Guidance
Cyber Assessment Framework
Cyber security guidance for organisations that support essential services or are critical to the UK’s security and prosperity.
Page 16 of 25
CAF Objective C - Detecting cyber security events
iStock.com/z_wei
Capabilities exist to ensure security defences remain effective and to detect cyber security events affecting, or with the potential to affect, essential functions.
Principle: C1  Security Monitoring
-
The organisation monitors the security status of network and information systems supporting the operation of essential function(s) in order to detect security events indicative of a security incident.
Principle: C2  Threat Hunting
-
The organisation proactively seeks to detect, within networks and information systems, adverse activity affecting, or with the potential to affect, the operation of essential functions even when the activity evades standard security prevent / detect solutions (or when standard solutions are not deployable).