CAF Principle B3: Data Security
CAF principle B3 asks whether you protect data that your essential functions depend on, wherever it is stored or travels, including information useful to an attacker. Under the Cyber Security and Resilience Bill (CSRB), data compromise is one of the factors in deciding whether an incident is significant.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What B3 asks
B3 in the National Cyber Security Centre's Cyber Assessment Framework (CAF) protects data from unauthorised access, modification or deletion that could harm essential functions. For the Cyber Security and Resilience Bill (CSRB), it is a useful reminder that some of the most important data may not be personal data at all: configuration, control logic and network diagrams can matter just as much.
| Outcome | Short version |
|---|---|
| B3.a Understanding Data | What it is, where it lives and travels, who can reach it, and what its loss would do |
| B3.b Data in Transit | Which links carry it, and how they are protected and backed up |
| B3.c Stored Data | Where copies are, how they are protected, and whether backups are usable |
| B3.d Mobile Data | Which mobile devices hold it, and whether they are controlled |
| B3.e Media / Equipment Sanitisation | Data removal before reuse or disposal |
Start with impact, not classification
B3.a is the foundation. It expects you to document the impact on essential functions of scenarios such as unauthorised access, uncontrolled release, modification, deletion, or authorised users being unable to reach data. A classification label cannot answer those questions.
Integrity and availability deserve particular attention. Someone seeing data may be bad, but silently changed control parameters or inaccessible records could stop a service. Each may need different protection.
Details that are easy to miss
- Third parties: B3.a also applies to third parties that store or access important data.
- Alternative paths: B3.b treats critical data paths with no alternative route as a warning sign.
- Copies: all copies should be necessary, and data moved to less secure systems should be limited or read-only.
- Remote wipe: at the achieved level you can remotely wipe all mobile devices holding important data.
- Assured sanitisation: the achieved level of B3.e uses an assured product or service and tracks the relevant devices.
What can show it
These are our suggestions, not NCSC requirements:
- A data catalogue listing owner, location, access, links and impact by scenario
- A data flow diagram including suppliers and non-trusted carriers
- Records explaining the confidence you have in your cryptographic protection
- Backup restore test results
- A mobile device inventory and policy settings
- Sanitisation certificates linked to tracked assets
Where organisations fall short
- Partial knowledge: you cannot say what data the systems use and produce.
- Data sprawl: unnecessary copies and historic data remain, especially in test environments and shared drives.
- Unprotected links: important data crosses non-trusted carriers with no technical protection.
- Untested backups: copies are incomplete, untested or unreachable during disaster recovery.
- Unmanaged mobile devices: important data sits on devices you do not manage.
How B3 relates to the Bill
The Bill's text does not name the CAF, and the CAF is not itself legislation. It does draw on similar ideas. When deciding whether an OES, RDSP or RMSP incident is significant, one factor is whether the confidentiality, authenticity, integrity or availability of data relating to users has been or is likely to be compromised.
RMSPs, RDSPs and data centres must also consider whether a customer's data is likely to be compromised when working out whom to notify. If your data catalogue can answer "whose data is on this system?", that work becomes much quicker.
A personal data breach may separately trigger UK GDPR reporting to the Information Commission, so plan for both regimes rather than assuming one report covers both.
Next, read CAF 4.0 explained, the CAF self-assessment guide and our overview of the framework.
Sources
Frequently asked questions
No. It is about data important to the operation of the systems supporting essential functions, including information that would help an attacker, such as design details. Personal data can be part of that, but UK GDPR covers it separately.
At the achieved level of B3.a, documented impact statements should be validated regularly, at least annually. At partially achieved, they are validated occasionally.
Not in every case. It refers to appropriate physical or technical means, such as cryptography. For the achieved level, you should have justified confidence in the protection you apply.
Yes. B3.c refers to stored soft and hard copy data, and backups may include offline or segregated copies or appropriate alternatives such as paper copies.