CAF Principle D1: Response and Recovery Planning
CAF principle D1 asks whether you have a tested plan and the capability to limit harm and keep essential functions running during an incident. Under the Cyber Security and Resilience Bill (CSRB), that plan should also include regulator notifications, CSIRT copies and customer notices.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What D1 asks
D1 in the National Cyber Security Centre's Cyber Assessment Framework (CAF) asks whether you are ready for the moment prevention and detection are not enough. For organisations preparing for the Cyber Security and Resilience Bill (CSRB), it is the natural home for the new reporting duties.
| Outcome | Ratings | Short version |
|---|---|---|
| D1.a Response Plan | Not, partially or achieved | An up-to-date plan based on risk, covering a range of scenarios |
| D1.b Response and Recovery Capability | Not achieved or achieved | People, information and back-up arrangements to carry it out |
| D1.c Testing and Exercising | Not achieved or achieved | Realistic exercises feeding into improvements |
The plan needs to survive the incident
The partially achieved level of D1.a makes a practical point: the plan must be accessible even when your IT systems are affected. If it sits on a file share that ransomware has just encrypted, or the only contact list is in your email system, it may not help when you need it.
The achieved level expects the plan to be integrated with wider business plans, supply chain response plans and dependencies such as power and cooling. It should also cover possible attacks you have not seen before.
Capability is more than a document
D1.b is about whether you can really carry out the plan. Key points include:
- Team members have the skills, knowledge and authority to act
- Key roles are duplicated, so one person's absence does not stop the response
- Back-up mechanisms can be activated to keep essential functions running, possibly at a reduced level
- You have arrangements for external support, such as specialist incident responders
- You know what information will be needed for decisions, and how to get it
Exercising
D1.c expects scenarios based on real incidents, experience or threat intelligence, run routinely, and testing all parts of the response cycle, including restoring normal function. Findings should be documented and used to improve both the plan and protective security.
A short exercise based on the Bill could be: "It is 6pm on a Friday. An analyst has found signs of compromise on a customer-facing platform. Who decides whether this is reportable, who sends the notification, and how do you find out which customers to tell?" This scenario is our suggestion, not an NCSC one.
What can show it
These are our suggestions, not NCSC requirements:
- The plan, version history and evidence of an offline or independent copy
- Records of who has read or been briefed on it
- A deputy list for each key role
- A retainer or agreement with an external incident responder
- Exercise reports with resulting actions and completion dates
Where organisations fall short
- Essential functions missing: the plan does not refer to them at all.
- Known attacks only: the plan does not extend beyond familiar scenarios.
- Ad-hoc exercises: they are irregular, or results do not reach the lessons learned process.
- Single points of knowledge: too few people know how to operate or recover a service.
How D1 relates to the Bill
The Bill's text does not name the CAF, and the CAF is not itself legislation. Its reporting duties should still shape your plan. Include:
- An initial notification within 24 hours of first being aware of a reportable incident
- A full notification within 72 hours of that same moment
- A copy of each notification to the CSIRT at the same time
- Customer notices where they apply: RMSPs, RDSPs and data centres must notify UK customers likely to be adversely affected, as soon as reasonably practicable after the full notification
Any regulator direction to inform the public is also worth planning for.
Next, read CAF 4.0 explained, the CAF self-assessment guide and our overview of the framework.
Sources
Frequently asked questions
At the achieved level it covers the complete lifecycle of an incident, roles and responsibilities, and reporting. It addresses both known attack patterns and possible attacks not seen before, and links to wider business and supply chain plans.
The partially achieved level expects the plan to be readily accessible even when your IT systems have been adversely affected by an incident. An offline or separately hosted copy is one way to do that.
No. Testing only a discrete part of the process, such as whether backups work, is a warning sign. Exercises should test all parts of the response cycle, including restoring normal function.
The sections we reviewed set notification duties rather than an explicit exercise rule. Practising your response is still a sensible way to check you can meet the 24-hour and 72-hour deadlines.