Phase 1: CAF-A

Developing a rigorous security
management plan.

CAF A1

Governance, Roles and Responsibilities

Organisations need appropriate, documented, and auditable systems that consider the structure and controls used to manage processes, people, and technology in relation to security risks.

CAF A2

Risk Management

A comprehensive risk management strategy, encompassing both physical and digital systems, should be established and regularly updated, based on the latest threat intelligence.

CAF A3

Asset Management

All essential physical and digital assets - and their associated licences, where applicable - should be logged and tracked, with processes in place for their end of life, including recycling where possible. Similarly, all system dependencies should be catalogued, in order to ensure hidden security risks are identified and proactively resolved.

CAF A4

Supply Chain

The increasingly interconnected nature of global supply chains presents a growing range of potential security risks, with bad actors frequently utilising third-party systems and platforms to gain access to CNI. Suppliers should understand their customers’ compliance and security obligations and take appropriate action, ensuring appropriate controls are in place, aligned to the level of risk and dependency.