CAF Principle B2: Identity and Access Control
CAF principle B2 asks whether you control who and what can reach your essential systems, from authentication and devices to privileged users. It is especially relevant to managed service providers under the Cyber Security and Resilience Bill (CSRB), because access to customer systems is part of what defines them.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What B2 asks
B2 in the National Cyber Security Centre's Cyber Assessment Framework (CAF) covers people, devices and automated functions. It is one of the more technical principles, and it matters for the Cyber Security and Resilience Bill (CSRB) because stolen or misused access is a route into the systems the Bill is meant to protect.
| Outcome | Focus |
|---|---|
| B2.a Identity Verification, Authentication and Authorisation | Confirming who or what is connecting |
| B2.b Device Management | Trusting the devices used for access |
| B2.c Privileged User Management | Closely managing admin access |
| B2.d Identity and Access Management (IdAM) | Maintaining access control across its lifecycle |
How the expectations rise
The difference between rating levels is unusually concrete, which makes B2 a good place for a gap analysis.
| Area | Partially achieved | Achieved |
|---|---|---|
| Strong authentication | For privileged access | For all user access, including remote |
| Access list review (B2.a) | At least annually | At least every six months |
| Privileged operations | Corporately managed devices with suitable separation | Highly trusted devices, such as dedicated Privileged Access Workstations |
| Privileged rights | Known, managed and limited to role | Separate monitored accounts and temporary, time-bound rights |
| Access logging | Logged and monitored | Logs reviewed and correlated, with unauthorised attempts alerted and investigated |
These are condensed from the framework, so check the full wording for your assessment.
What can show it
These are our suggestions, not NCSC requirements:
- Authentication policy settings and exception lists, not just the policy document
- Dated access reviews, with the removals that resulted
- A privileged account inventory that includes third parties
- Samples of joiner, mover and leaver cases traced through to actual changes
- Records of reviewed privileged activity
- Results of scans for unknown devices, with follow-up
Where organisations fall short
- Shared admin accounts: privileged access through generic, shared or default accounts.
- System-wide admin rights: rights granted across a whole system rather than by role or function.
- One account for everything: no separation between a person's roles, such as email and privileged work on the same identity.
- Always-on terminals: a control room terminal can perform privileged actions without added controls.
- Forgotten leavers: access rights stay active after people leave.
- Plug in and connect: physically connecting to a network gives access without device or user authentication.
How B2 relates to the Bill
The Bill's text does not name the CAF, and the CAF is not itself legislation. B2 is still closely linked to one of the Bill's new categories. A managed service, as the Bill defines it, is provided by connecting to or otherwise getting access to network and information systems a customer relies on. That access can be on-site or remote.
So if you are a relevant managed service provider, B2 maps closely onto one of your main risks. Regulation 14B requires appropriate and proportionate measures for the systems you rely on to provide those services. Consider separate administrative identities per customer, time-limited access, and logs that show who reached which customer's systems. Those logs may also help you work out which customers to notify after an incident.
If you are a customer of an MSP, A4 and B2 meet here: supplier access should be known, limited and monitored like your own.
Next, read CAF 4.0 explained, the CAF self-assessment guide and our overview of the framework.
Sources
Frequently asked questions
It refers to additional strong authentication, such as MFA. At partially achieved, this covers privileged access to relevant systems. At achieved, it covers all user access, including remote access.
B2.a expects the list of users and systems with access to be reviewed at least annually at partially achieved, and at least every six months at achieved.
At the achieved level, privileged operations should be carried out from highly trusted devices, such as Privileged Access Workstations, dedicated solely to those operations. Corporately owned and managed devices with suitable separation fit the partially achieved level.
Yes. The principle covers users and automated functions, and B2.d covers access control for users, devices and systems.