World events this year seem to have really sharpened the minds of governments around the world in ensuring that their critical infrastructure is secure and intact. Particularly in the UK, the Government has focused its efforts in safeguarding from cyber-attack. Hence CAF – The Cyber Assessment Framework has become front and centre on outlining how organisations need to be vigilant.
What organisations is the Cyber Assessment Framework (CAF) for?
CAF has been introduced to specifically focus on strengthening cyber resilience within the UK Public Sector. However, clear guidance is now being provided by the NCSC about which industries it will support outside of UK Government parameters:
- organisations within the UK Critical National Infrastructure (CNI)
- organisations subject to Network and Information Systems (NIS) Regulations
- organisations managing cyber-related risks to public safety.
Given events in 2015 when Ukraine’s Electricity was affected and 2017 WannaCry ransomware attack, together with more recent events such as the US Colonial Pipeline and Israeli water infrastructure attacks clearly highlight the impact that incidents can have. The NCSC website states, “There is therefore a need to improve the security of network and information systems across the UK, with a particular focus on essential functions which if compromised could potentially cause significant damage to the economy, society, the environment, and individuals’ welfare, including loss of life.”
Whilst there is no stipulation that organisations outside of those cited above should be concerned with CAF – there is clear guidance from the NCSC that all businesses need to be vigilant and build operational resilience to be resistant to attack.
Eliminating the confusion; how CAF supports the NIS regulation?
CAF is a set of 14 deliverable actions that organisations can take to achieve the 4 key areas of NIS:
- Risk Management
- Protecting against cyber attack
- Detecting cyber security events
- Minimising the impact of cyber security incidents
Is CAF actual helpful in maintaining NIS compliance?
CAF can be a great framework for focusing an organisation in complying with NIS and providing specific outcomes that need to be achieved. Under NIS regulations, the four key areas are so broad without specific guidance, it can be challenging for organisations to really focus or provide the resource to really be able to comply with NIS, plus confusion and inconsistency is potentially an issue with such broad objectives. This leaves NIS open to interpretation with a potential for inconsistency. However, using CAF alongside NIS allows businesses to drill down to specifics and really get to the core of the compliance.
Will businesses find NIS & CAF compliance challenging?
Short answer – undoubtedly yes!
Organisations are always trying to balance their cyber security objectives, reduction of risk with that of operational efficiency: Sometimes the two ‘doth collide and striking a balance is never an easy one to achieve so cyber security objectives must not impede innovation but equally NIS and CAF must be adhered to.
It’s all change, change, change in regulatory compliance: Several frameworks to comply with and the one constant is change.. NIS is no exception, so the expectation is, you need to keep on top of any changes which can be challenging.
It’s not just about change, it’s also about the complexity: Never easy to decipher and implement, complying consistently is a huge challenge for organisations to navigate.
Another headache – those pesky evolving threats: We have said it time and again, but this is never going to change. Keeping ahead of the threats is not easy and one that is a continuous challenge for businesses.
Technology gaps and integration: When organisations begin implementing NIS and CAF, they may discover gaps in their current technology that could make it harder to comply. Once these gaps are identified, integrating new technology can be challenging—especially when it comes to making sure it’s compatible with what’s already in place.
Resource constraints & Skills shortages:Implementing and maintaining NIS and CAF will require significant investment, and the global skills shortage will further exacerbate the challenge, As a result, finding qualified personnel to manage NIS and CAF requirements will be severely limited.”
Supply chain risks: Managing supply chain risk is never going to be easy, and the added need to monitor and assess third-party security will ultimately have a direct impact on your business too. Trusting that your suppliers are secure is no longer an option but gaining visibility to this will challenging.
Responding & Recovering: Even with robust preventive measures in place, no system is completely immune to cyber-attacks. Developing and testing effective incident response and recovery plans is crucial, but many organisations struggle with this aspect of cybersecurity.
What’s the answer? What technology is needed to alleviate the challenges that organisations will face implementing NIS & CAF and ensure continual and accurate compliance?
It’s obvious we would say this – but Continuous Controls monitoring is the answer. But let’s break it down by NIS and the CAF objectives as to why we would say that.
Managing Security Risk – NIS
Asset Management: CCM can connect to any technology in your business infrastructure meaning it can create a live asset repository for total asset visibility.
Supply chain: Our platform can connect to any of your third-party vendors or suppliers, also monitoring their key controls to ensure you are confident they are compliant!
Risk: By continuously monitoring controls, businesses can proactively identify and address potential risks, preventing them from turning into significant issues that could impact the organisation’s objectives.
Governance: CCM provides that real time visibility into your controls and their effectiveness This approach can significantly contribute to governance in a business by providing real-time insights, improving risk management, and enhancing overall compliance.
Protecting Against Cyber Attack – NIS
Service protection policies & procedures: Our platform aligns to any of your procedures for clear reporting and continual monitoring of your environment.
Identity and access control: We can connect to your active directory and provide real time updates on your users, and revoked user access. The platform monitors access and authentication to critical systems and data. Unauthorised access attempts, excessive failed logins and suspicious user behavior are detected.
Data security: CCM can connect to any data within your infrastructure for continuous, real-time monitoring, ensuring that your data remains protected
Resilient networks & System security: By continuously monitoring an organisations environment our CCM platform detects any anomalies, deviations, or potential issues, promptly. This allows for timely intervention and correction before issues escalate, reducing the risk of financial losses or compliance violations.
Staff awareness & training: Feedback on anomalies and risk identification can be used as a basis for staff training to drill into the areas in the business that require attention..
Detecting Cyber Security Events
Security Monitoring & Anomaly Detection: Continuous Controls Monitoring (CCM) tracks and manages security-related controls as part of a proactive approach to risk and compliance. It ensures that controls are consistently applied and remain effective over time. Within the broader context of business security, CCM continuously monitors these controls to detect anomalies, uncover vulnerabilities, and address potential risks before they escalate.
Minimising the Impact of Incidents
Response & recovery planning & Improvements: Through customised reporting the CCM platform can provide valuable insights into the security risk and compliance status of your critical business process and technology, meaning that not only do you receive tangible evidence for auditing processes, but you are able to use those insights to plan for all eventualities.
Ultimately, the challenges of regulatory compliance combined with the complexities and nuances of any organisation, can be significantly alleviated and improved through the implementation of continuous controls monitoring.
To find out more about Continuous Controls Monitoring, click here.
