CAF Principle D2: Lessons Learned
CAF principle D2 asks whether you find out why incidents happened and make real improvements afterwards, including from near misses. Under the Cyber Security and Resilience Bill (CSRB), that analysis can also support notifications and show how you are managing risk over time.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What D2 asks
D2 closes the National Cyber Security Centre's Cyber Assessment Framework (CAF) and feeds back into everything before it. It has two outcomes, each rated achieved or not achieved. For the Cyber Security and Resilience Bill (CSRB), it helps turn an incident from a one-off emergency into a record of improvement.
| Outcome | Short version |
|---|---|
| D2.a Post Incident Analysis | Understand the causes, informing the right action |
| D2.b Using Incidents to Drive Improvements | Actually make the improvements |
Look beyond the technical cause
D2.a expects analysis to consider four areas:
| Area | Example question (our illustration) |
|---|---|
| Organisational | Did a policy or process make the problem more likely? |
| Technical | Did system design or a vulnerability play a part? |
| Human | Did training or security culture contribute? |
| Threat | Has anything changed about the threat? |
An investigation that stops at "an analyst clicked the link" misses most of this. The framework specifically warns against investigations focused only on who to blame, and against investigators forming an early theory and then only looking for evidence that supports it.
Analysis also needs access to all relevant incident data. If evidence was destroyed during recovery, or log retention was too short, that is itself a lesson.
Near misses and what-ifs
D2.b refers to lessons from each incident, including near misses. Combined with what-if analysis, this gets more value from an event that caused little harm. If a backup saved you, ask what would have happened had that backup also failed. The framework also encourages learning from incidents reported in your sector and wider national infrastructure, so you do not need to wait for your own.
Avoid both extremes
D2.b warns about two opposite failures:
- Doing nothing until it is serious: waiting for a severe or high-profile incident before taking steps to improve.
- Knee-jerk changes: reacting quickly without the analysis and testing needed to check the change is appropriate.
Improvements should be prioritised, with the highest-priority items completed promptly, and the analysis should reach senior management and feed into risk management.
What can show it
These are our suggestions, not NCSC requirements:
- A documented incident review process, including when near misses trigger one
- Review reports covering all four areas, with contributing factors rather than one root cause
- An action tracker with owners, priorities, dates and evidence of closure
- Updated and retested response plans after relevant reviews
- Papers showing analysis reaching senior management and the risk register
- Notes on lessons taken from incidents at other organisations
Where organisations fall short
- Lessons not captured: reviews do not happen, or cover too little.
- Actions that drift: improvements are identified but not given enough priority.
- Narrow reviews: reporting, roles, governance and skills are not considered alongside technology.
How D2 relates to the Bill
The Bill's text does not name the CAF, and the CAF is not itself legislation. Note that the CAF's near-miss language does not settle what you must report to a regulator. The Bill has its own tests, and for data centres they include incidents that could have had a significant impact. Treat internal learning and external reporting as separate questions.
Post-incident work can help in other ways. Where an incident was caused by a separate incident affecting another regulated person, a full notification should include those details, so far as known. The record of completed improvements could also help you explain your approach to risk if a regulator later asks.
Next, read CAF 4.0 explained, the CAF self-assessment guide and our overview of the framework.
Sources
Frequently asked questions
Yes. The achieved description of D2.b refers to lessons learned from each incident, including near misses, being identified, captured and acted on.
Yes. An investigation focused solely on finding the people to hold responsible is a warning sign. Analysis should consider organisational, technical and human factors, and changes to the threat.
They look at what could have happened in plausible alternative circumstances. Both D2.a and D2.b use them, which helps you learn more from an event than its actual outcome alone.
No. D2.a and D2.b are rated achieved or not achieved in CAF 4.0.