Update to the NCSC CAF - how v3.1 aims to boost Clarity and Consistency

In its latest release, the Cyber Assessment Framework (CAF) version 3.1 has undergone enhancements to cater to its core users: organisations within the UK Critical National Infrastructure (CNI), entities subject to the Network and Information Systems (NIS) Regulations, and those involved in cyber-related public safety. 

Interestingly, the CAF is increasingly being adopted by a growing number of additional organisations seeking to bolster their cyber resilience and not just those sectors where a loss of service would significantly impact the population. 

Enhancing clarity and consistency 

Language revisions 

One of the primary focuses of the CAF 3.1 update has been to refine the language used within the framework. This endeavour aims to enhance clarity and consistency across various aspects of the CAF. The areas addressed include the Framework's Principles, the Contributing Outcomes, and the Indicators of Good Practice (IGPs).

Introduction of the partially achieved level

The UK Government's decision to place the CAF at the centre of the new Government Cyber Security Strategy has increased public sector organisations' adoption. In response to this growing usage and the need for more nuanced assessment, CAF 3.1 introduces a "Partially Achieved" level within the IGP for Media/Equipment sanitisation. This addition acknowledges the critical importance of data confidentiality within the public sector.

Consultation and collaboration 

The CAF revisions have undergone extensive consultation with NIS regulators and other key stakeholders, resulting in a collaborative approach that keeps the framework current and effective in tackling emerging cyber security challenges.

The importance of supporting guidance 

Throughout the latest review process, it became clear that utilising the supporting guidance alongside the CAF is of utmost importance. It is highly recommended that all users have both the framework and its accompanying guidance readily available while working with the CAF. The additional context provided in the guidance significantly aids in the interpretation and practical application of the framework's principles, ultimately enhancing the overall effectiveness of cyber assessment.

Adapting to evolving threats and expanding use 

As the threat landscape evolves and the use of CAF expands into new sectors, ongoing consideration is given to ensuring that the framework remains reflective of its users' needs. Any future changes will not alter the fact that the CAF will maintain its outcome-focused approach, allowing organisations to adopt a risk-based strategy when addressing their cyber resilience.

Final roundup 

While your organisation’s cyber challenges are complex and ever-changing, you can successfully navigate them and build a more secure future with your cyber security partner by your side. Get in touch today and discover how tmc3 can help you achieve your digital goals. Driven by a passion for doing things better, tmc3 understands that cyber security, data protection and compliance are challenges that every company faces, no matter their size, and that a unique and personal approach is required every time.