Principle A1: Governance

The organisation has appropriate management policies, processes and procedures in place to govern its approach to the security and governance of information, systems and networks.

Description

You have effective organisational information assurance management led at board level and articulated clearly in corresponding policies.

Expand the achievement levels to find out the requirements needed to meet each level.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework (CAF).

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the NHS providers outcomes are effectively achieved.

Suggested approach to testing

1. Information governance and security policies - assess whether the organisation’s information governance and security policies have been clearly documented. The policies should cover:

1. the approach to the security and governance of information, systems and networks supporting the operation of essential function(s). (A#1)
2. a communication process to ensure that all relevant staff are aware of the contents of the policies. (A#1)
3. reporting lines up to the accountable board level member(s). (A#3)

2. Information governance and security groups - obtain evidence that key findings and decisions made by expert groups responsible for information, systems and networks feed into discussions at board level. (A#2)

3. Board meetings - obtain the terms of reference and minutes of the organisation’s board and assess whether security and governance of information, systems and networks is regularly discussed. (A#3)

4. Board strategy and action plans - assess whether action plans relating to the security and governance of information, systems and networks are put in place to implement the direction set by the Board. These action plans should have named owners and clear timelines. Verify that progress is monitored, and timelines are being adhered to. (A#4)

Suggested documentation list

Suggested documentation includes:

• policies relating to the security and governance of information, systems and networks
• evidence of information governance and security group findings and decisions being discussed at board level
• terms of reference and minutes from board meetings
• board level strategy and action plans relating to the security and governance of information, systems and networks

Description

Your organisation has established roles and responsibilities for the security and governance of information, systems and networks at all levels, with clear and well-understood channels for communicating and escalating risks.

Expand the achievement levels to find out the requirements needed to meet each level.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework (CAF).

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the NHS providers outcomes are effectively achieved.

Suggested approach to testing

1. Key roles and responsibilities – assess how the organisation has assigned responsibilities to each key role in a way that ensures there are no gaps in its critical information governance and cyber security activities. (A#1)

2. Regular review - verify that the organisation has a process for reviewing key roles and responsibilities to ensure they remain suitable for maintaining the security and governance of its information, systems and networks. Obtain evidence that the reviews occur in a scheduled or efficiently reactive manner to identify and address potential gaps in the organisation’s cyber security and IG activities without undue delay. (A#1)

3. Job descriptions - obtain the job descriptions of key staff, such as Data Protection Officer (DPO), Senior Information Risk Owner (SIRO), Caldicott Guardian, Information security/cyber security lead. Assess whether appropriate qualifications and/or experience requirements are required for these roles. (A#2)

4. Reporting resourcing issues - assess whether the organisation has procedures in place for reporting risks relating to inadequate time, authority and resources for carrying out information governance and cyber security duties so these can be considered by responsible decision-makers. (A#2)

5. Overall accountability – obtain the name of the individual with overall accountability for the security and governance of information, systems and networks. Verify that their responsibilities have been appropriately documented. (A#3)

6. Staff contracts - obtain an example staff contract and assess whether they contain clear clauses confirming their responsibilities for the security and governance of information, systems and networks. (A#4)

Suggested documentation list

Suggested documentation includes:

• documentation of key roles and responsibilities
• evidence of review process for roles and responsibilities
• job descriptions
• procedures for reporting resourcing issues
• name of individual with overall accountability
• staff contract sample

Description

You have senior-level accountability for the security and governance of information, systems and networks, and delegate decision-making authority appropriately and effectively. Risks to information, systems and networks related to the operation of your essential function(s) are considered in the context of other organisational risks.

Expand the achievement levels to find out the requirements needed to meet each level.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework (CAF).

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the NHS providers outcomes are effectively achieved.

Suggested approach to testing

1. Decision-making process - obtain evidence that:

1. a board-approved risk appetite has been established (A#2)
2. decision-makers are able to explain how they make effective decisions in the context of the risk appetite (A#2)
3. it is clear which staff members are responsible for making decisions about which areas of risk (A#2, A#3)

2. Escalation to board - assess whether there are criteria and procedures for escalating key risk decisions to the board, and obtain evidence that this escalation takes place when required. (A#1)

3. Skills, knowledge, tools and authority – verify how the organisation has ensured that staff members responsible for making decisions in different risk areas are most appropriately positioned and equipped to fulfil their decision-making responsibilities. (A#3)

4. Risk registers - obtain the organisation’s risk registers and assess whether their contents align with the organisation’s procedures for decision-making. (A#3)

5. Risk register review - verify that the organisation has a process for reviewing risk management decisions to ensure they remain relevant and valid. Obtain evidence that the reviews occur in a scheduled or efficiently reactive manner to identify and address potential issues with risk decisions. (A#4)

6. Siloed risk decisions - verify that decision-makers have a criterion for deciding where other departments need to be consulted on risk decisions. Obtain evidence that decision-makers have involved other departments where appropriate. (A#5)

Suggested documentation list

Suggested documentation includes:

• risk appetite statement
• responsibilities for decision-making in different risk areas
• procedures for reporting key risk decisions to the board
• procedures for delegating risk decisions
• risk registers
• procedures for risk register review
• procedures for involving other departments in risk decisions