CAF Principle C1: Security Monitoring
CAF principle C1 asks whether you monitor your essential systems well enough to spot signs of an incident, from logging and alerting through to triage and analyst skills. Under the Cyber Security and Resilience Bill (CSRB), detection and triage feed directly into the decision to report.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What C1 asks
C1 is the largest principle in the National Cyber Security Centre's Cyber Assessment Framework (CAF), with six contributing outcomes. For the Cyber Security and Resilience Bill (CSRB), it matters because you can only report an incident you have noticed and understood.
| Outcome | Short version |
|---|---|
| C1.a Sources and Tools | Do you collect the right data, and can you use it? |
| C1.b Securing Logs | Can logs be trusted and are they protected? |
| C1.c Generating Alerts | Does evidence reliably become an alert? |
| C1.d Triage | Do you handle and contextualise alerts well? |
| C1.e Personnel Skills | Do people have the skills, context and capacity? |
| C1.f Behaviour and Threat Intelligence | Do you know what normal and adverse activity look like? |
The NCSC says CAF v4.0 updates security monitoring and threat hunting to improve threat detection.
Questions worth asking your team
Can you see it? At partially achieved, you monitor traffic crossing the network boundary and some user and system activity. The achieved level expects host-based and network monitoring, extensive user and system monitoring, and all new systems considered as potential log sources.
Can you trust the logs? The achieved level keeps master copies unaltered, traces actions on logs to a unique user or system, and detects and attributes changes. The logging architecture should be able to protect itself from the threats it is trying to find.
Can logs be correlated? Without an accurate common time source, combining datasets becomes difficult. That is a warning sign under C1.a.
Is it near real time? At the achieved level of C1.c, logs are monitored continuously in near real time. At partially achieved, regular intervals are acceptable.
Is the team coping? Under C1.e, personnel overwhelmed by data and alerts, or suffering alert fatigue, count against you.
What can show it
These are our suggestions, not NCSC requirements:
- A log source register mapped to systems supporting essential functions, showing gaps
- Detection rules mapped to the threats identified under A2.b
- Records of testing alerts and tuning false positives
- Playbooks for plausible use cases, with review dates
- Triage records showing category, priority, actions and improvements
- Analyst workload figures and role descriptions, including outsourced staff
- Feedback provided to threat intelligence providers or sector partners
Where organisations fall short
- Logs collected but not usable: tools use only a fraction of the data being gathered.
- Off-the-shelf only: alerts depend entirely on default tooling or users reporting problems.
- Unclear retention: you do not know where logs are stored, or for how long.
- Analysts without context: they do not know which assets relate to essential functions.
- Unactioned intelligence: threat information is unreliable, or not acted on in time.
How C1 relates to the Bill
The Bill's text does not name the CAF, and the CAF is not itself legislation. C1 is still closely linked to the reporting duties, as the deadlines start when you are first aware that a reportable incident has occurred or is occurring.
That makes the handover from triage to decision-making important. Decide in advance who can declare that an event may be reportable, how they are reached, and how the time and reasoning are recorded. C1.d's expectation of documented triage gives you a natural place to keep those records, and C1.e includes following procedures for reporting requirements, internal and external.
Logs can also support a full notification, which covers when an incident occurred, its duration and its nature, so far as known.
Next, read CAF 4.0 explained, the CAF self-assessment guide and our overview of the framework.
Sources
Frequently asked questions
Six: C1.a Sources and Tools for Logging and Monitoring, C1.b Securing Logs, C1.c Generating Alerts, C1.d Triage of Security Alerts, C1.e Personnel Skills for Monitoring and Detection, and C1.f Understanding User’s and System’s Behaviour, and Threat Intelligence.
C1 does not simply say you need a 24/7 SOC. At the achieved level of C1.c, logs are monitored continuously in near real time. How you deliver that, in-house or outsourced, is up to you, but C1.e applies to outsourced personnel too.
Yes. C1.e explicitly refers to personnel skills and roles, including those outsourced. They still need enough knowledge of your systems and essential functions.
C1.b expects you to define and implement retention periods, but the framework does not fix a single number. Base yours on your investigation needs and any other obligations.