CAF 4.0

Process for managing technical vulnerabilities

Critical

High

Normal

Low

B1.a: Policy, process and procedure development

The organisation has developed and continues to improve a set of cyber security and resilience policies, processes and procedures that manage and mitigate the risk of adverse impact to network and information systems supporting its essential function(s).

Related tasks

Information security policy -report publishing, informing and maintenance

Critical

High

Normal

Low

Risk management procedure -report publishing and maintenance

Critical

High

Normal

Low

Risk management

Management commitment to cyber security management and management system

Critical

High

Normal

Low

ISMS description and maintenance

Critical

High

Normal

Low

Maintaining chosen theme-specific policy documents

Critical

High

Normal

Low

Identifying critical functions and related assets

Critical

High

Normal

Low

B3.b: Data in transit

The organisation has protected the transit of data important to the operation of network and information systems supporting its essential function(s). This includes the transfer of data to third parties.

Related tasks

Encryption and addressing protections for secure data transfer

Critical

High

Normal

Low

Encryption

Rules ensuring secure network data transfer

Critical

High

Normal

Low

Management of data sets

Securing the physical transport of data, devices and media

Critical

High

Normal

Low

Removable media

Secure transfer of confidential data outside the organization

Critical

High

Normal

Low

Management of data sets

Protection of data in transit

Critical

High

Normal

Low

Encryption

B4.a: Secure by design

The organisation designs security into network and information systems that support the operation of its essential function(s). The organisation minimises their attack surface and ensures that the operation of its essential function(s) should not be impacted by the exploitation of any single vulnerability.

Related tasks

Minimizing the risk of attack by limiting attack surfaces

Critical

High

Normal

Low

Description of cyber security structure

Critical

High

Normal

Low

Built in and default cyber security in system development (Security by design)

Critical

High

Normal

Low

Secure development

Defining standard templates for secure configurations

Critical

High

Normal

Low

B4.b: Secure system configuration

The organisation securely configures network and information systems that support the operation of its essential function(s).

Related tasks

Process for secure configuration of network infrastructure

Critical

High

Normal

Low

Defining standard templates for secure configurations

Critical

High

Normal

Low

Monitoring configurations

Critical

High

Normal

Low

B6.b: Cyber security training

The people who support the operation of network and information systems supporting the organisation's essential function(s) are appropriately trained in cyber security.

Related tasks

Training for support personnel

Critical

High

Normal

Low

Training personnel with a changed role

Critical

High

Normal

Low

Maintaining a log of cyber security trainings

Critical

High

Normal

Low

Arranging training and guidance during orientation (or before granting access rights)

Critical

High

Normal

Low

Staff guidance and training procedure in cyber security

Critical

High

Normal

Low

B5.c: Backups

The organisation holds accessible and secured current backups of data and information needed to recover operation of its essential function(s) following an adverse impact to network and information systems.

Related tasks

Establishing and maintaining an isolated instance of recovery data

Critical

High

Normal

Low

Protecting backups against intentional and unintentional deletion and manipulation

Critical

High

Normal

Low

Encryption of backup data

Critical

High

Normal

Low

Encryption

Defining a backup strategy

Critical

High

Normal

Low

Documenting and delegating ownership of own backup processes

Critical

High

Normal

Low

Determining responsibilities for backing up important information assets

Critical

High

Normal

Low

B5.a: Resilience preparation

The organisation is prepared to restore the operation of its essential function(s) following adverse impact to network and information systems.

Related tasks

Creating and documenting continuity plans

Critical

High

Normal

Low

Anticipating capacity-related problems

Critical

High

Normal

Low

Regular testing and review of continuity plans

Critical

High

Normal

Low

Continuity of critical tasks in exceptional situations

Critical

High

Normal

Low

B3.e: Media / Equipment sanitisation

Before reuse and / or disposal the organisation appropriately sanitises devices, equipment and removable media holding data important to the operation of network and information systems supporting its essential function(s).

Related tasks

Safe disposal of laptops

Critical

High

Normal

Low

Mobile device management

Marking of equipment that needs safe disposal

Critical

High

Normal

Low

Data classification

Process for secure disposal of removable media containing confidential information

Critical

High

Normal

Low

Removable media

B2.a: Verification and authorization of system access

The organisation robustly verifies, authenticates and authorises access to network and information systems supporting its essential function(s).

Related tasks

Defining and documenting access roles

Critical

High

Normal

Low

Implementing formal access control processes

Critical

High

Normal

Low

Centralized record of user's access rights to data systems

Critical

High

Normal

Low

Authentication of identities and binding to user data

Critical

High

Normal

Low

B5.b: Design for resilience

The organisation designs network and information systems supporting its essential function(s) to be resilient to cyber security incidents. Systems are appropriately segregated and resource limitations are mitigated.

Related tasks

Network security and segregation

Critical

High

Normal

Low

System capacity planning and resilience

Critical

High

Normal

Low

Data system management

Detailed procedures for the management, control and segmentation of networks

Critical

High

Normal

Low

Ensuring and testing the resilience of data processing environment

Critical

High

Normal

Low

Monitoring the use of the available capacity

Critical

High

Normal

Low

C1.b: Securing logs

The organisation holds log data securely and grants appropriate user and system access only to accounts with a business need. Log data is held for a suitable retention period, after which it is deleted.

Related tasks

Log data deletion process

Critical

High

Normal

Low

Retaining audit logs

Critical

High

Normal

Low

Protecting log information

Critical

High

Normal

Low

Minimizing and monitoring log data access

Critical

High

Normal

Low

Incident management and response

C2: Threat hunting

The organisation proactively seeks to detect, within networks and information systems, adverse activity affecting, or with the potential to affect, the operation of essential functions even when the activity evades standard security prevent / detect solutions (or when standard solutions are not deployable).

Related tasks

Advanced threat hunting

Critical

High

Normal

Low

Deploying a network intrusion detection solution

Critical

High

Normal

Low

Monitoring the use of the network and information systems to identify anomalies

Critical

High

Normal

Low

Incident management and response

C1.e: Personnel skills for monitoring and detection

Monitoring and detection personnel skills and roles, including those outsourced, reflect governance and reporting requirements, expected threats and the complexities of the network or system data they need to use. Monitoring and detection personnel have sufficient knowledge of network and information systems and the essential function(s) they need to protect.

Related tasks

Competence requirements for security monitoring personnel

Critical

High

Normal

Low

Training own IT-personnel for security system usage

Critical

High

Normal

Low

Amount, competence and adequacy of key cyber security personnel

Critical

High

Normal

Low

A1.c: Decision-making

The organisation has senior-level accountability for the security of network and information systems, and delegates decision-making authority appropriately and effectively. Risks to network and information systems related to the operation of the organization's essential function(s) are considered in the context of other organisational risks.

Related tasks

Delegating security decision-making authority

Critical

High

Normal

Low

Strategic directions of risk response options

Critical

High

Normal

Low

Amount, competence and adequacy of key cyber security personnel

Critical

High

Normal

Low

A1.a: Board direction

The organisation has effective organisational security management led at board level and articulated clearly in corresponding policies.

Related tasks

Management commitment to cyber security management and management system

Critical

High

Normal

Low