CAF Principle B6: Staff Awareness and Training
CAF principle B6 asks whether people have the awareness, knowledge and skills to help keep essential systems secure, and whether they feel able to raise concerns. Under the Cyber Security and Resilience Bill (CSRB), a culture of quick reporting supports the short incident deadlines.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What B6 asks
Principle B6 of the National Cyber Security Centre's Cyber Assessment Framework (CAF) has two outcomes: B6.a Cyber Security Culture and B6.b Cyber Security Training. For organisations preparing for the Cyber Security and Resilience Bill (CSRB), it is tempting to treat this as an annual e-learning task. The framework asks for considerably more.
Culture comes first
B6.a looks at how people behave and what they believe. The warning signs are specific:
- People do not know how to raise a cyber security concern.
- People believe reporting an issue may get them into trouble.
- Staff see security as hindering the business, which may encourage poor behaviour.
- Formal or informal incentives conflict with good security outcomes.
The last point deserves particular attention. If a team is rewarded only for speed, and the secure route is slower, people will often choose the faster option. The partially achieved level asks you to identify and address exactly this kind of barrier.
At the achieved level, people are recognised for reporting concerns, management is visibly involved, and teams across the organisation collaborate on security improvements, bringing knowledge of their own areas.
Training has to change behaviour
B6.b expects defined training and awareness activities for all roles, from executives to the most junior, using a range of methods. At the achieved level, every person follows an appropriate training path, each individual's training is tracked and refreshed, and activities are routinely evaluated for effectiveness.
The framework also warns against treating training as a "silver bullet" for all user behaviour. This ties in with B1: if a process relies on perfect human behaviour, redesign the process rather than simply adding more training.
Role-specific needs differ. An example from our own view: a board member needs to understand decisions and accountability, an engineer needs secure administration, and a service desk analyst needs to spot and escalate a possible incident.
What can show it
These are our suggestions, not NCSC requirements:
- A training matrix by role, with completion and refresh dates
- Measures of behaviour, such as phishing report rates and how quickly suspicious events are reported
- Examples of leadership messages about priorities
- Records of staff who raised concerns, including how they were thanked or recognised
- Anonymous culture survey results and the actions taken from them
- An annual review of training materials, checking they do not conflict with policy
Where organisations fall short
- Training only for some: teams operating essential systems have no cyber training at all.
- Attendance as the only measure: no assessment of whether behaviour has changed.
- Poor records: training records are missing or incomplete.
- Outdated content: materials contain old or contradictory information.
- Security as a separate team's job: people do not understand what they contribute.
How B6 relates to the Bill
The Bill's text does not name the CAF, and it does not set general staff training rules in the sections we reviewed. The CAF is not itself legislation. The link is mostly practical.
Reporting periods start when an organisation is first aware that a reportable incident has occurred or is occurring. They are short: 24 hours for an initial notification and 72 hours for a full notification, both from that same moment. If staff do not recognise a possible incident, or are reluctant to say so, the people who decide whether to report lose valuable time.
So add one practical item to your training: who to call, immediately and at any hour, when something looks wrong.
Next, read CAF 4.0 explained, the CAF self-assessment guide and our overview of the framework.
Sources
Frequently asked questions
B6.a Cyber Security Culture and B6.b Cyber Security Training.
No. B6.b warns against measuring success only by the number of people reached without assessing whether behaviour improves.
Yes. Training activities are expected across roles from executives to junior staff, and executive management has a role in communicating security priorities.
B6.a treats people fearing they may get into trouble for reporting issues as a warning sign. Delayed reports reduce your time to respond.