The Cyber Assessment Framework (CAF) is a mechanism developed by the NCSC in 2018 for overlooking the security of operations, in which they meet NIS regulations by supporting the CNI requirements. [1] Although the tool is mainly used by the CNI, they can be used by other organizations as well. [2] The main purpose of the CAF is to introduce councils to efficient cybersecurity practices in order to let them understand about where their security stands in a cybersecurity inspection. [3] This allows the councils to understand managing their own cybersecurity, and what improvements to make upon their protection. Since the EU had to introduce the NIS Directive into the national legislation of every state, the CAF applies to any organization that resides under the territory that applies to this rule, while other countries that adopted their own cybersecurity law wouldn't have to follow this law. [4]
The CAF is also used by local government in order to create effective standards in regards to reinforcing protection against cyber threats. [5] By accessing the framework, the local government will boost their cybersecurity measures in order to protect the users, and also set new cyber protection standards for their department. [6]
The CAF has four objectives that are applied to managing the assessment of an organization's cyber resilience, which help reveals the weak points of one's cybersecurity and how that could be improved on. Individuals are able to read the list of free resources from the NCSC Toolkit in order to seek guidance on how to improve their security measures and their ability to react to a cyber attack event.
Each principle of the CAF comes with a Contributing Outcome that leads to a total of 39 Contributing Outcomes in total based on how an organization tries to "achieve" the objective. Each outcome is marked with an Indicator of Good Practice (IGP), which is a key part of judging how an organization's cybersecurity is assessed. After the assessment is completed, the organization creates a roadmap that includes the required improvements needed for their cybersecurity.
The CAF has fourteen principles, which are divided into four objectives to follow: [7]
Objective A focuses on the availability of process and policies that are able to handle security risks that will possibly affect your essential functions. [8] With the available processes and policies in place, the security risks are able to be inspected, and assessed to help the organization know what part of the security to improve on. Once the assessment is completed, if the organization succeeds in this objective, they possess the sufficient elements for ensuring significant analysis of cyber threats that will affect parts of the organization's service like information systems of devices and the network used to host the service, efficient knowledge for analysis on how to deflect cyber attacks, and risk assessments that are up-to-date to provide information on recent cyber threats that are considered advanced. [9]
Objective B focuses on the security measures that an organization has, in which it will assess where it is placed in the system and how they have it ready to protect any important service that is running from cyber threats. [10] Different security measures like honey pots, firewalls, data security, and many other kinds of security measures are effective in defending against cyber attacks. With the completion of this objective in an assessment, the organization's security defense are present at all times in order to prevent a cyber breach of service from occurring at any time.
Objective C assesses on how reactive people are when maintaining security measures and the security's ability to perceive patterns of cyber events that will indicate a possible disruption to any essential functions in an organization's possession. [10] A cyber attack will reveal patterns that are indicators for security measures to point out. With the achievement of this objective during the assessment, the organization proves their ability in perceiving an upcoming cyber attack that will disrupt or damage any important part of an organization's service when all security measures result in failure on their part. [11]
Objective D focuses on how an individual will respond to a cyber attack after their organization was targeted, including how to minimize the damage that was dealt to any essential operations, and how to bring them back after the cyber attack. [10] When the cyber attack starts to recede, an organization or individual has to be able to respond to this kind of situation with the knowledge of how to restore functionality back to an affected service. To mitigate such damages from the cyber attack, the organization should understand what caused this event in order to prevent a similar attack from affecting their services again.
These four objectives cover the main cores of cyber resilience for many organizations to follow in order to improve cybersecurity measures and resilience against cyber attacks. The objectives are designed to support each other, which means that if one objective isn't active, then the rest of the objectives won't work properly. [12] Although the framework is incredibly similar to the categories of controls, created by ISO 27001, they aren't exactly identical as categories of control focuses on the different types of controls, while the CAF is an assessment focused on improving cybersecurity measures for other establishments.
Each of these are linked to "outcomes" and "contributing outcomes". There are a total of 14 outcomes and 39 contributing outcomes. NCSC has published Indicators of Good Practice; IGP tables can be used to assess whether each objective has been "Achieved", "Not achieved", or "Partially achieved". Organizations are expected to self-assess, and to draw up an improvement roadmap. Competent Authorities review the assessment and the roadmap.
Contributing outcomes are linked to the assessment of each principles of the CAF, in which they have about 39 contributing outcomes in total. Each of those outcomes are indicated with an Indicator of Good Practice (IGP), which are indicators to how an organization's cybersecurity is assessed, to judge whether the contributing outcome has been "Achieved", "Partially Achieved", or "Not Achieved." [13] This will judge whether or not the cybersecurity practices that an organization has used would be considered good or bad practice of cybersecurity. According to Vilnius Tech, the IGPs come in the form of checklists that are convenient for authority to use when reviewing the cybersecurity and cyber resilience of one's organization. [14] Any organization under review are to create a roadmap for improvements to make as they self assess their security, in which any authority that inspect their system are to review both the assessment and the improvement roadmap.
This process is used by GovAssure to review the cybersecurity of government departments, organizations, and companies to ensure cybersecurity competence across all organizations to protect users and their services from harm. [15]
{{cite journal}}: CS1 maint: unflagged free DOI (link){{cite web}}: CS1 maint: url-status (link)