Principle A3: Asset management

Description

Everything required to deliver, maintain or support networks and information systems necessary for the operation of essential functions is determined and understood. This includes data, people and systems, as well as any supporting infrastructure (such as power or cooling).

Expand the achievement levels to find out the requirements needed to meet each level.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework (CAF).

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the NHS providers outcomes are effectively achieved.

Suggested approach to testing

1. Asset inventory – review the organisation’s document(s) or tool(s) for cataloguing assets. Cataloguing may all be done in the organisation’s Information Asset Register, or may be achieved via a combination of the Information Asset Register with other documents and tools for different asset types. Obtain evidence to verify that the following criteria are met:

1. Comprehensive coverage of the organisation’s information assets, hardware assets, software assets, connected medical devices, systems storing personal data and systems storing business and commercial data. (A#1) 
2. Indication of the relevance of each asset to the organisation’s essential function(s). (A#1)
3. Recognition of asset dependencies on supporting infrastructure. (A#2)
4. A system of prioritisation that indicates which assets are most important to the operation of the organisation’s essential function(s). (A#3)
5. An assigned staff member who is responsible for managing each asset, including information asset owners and administrators for information assets. Verify how the organisation has made these staff members aware of their roles and responsibilities. (A#4, A#6)

2. Managing with cyber security in mind - verify that the organisation is able to use its asset management procedures for security purposes, such as identifying anomalous or unsupported devices, cross-referencing vulnerabilities against devices and software on its networks, and ensuring suitable controls are applied wherever assets are reused, transferred or disposed of. (A#5)

Suggested documentation

Suggested documentation includes:

• information assets register
• other document(s) or tool(s) for cataloguing assets
• evidence of consideration and prioritisation of essential functions
• evidence of asset dependencies on supporting infrastructure being recognised
• evidence of asset managers and owners being assigned
• procedures for reviewing and updating asset inventories
• evidence of asset management procedures facilitating effective cyber security