Principle A2: Risk management

The organisation takes appropriate steps to identify, assess and understand risks to the security and governance of information, systems and networks supporting the operation of essential functions. This includes an overall organisational approach to risk management.

Description

Your organisation has effective internal processes for managing risks to the security and governance of information, systems and networks related to the operation of your essential function(s) and communicating associated activities. This includes a process for data protection impact assessments (DPIAs).

Indicators of good practice (IGP) achievement levels can be viewed via the Data Security Protection Toolkit.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework (CAF).

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the organisation's outcomes are effectively achieved.

Suggested approach to testing – Partially achieved

1. Risk management process - verify that:

1. The organisation has comprehensive processes for identifying, analysing, prioritising and managing information governance and cyber security risk. (PA#1, A#1)
2. There is a specific process which the organisation adheres to for conducting risk assessments when significant events occur that could affect the organisation’s essential functions. (PA#5, A#7)
3. There is a specific process which the organisation adheres to for conducting DPIAs before beginning any type of processing which is likely to result in a high risk to the rights and freedoms of individuals. (PA#5, A#7)
4. The organisation’s adherence to agreed processes are reflected in the organisation’s risk management documentation such as risk registers and risk assessments. (PA#1, A#1)

2. Risk management documentation - verify whether the documents show:

1. Data protection by design and by default, incorporated in the process. (PA#1, A#1)
2. Consideration of data protection principles and relevant legislation, including the right to private life where applicable. (PA#6, A#10) 

3. Understanding threats and vulnerabilities – obtain and inspect the organisation’s risk registers and a sample of the organisation’s risk assessments. Verify that risk assessments associated with systems and networks appropriately consider:

1. known and well understood cyber threats (PA#2)
2. vulnerabilities (PA#2)

4. Risk management actions - obtain the outputs of the risk management process discussed in step 1 and step 3, and assess whether the outputs include clear requirements and mitigation to address risks in line with the organisation’s approach to cyber security and information governance (IG) more widely. (PA#3, A#5)

5. Communicating to accountable individuals - verify that the organisation has established thresholds for situations where outputs of risk management processes should be communicated to key decision-makers and accountable individuals. Obtain evidence that this communication occurs where it is needed. (PA#4, A#6)

Additional approach to testing – Achieved

1. Risk impact – discuss the process for evaluating the business impact of various scenarios, and assess whether the adverse impacts on the organisation’s essential functions has been understood and documented. Obtain a sample of scenario business impact evaluations and verify that the results are fed into the risk management process. (A#2)

2. Threat assumptions - obtain evidence that the organisation maintains a set of threat assumptions based on threat intelligence it receives and its own threat analysis, and that it has an effective review process to ensure these assumptions remain up-to-date. Verify that the threat assumptions are tailored to the organisation’s individual circumstances and cover a wide range of possible attacks. Assess whether these threat assumptions are appropriately integrated into the organisation’s risk management processes. (A#3)

3. Near misses - obtain a sample of the organisation’s repeated or significant near misses and assess whether the organisation effectively integrates lessons learned from these into its risk management processes. (A#4)

4. Dynamic risk assessments - determine whether there are processes and controls in place to ensure that the risk assessments are updated based on changes in threats, data use or processing and technical changes. Obtain evidence of risk assessments updated following this process. (A#7)

5. Risk management process review - verify what specific criteria the organisation uses to evaluate the effectiveness of its risk management processes. Obtain evidence that evaluations occur on a scheduled or efficiently reactive basis and improvements are made to strengthen risk management processes where appropriate. (A#8)

6. Anticipating technological developments - obtain evidence that the organisation conducts horizon-scanning activities using relevant sources of threat intelligence and industry guidance. Verify that these activities are used to update threat assumptions, risk assessments, risk registers and security improvement plans as appropriate. (A#9)

Suggested documentation – Partially achieved

Suggested documentation includes:

• procedures for identifying, analysing, prioritising and managing information governance and cyber security risk
• risk assessments
• data protection impact assessments (DPIAs)
• risk registers
• evidence of data protection by design and by default being incorporated into risk management processes
• evidence of data protection principles and relevant legislation being incorporated into risk management processes
• evidence of known cyber threats and vulnerabilities in systems and networks being considered as part of risk management processes
• procedures for communicating significant conclusions from risk management processes to accountable individuals

Additional documentation - Achieved

Additional documentation includes:

• evidence of business impact evaluations for multiple scenarios
• threat assumptions and review process
• evidence of lessons learned from near misses being integrated into risk management processes
• evidence of risk assessments being updated in response to threats, data uses and technical changes
• procedures for evaluation and improvement of risk management processes
• evidence of horizon-scanning activities being used to update risk management documentation 

Description

You understand the capabilities, methods and techniques of threat actors and what information, systems and networks they may compromise to adversely impact your essential function(s). 

This information is used to inform security and resilience risk management decisions, adjusting, enhancing or adding security measures to better defend against threats.

Indicators of good practice (IGP) achievement levels can be viewed via the Data Security Protection Toolkit.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework (CAF).

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the organisation’s outcomes are effectively achieved.

Suggested approach to testing - Partially achieved

1. Threat analysis – assess whether the organisation receives, and documents where relevant to their environment, threat information from authoritative sources. (PA#1)
2. Common types of cyber attacks - obtain evidence that the organisation understands common attack methods and techniques relevant to its environment and keeps its understanding up-to-date. (PA#2, PA#4)
3. Likely threat actor targets - verify that the organisation has identified likely targets for threat actors within its environment, and considered how common attacker methods and techniques could be used against these targets. (PA#3)
4. Applying understanding of threat to risk management decision-making – obtain evidence that the organisation incorporates its understanding of threat developed through steps 1 to 3 into its risk management decision-making, security planning and implementation of security controls. (PA#5)

Suggested approach to testing – Achieved

1. Detailed threat analysis – in addition to step 1 of 'partially achieved', obtain evidence that the organisation: 

1. has a systematic way of documenting and acting on threats which are relevant to its environment (A#1, A#8)
2. considers the wider national infrastructure on which it depends, geo-political events and emerging attack campaigns as part of its analysis of threat (A#1)

2. Capable and well-resourced threat actors - verify that the organisation considers how sophisticated attacker techniques could be used to compromise its critical services and infrastructure supporting essential functions. (A#2)

3. Threat modelling - assess whether the organisation uses an appropriate threat modelling technique to examine threats to information, systems and networks supporting its essential function(s) from a threat actor’s perspective. As part of threat modelling exercises, verify that the organisation:

1. anticipates probable attack methods and techniques, targets and objectives, and develops plausible scenarios (A#3)
2. prioritises systems and assets which they consider to be probable targets for capable and well-resourced threat actors (A#4)
3. identifies and justifies what measures they can put in place to reduce the likelihood of the threat actor achieving their objectives (A#5)

4. Detailed understanding of current threats – in addition to step 1 of 'partially achieved', obtain evidence that the organisation conducts proactive research using authoritative and relevant sources, and incorporates this into its risk management decisions. (A#6, A#7)

Suggested documentation – Partially achieved

Suggested documentation includes:

• threat intelligence reports, alerts and advisories received from authoritative sources
• documentation showing consideration of common cyber attack methods and techniques relevant to the organisation's environment
• records of reviews and updates to threat assessments following new threat intelligence, incidents or changes in the threat landscape
• documentation identifying likely threat actor targets within the organisation's environment
• risk assessments
• risk registers 
• security improvement plans

Suggested documentation – Achieved

Suggested documentation includes:

• documented procedures for identifying and responding to threats relevant to the organisation's environment
• records showing consideration of geo-political developments, emerging attack campaigns and dependencies on wider national infrastructure
• evidence of consideration of sophisticated attacker techniques 
• threat modelling methodology and procedures (for example STRIDE, attack trees, MITRE ATT&CK mapping or equivalent)
• documented attack scenarios, attack paths or threat actor journeys showing the steps required to reach critical assets or services
• evidence of security controls being mapped to attack paths or threat scenarios
• evidence of proactive threat research incorporated into risk management decisions

Description

You have gained confidence in the effectiveness of  your technology, people, and processes relevant to the security and governance of information, systems and networks supporting your essential function(s).

Indicators of good practice (IGP) achievement levels can be viewed via the Data Security Protection Toolkit.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework (CAF).

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the organisation's outcomes are effectively achieved.

Suggested approach to testing – Mandatory policy requirement

Assurance policy – it's mandated via the NHS Standard Contract and the Data Security and Protection Toolkit (DSPT) requirement that organisations annually complete a DSPT audit/independent assessment. Organisations must have due regard to the findings and provide them to their board and within their DSPT submission. The provision of an independent assessment following the guidance in this document meets this directive policy requirement.

Suggested approach to testing - Achieved

1. Security and governance measures - assess how the organisation validates that its cyber security and IG controls are working effectively. Obtain evidence that the organisation’s validation processes can effectively identify weak points, and that plans are put in place to remedy those weak points. (A#1)

2. Selection of assurance methods – discuss the various assurance methods in use at the organisation, and understand how they were assessed against other methods and validated as the appropriate methods to be used. (A#2)

3. Independent assurance - obtain evidence of how the organisation uses third-parties to assure its technology, people and processes, for example, by inspecting documentation of previous DSPT audits. (A#3)

4. Deficiency remediation - assess whether deficiencies identified by assurance activities are assessed by responsible decision-makers, and clear remediation actions are delegated to named owners. Obtain evidence that this process leads to remediation of deficiencies identified without undue delay. (A#4)

5. Review of assurance methods - verify that the organisation has a scheduled or efficiently reactive process for reviewing its assurance methods which ensures that they remain appropriate. (A#5)

Suggested documentation - Achieved

Suggested documentation includes:

• procedures for assurance of cyber security and information governance controls
• evidence of validation and selection of assurance methods
• evidence of previous DSPT audits or equivalent independent assurance
• action plans for remediating deficiencies
• procedures for reviewing assurance methods