by Craig Moores, Principal Lead at Bridewell
In the face of a surge in ransomware-related attacks, averaging one every two weeks in the utilities sector, organisations must bolster their defences to match the evolving threat landscape. Recent research from Bridewell highlights this concerning trend, underlining the urgency for action. Embracing the NCSC’s Cyber Assessment Framework (CAF) emerges as a crucial strategy to mitigate future risks and keep pace with attackers.
Understanding the framework
The CAF isn’t merely another regulatory hurdle. Already utilised by Ofgem, the framework serves as a comprehensive guide to enhance the cyber resilience of Operators of Essential Services (OES). It isn’t a checkbox exercise but instead necessitates a roadmap for devising best practices and digital transformation strategies. Those organisations that don’t comply, however, will face the risk of enforcement notices and financial penalties.
With sector regulators devising Baseline and Enhanced profiles, the CAF sets security outcomes that mandate a higher level of resilience by 2027 for OES network and information systems. Transitioning from the Baseline to the Enhanced profile is a gradual process, emphasising the consolidation of existing efforts rather than reinventing the wheel. Achievements under the Baseline profile serve as foundations for adopting advanced security measures, monitoring, alerting, and threat detection across entire system architectures.
Once the fundamental aspects of the CAF are understood, energy firms should pivot towards strategically aligning with the CAF profiles. This strategic alignment is vital for enhancing long-term cyber security measures and effectively managing the evolving threat landscape. As such, organisations should be considering their cyber target operating model to ensure initiatives have longevity and the organisation adapts to continue their operation in BAU.
Strategic alignment with CAF profiles
Companies initiate their alignment with the CAF through a rigorous process of scoping, in line with regulator guidance. Organisations must document how the NIS regulation applies to each of its essential services and how these are supported by network and information systems – these are what the CAF will be applied against, ensuring they have implemented comprehensive cyber security controls. For instance, with an electricity provider, understanding how energy is generated and supplied is key. High-level schematics clarify how these systems function, ensuring efficient delivery of essential services. Collaborative input from various business functions ensures thorough device identification.
Following this, a gap analysis comparing their status against sector-specific profiles should be undertaken. This reveals overlooked technologies requiring risk assessment. Gap identification facilitates targeted corrective action plans to achieve the target profile. The outcome-focused nature of the CAF allows flexibility in meeting objectives, tailored to unique business environments and operational needs. Although specific deployments may not precisely align with the framework’s Indicators of Good Practice, desired outcomes can still be achieved. Therefore, organisations navigate CAF compliance by systematically assessing, aligning, and adapting cybersecurity measures.
Tailoring approaches to unique environments
While the Indicators of Good Practice offer guidance, they cannot replace expert judgment in all scenarios. The CAF isn’t designed to be a one-size-fits-all solution. Technology limitations and contextual factors must be considered. For instance, outdated technology may not meet current best practices. The framework adopts a risk-based approach, allowing flexibility and permitting the integration of countermeasures to reduce cyber risk. Contextualisation within individual environments is crucial, especially for organisations with remote instruments or dispersed outstations.
External expertise also plays a vital role in meeting the requirements of the Enhanced profile. A systematic approach identifies strengths and weaknesses, focusing on organisational goals and interactions. Assessments at the asset level enhance risk articulation, leading to better compliance and tailored action plans. Collecting evidence at the system level supports and justifies CAF self-assessment outcomes. By adapting strategies to specific environments and leveraging external guidance, organisations can navigate CAF compliance effectively.
Preparing for 2027 and beyond
Compliance with the CAF is not a one-time task but an ongoing programme of cyber security improvement. Achieving the outcomes of the Enhanced profile by 2027 necessitates collaboration across business functions and the integration of mitigating controls to address evolving threats. Beyond 2027, working with experts to continuously assess, audit, and manage corrective action plans remain imperative to successfully safeguard energy infrastructure against emerging risks.
