Principle A2: Risk management

The organisation takes appropriate steps to identify, assess and understand risks to the security and governance of information, systems and networks supporting the operation of essential functions. This includes an overall organisational approach to risk management.

Description

Your organisation has effective internal processes for managing risks to the security and governance of information, systems and networks related to the operation of your essential function(s) and communicating associated activities. This includes a process for data protection impact assessments (DPIAs).

Expand the achievement levels to find out the requirements needed to meet each level.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework (CAF).

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the NHS providers outcomes are effectively achieved.

Suggested approach to testing – Partially achieved

1. Risk management process - verify that:

1. The organisation has comprehensive processes for identifying, analysing, prioritising and managing information governance and cyber security risk. (PA#1, A#1)
2. There is a specific process which the organisation adheres to for conducting risk assessments when significant events occur that could affect the organisation’s essential functions. (PA#5, A#7)
3. There is a specific process which the organisation adheres to for conducting DPIAs before beginning any type of processing which is likely to result in a high risk to the rights and freedoms of individuals. (PA#5, A#7)
4. The organisation’s adherence to agreed processes are reflected in the organisation’s risk management documentation such as risk registers and risk assessments. (PA#1, A#1)

2. Risk management documentation - verify whether the documents show:

1. Data protection by design and by default, incorporated in the process. (PA#1, A#1)
2. Consideration of data protection principles and relevant legislation, including the right to private life where applicable. (PA#7, A#10)

3. Understanding information and vulnerabilities – obtain and inspect the organisation’s risk registers and a sample of the organisation’s risk assessments. Verify that:

1. For projects involving personal information, the nature of personal and sensitive information is appropriately considered as part of risk management processes. (PA#2)
2. For projects involving changes to systems and networks, vulnerabilities are appropriately considered as part of risk management processes. (PA#2)

4. Risk management actions - obtain the outputs of the risk management process discussed in step 1 and step 3, and assess whether the outputs include clear requirements and mitigation to address risks in line with the organisation’s approach to cyber security and information governance (IG) more widely. (PA#3, A#5)

5. Communicating to accountable individuals - verify that the organisation has established thresholds for situations where outputs of risk management processes should be communicated to key decision-makers and accountable individuals. Obtain evidence that this communication occurs where it is needed. (PA#4, A#6)

6. Threat analysis - assess how the organisation has incorporated threat intelligence into its cyber risk management processes. (PA#6, A#9)

Additional approach to testing – Achieved

1. Risk impact – discuss the process for evaluating the business impact of various scenarios, and assess whether the adverse impacts on the organisation’s essential functions has been understood and documented. Obtain a sample of scenario business impact evaluations and verify that the results are fed into the risk management process. (A#2)

2. Threat assumptions - obtain evidence that the organisation maintains a set of threat assumptions based on threat intelligence it receives and its own threat analysis, and that it has an effective review process to ensure these assumptions remain up-to-date. Verify that the threat assumptions are tailored to the organisation’s individual circumstances and cover a wide range of possible attacks. Assess whether these threat assumptions are appropriately integrated into the organisation’s risk management processes. (A#3)

3. Near misses - obtain a sample of the organisation’s repeated or significant near misses and assess whether the organisation effectively integrates lessons learned from these into its risk management processes. (A#4)

4. Dynamic risk assessments - determine whether there are processes and controls in place to ensure that the risk assessments are updated based on changes in threats, data use or processing and technical changes. Obtain evidence of risk assessments updated following this process. (A#7)

5. Risk management process review - verify what specific criteria the organisation uses to evaluate the effectiveness of its risk management processes. Obtain evidence that evaluations occur on a scheduled or efficiently reactive basis and improvements are made to strengthen risk management processes where appropriate. (A#8)

6. Threat analysis - obtain evidence that the organisation performs ongoing detailed threat analysis to understand the wide range of attacks and threat actors it is subject to at any given time. Verify that threat assumptions are reviewed in response to changes in the threat landscape such as significant geo-political events, knowledge of new cyber-attack campaigns and threat intelligence received from authoritative sources. Obtain evidence that this detailed threat analysis is incorporated into risk management processes. (A#9) 

Suggested documentation – Partially achieved

Suggested documentation includes:

• procedures for identifying, analysing, prioritising and managing information governance and cyber security risk
• risk assessments
• data protection impact assessments (DPIAs)
• risk registers
• evidence of data protection by design and by default being incorporated into risk management processes
• evidence of data protection principles and relevant legislation being incorporated into risk management processes
• evidence of nature of information being considered as part of risk management processes
• evidence of vulnerabilities in systems and networks being considered as part of risk management processes
• procedures for communicating significant conclusions from risk management processes to accountable individuals
• evidence of threat intelligence being used for cyber risk management processes

Additional documentation - Achieved

Additional documentation includes:

• evidence of business impact evaluations for multiple scenarios
• threat assumptions and review process
• evidence of lessons learned from near misses being integrated into risk management processes
• evidence of dynamic risk assessments
• procedures for evaluation and improvement of risk management processes
• evidence of ongoing detailed threat analysis

Description

You have gained confidence in the effectiveness of the security and governance of your technology, people, and processes relevant to your essential function(s).

Expand the achievement levels to find out the requirements needed to meet each level.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework (CAF).

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the NHS providers outcomes are effectively achieved.

Suggested approach to testing – Mandatory policy requirement

Assurance policy – it's mandated via the NHS Standard Contract and the Data Security and Protection Toolkit (DSPT) requirement that organisations annually complete a DSPT audit/independent assessment. Organisations must have due regard to the findings and provide them to their board and within their DSPT submission. The provision of an independent assessment following the guidance in this document meets this directive policy requirement.

Suggested approach to testing

1. Security and governance measures - assess how the organisation validates that its cyber security and IG controls are working effectively. Obtain evidence that the organisation’s validation processes can effectively identify weak points, and that plans are put in place to remedy those weak points. (A#1)

2. Selection of assurance methods – discuss the various assurance methods in use at the organisation, and understand how they were assessed against other methods and validated as the appropriate methods to be used. (A#2)

3. Independent assurance - obtain evidence of how the organisation uses third-parties to assure its technology, people and processes, for example, by inspecting documentation of previous DSPT audits. (A#3)

4. Deficiency remediation - assess whether deficiencies identified by assurance activities are assessed by responsible decision-makers, and clear remediation actions are delegated to named owners. Obtain evidence that this process leads to remediation of deficiencies identified without undue delay. (A#4)

5. Review of assurance methods - verify that the organisation has a scheduled or efficiently reactive process for reviewing its assurance methods which ensures that they remain appropriate. (A#5)

Suggested documentation

Suggested documentation includes:

• procedures for assurance of cyber security and information governance controls
• evidence of validation and selection of assurance methods
• evidence of previous DSPT audits or equivalent independent assurance
• action plans for remediating deficiencies
• procedures for reviewing assurance methods