CAF Principle C2: Threat Hunting
CAF principle C2 asks whether you actively look for adverse activity that your normal security tools miss, or where they cannot be deployed. Under the Cyber Security and Resilience Bill (CSRB), a hunt could also uncover an incident that needs reporting, so hunters need a clear escalation route.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What C2 asks
C2 has a single outcome, C2.a Threat Hunting, within the National Cyber Security Centre's Cyber Assessment Framework (CAF). It assumes that automated tools can miss things and cannot be deployed everywhere. For those preparing for the Cyber Security and Resilience Bill (CSRB), it is one of the more demanding parts of the framework.
The NCSC lists threat hunting among the areas updated in CAF v4.0.
How the levels differ
| Not achieved | Partially achieved | Achieved | |
|---|---|---|---|
| Resources | Requirements unknown | Identified, deployed occasionally | Deployed as business as usual |
| Frequency | Not applicable | Not frequent enough for the risk, for example after a tip-off | Matches the risk |
| Method | Unstructured, with few records | Documented methods | Documented methods aimed at activity automated detection misses |
| Follow-through | Little or none | Records of hunts and post-hunt analysis | Hunts become detections and drive improvement |
| Focus | Not applicable | Not specified | Attacker tactics, techniques and procedures over simple indicators |
This table condenses the framework's wording, so read the full text before self-assessing.
What a hunt looks like
The framework names hypothesis-driven, data-driven and entity-driven methods. A worked example of the hypothesis-driven approach, using our own illustration:
- Start with a credible idea: "An attacker with stolen supplier credentials is using legitimate admin tools to move between systems."
- Decide what data would show it: remote administration logs, authentication events, process execution records.
- Search and investigate: look for unusual combinations of account, time, source and tool.
- Record the result: note what you tested and how, even if you found nothing.
- Turn it into a detection: if the pattern can be automated, add an alert.
The focus on tactics rather than atomic indicators is important. File hashes and IP addresses change easily, whereas patterns of behaviour are harder for an attacker to change.
What can show it
These are our suggestions, not NCSC requirements:
- A threat hunting plan, with frequency justified by your risk assessment
- Hunt records showing hypothesis, data used, findings and follow-up
- New automated detections that came directly from a hunt
- Links from hunting topics to your threat analysis under A2.b
- A record of how the hunting process has been reviewed and improved
- Notes on areas where standard tools cannot be deployed, and how you hunt there
Where organisations fall short
- Calling alert review a hunt: working through alerts is C1 activity, not proactive hunting.
- Hunting only on tip-offs: purely reactive hunting does not match the achieved level.
- Insufficient data: logs do not go back far enough or lack the required detail.
- No lasting benefit: findings do not improve detection or wider security.
How C2 relates to the Bill
The Bill's text does not name threat hunting or the CAF, and the CAF is not itself legislation. There is still a practical link. If a hunt finds a compromise that meets the reporting test, the 24-hour and 72-hour periods run from when the organisation is first aware that a reportable incident has occurred or is occurring.
Give hunters a route straight to whoever makes that decision, and record when each step took place. Full notifications also cover when the incident occurred and its duration, so far as known, so historic log data can help you answer those questions.
Next, read CAF 4.0 explained, the CAF self-assessment guide and our overview of the framework.
Sources
Frequently asked questions
C2.a is a contributing outcome in CAF 4.0. What rating you need depends on the target profile your regulator or sector applies, so check that before deciding how much to invest.
C1 covers security monitoring and alerts, largely from known sources and detections. C2 proactively looks for adverse activity even when it evades standard detection or those tools cannot be deployed.
The framework does not set a frequency. At the achieved level, threat hunting is business as usual, at a frequency that matches the risks posed to your systems.
C2 does not rule it out. It does expect you to understand the resources needed and to have access to an effective capability, with documented methods and records.