
The partially achieved level expects a review after major incidents. The achieved level adds regular review intervals and treats changes to the essential function or the threat as triggers. A major technology or regulatory change without a review is itself a warning sign, so the Bill passing into law is an obvious moment to look again.
What can show it
These are our suggestions, not NCSC requirements:
- A policy map tied to essential functions, with owners and last and next review dates
- A review log recording what triggered each change
- Key performance indicators reported to executive management, which the achieved level expects
- Policy exception records, with reasons, approvals and expiry dates
- Records of investigated breaches, along with trend analysis of smaller ones
- Short staff surveys or interviews testing whether people know their responsibilities
Where organisations fall short
- Copied templates: the governance and risk approach has no real bearing on the policy.
- Uneven application: policies are not applied universally or consistently.
- Isolated security policies: they are not joined up with HR and other organisational procedures.
- Unmeasured compliance: nobody can show that policies are followed, or that they work.
- Ignored small breaches: the achieved level expects action on aggregated breaches too.
How B1 relates to the Bill
The Bill's text does not name the CAF, and the CAF is not itself legislation. Its duties are expressed in terms of measures. For relevant managed service providers, regulation 14B requires appropriate and proportionate measures to manage risk, and regard to any relevant Information Commission guidance.
That makes B1 useful in two ways. First, written and followed procedures are a practical way to show what your measures are if a regulator asks. Second, the Bill adds specific new procedures you will probably need: 24-hour and 72-hour notifications, copies to the CSIRT, customer notices and keeping registration details current. Each of these needs an owner and a tested process, not simply a paragraph in a policy.
Next, read CAF 4.0 explained, the CAF self-assessment guide and our overview of the framework.
Sources
Frequently asked questions
B1.a Policy, Process and Procedure Development, and B1.b Policy, Process and Procedure Implementation. The first covers creating and improving them, and the second covers whether they work in practice.
The framework does not set a fixed number. At the achieved level it expects suitably regular reviews, as well as reviews after a major incident and when the essential function or threat changes.
The achieved level says systems should be designed to remain secure even when user procedures are not always followed. Relying entirely on careful manual behaviour counts against you.
Yes. Policies should be integrated with other organisational policies, including HR assessments of individuals’ trustworthiness.