Cyber Assessment Framework: Why NHS Trusts Must Act Now

NHS Trusts and other healthcare providers in the UK must start thinking about the Cyber Assessment Framework (CAF) now to ensure they are well-prepared for their initial assessment by June 30, 2025. Starting now allows NHS Trusts to methodically address the framework's requirements, allocate resources effectively, and ensure CAF requirements are integrated into their overall cybersecurity strategy.

Read on to learn more about the CAF framework, how it will impact NHS Trusts and other healthcare organizations in the UK, and what you need to do now to ensure successful CAF compliance by June 2025.

Understanding the CAF Framework

The Cyber Assessment Framework (CAF) was developed by the UK National Cyber Security Centre (NCSC) to help organizations manage and improve their cyber resilience. It is specifically targeted at organizations that are part of the UK’s Critical National Infrastructure (CNI) or are subject to certain types of cyber regulation, such as the Network and Information Systems (NIS) Regulations.

The CAF provides a structured approach to assess and demonstrate an organization’s level of cyber resilience. It includes a set of Objectives, Principles, Outcomes, and Indicators of Good Practice (IGPs) to guide organizations in achieving robust cybersecurity measures.

The initial version of the CAF was released on April 30, 2018. The latest version of the CAF is v3.2, which was released on April 15th, 2024.

Industries Affected by CAF

The NCSC CAF impacts several key industries in the UK, particularly those involved in critical national infrastructure and essential services. These include healthcare, energy and transportation, water supply and distribution, finance, telecommunications, various government departments and agencies, and digital infrastructure providers, such as data centers and cloud service providers.

Of particular interest is the impact CAF will have on healthcare in the UK. NHS Trusts and other healthcare organizations must comply with CAF to protect patient data and ensure the resilience of healthcare services.

CAF Impact on NHS Trusts

Complying with the CAF will require NHS Trust hospitals to allocate resources, including time, personnel, and financial investments. For example, NHS hospitals complying with CAF will require a variety of resources, such as:

• Skilled Staff: Cybersecurity experts, IT professionals, and information governance specialists will be essential to navigate the technical and regulatory aspects of the CAF.
• Training Programs: CAF compliance will require continuous training for staff to stay updated on cybersecurity best practices and compliance requirements.
• Financial Investment: NHS Trust hospitals will need to ensure they have adequate funding to support the implementation of new technologies and training programs in order to meet the broader CAF requirements.
• Technology and Tools: NHS Trusts may need new, more advanced cybersecurity tools and technologies to monitor, detect, and respond to cyber threats effectively.
• Documentation and Reporting Systems: NHS Trusts may need to upgrade or enhance their systems for documenting compliance efforts, managing audits, and generating necessary reports.

In addition, NHS Trust IT and information security teams will need strong commitment and support from hospital leadership to prioritize cybersecurity and allocate necessary resources.

CAF Compliance Timelines

NHS Trusts need to comply with the CAF by June 30, 2025. This compliance is part of the updated Data Security and Protection Toolkit (DSPT), which aligns with the CAF to enhance cybersecurity assurance across NHS trusts and other healthcare organizations.

Relationship Between DSPT and CAF

Of course, NHS Trusts and other healthcare providers in the UK are already familiar with the DSPT and its annual assessment requirements. As a result, some may have questions about the differences between the DSPT and CAF, as well as if or how the CAF may be replacing the DSPT.

The DSPT is an online self-assessment tool provided by NHS Digital. It allows organizations, particularly those with access to NHS patient data, to measure their performance against the National Data Guardian’s 10 data security standards.

The DSPT was first released in April 2018. Since then, it has undergone several updates to enhance its functionality and align with evolving cybersecurity standards.

However, the most important thing to know is that the latest version of the DSPT, Version 7, which was released on August 30, 2024 has adopted the NCSC CAF for Category 1 organizations, which includes NHS Trusts, Integrated Care Boards (ICBs), Commissioning Support Units (CSUs), and Arm’s Length Bodies (ALBs). (For more information, see the joint statement between NHS England and the National Data Guardian, CAF-aligned DSPT: Evolution of our assurance model.)

This change will lead to NHS Trusts, ICBs, CSUs, and ALBs seeing a different interface when they log in. This updated interface will display CAF-aligned requirements in terms of Objectives, Principles, and Outcomes. Other organizations will retain the current interface and will continue to respond to a list of prescriptive controls, which will be mapped nationally “in the background” against a CAF profile.

Differences Between CAF and DSPT

The new DSPT-aligned CAF introduces several key differences compared to prior versions of the DSPT:

• Framework Alignment: The new DSPT has moved away from the National Data Guardian’s 10 data security standards to now align with the four overall CAF security objectives and 14 cybersecurity principles. The goal of this shift is to provide a more comprehensive approach to cybersecurity.
• Outcomes-Based Approach: The CAF-aligned DSPT focuses on achieving specific security outcomes rather than prescribing detailed controls.
• Incremental Improvement: The new framework sets a high bar for achievement and provides a long-term roadmap for yearly incremental improvement. This encourages continuous enhancement of cybersecurity practices over time.
• Enhanced Scope: While the DSPT originally focused on data protection, confidentiality, and information governance, the CAF-aligned DSPT covers broader cybersecurity aspects, including risk management and incident response, making it more comprehensive than previous versions.
• Independent Audits: The DSPT originally focused on annual self-assessment, but with the new CAF-aligned DSPT there is an increased emphasis on independent audits and national sampling audits to ensure compliance and verify the effectiveness of cybersecurity measures.
• Resource Requirements: The new framework may require more significant resource allocation, including skilled personnel, advanced technologies, and continuous training to meet the higher standards set by the CAF.

These changes were designed to enhance the overall cybersecurity posture of NHS Trusts and other healthcare organizations. They will also help ensure NHS Trusts are better equipped to handle evolving cyber threats and protect sensitive patient data.

NHS Trust CAF Compliance Challenges

Based on all of the changes between prior version of the DSPT and the new CAF-aligned DSPT, NHS trusts face several challenges when trying to comply with CAF:

• Complexity of Requirements: The CAF-aligned DSPT introduces new compliance requirements structured around Objectives, Principles, and Outcomes. This complexity can be overwhelming for NHS Trusts as they need to self-assess and meet various indicators of good practice.
• Resource Allocation: Ensuring compliance requires significant resources, including time, personnel, and financial investment. NHS trusts may struggle to allocate sufficient resources to meet the new standards, especially given existing pressures on healthcare services.
• Technical Expertise: The CAF demands a high level of technical expertise in cybersecurity and information governance. NHS trusts may need to invest in training or hiring skilled professionals to navigate the new framework effectively.
• Continuous Improvement: The CAF emphasizes continuous improvement and effective risk management. NHS trusts must not only achieve compliance but also maintain and improve their practices over time. This can be challenging in a dynamic and resource-constrained environment.
• Audit and Assurance: The requirement for independent audits and national sampling audits adds another layer of scrutiny. NHS trusts must be prepared for these audits, ensuring that all necessary documentation and evidence are in place.

NHS Trust CAF Compliance Audit Timelines and Frequency

NHS Trust hospitals will be required to undergo annual independent audits for CAF compliance. These audits are part of the updated DSPT process, which now aligns with the CAF. The audits ensure that NHS organizations continuously meet the required cybersecurity standards and improve their overall security posture.

NHS Trusts will have their first audits by June 30, 2025. However, it is strongly recommended that NHS Trust begin to prepare for their first CAF-aligned DSPT audit now to ensure all necessary documentation and evidence are in place. NHS Trusts should also begin conducting their own internal audits to identify and address any potential issues before their official audit.

How to Start Preparing for CAF Compliance Now

NHS hospitals can and should begin preparing to comply with the CAF immediately. Below are some good next steps you should take to prepare your hospital:

• Understand the CAF Requirements: Familiarize yourself with the CAF-aligned DSPT guidance. This includes understanding the goals, objectives, and expected outcomes of the CAF.
• Conduct a Gap Analysis: Assess your current cybersecurity posture against the CAF requirements. Identify areas where your organization does not meet the standards and prioritize these gaps for remediation.
• Develop a Compliance Plan: Create a detailed plan to address the identified gaps. This plan should include timelines, responsible parties, and specific actions needed to achieve compliance.
• Enhance Risk Management: Implement robust risk management practices. This involves identifying, assessing, and mitigating risks to essential functions and sensitive data.
• Improve Cybersecurity Measures: Strengthen your cybersecurity measures by adopting best practices in threat detection, incident response, and vulnerability management. Ensure that all connected devices and systems are secure.
• Train Staff: Provide comprehensive training for all staff members on cybersecurity best practices and the importance of CAF compliance. This helps in building a security-aware culture within the organization.
• Conduct Regular Audits and Assessments: Conduct regular audits and assessments to ensure ongoing compliance with the CAF. Use these assessments to continuously improve your cybersecurity posture.
• Engage with Experts: Consider engaging with cybersecurity experts or consultants who can provide guidance and support in achieving CAF compliance.

How Cylera Helps Enable CAF Compliance for NHS Trusts

The Cylera platform is designed to help NHS Trusts and other UK healthcare organizations comply with the CAF by providing the following key capabilities:

• Device Discovery and Profiling: Cylera automatically detects and profiles every healthcare IoT and connected medical device, ensuring comprehensive visibility and control over the network. Having a comprehensive inventory is an essential first step for identifying vulnerabilities and managing risks associated with healthcare IoT and connected medical devices.
• Vulnerability and Risk Management: The Cylera platform helps identify and mitigate known vulnerabilities, reducing the likelihood of threat actors exploiting these weaknesses. This aligns with the CAF’s emphasis on continuous improvement and effective risk management.
• Network Segmentation and Protection: Cylera, through its network segmentation policy generation engine and integrations, provides the automated support required to enable network segmentation and zero trust frameworks. These capabilities allow hospitals to isolate sensitive data and critical systems appropriately on the network, which in turn helps prevent unauthorized access and limits the spread of malware or other cyber threats.
• Threat Detection and Response: Cylera provides enhanced threat detection and response capabilities, enabling healthcare organizations can quickly identify and respond to cyber threats. This is critical for maintaining the security and resilience of healthcare services.
• Compliance Support: Cylera provides tools and resources to help healthcare organizations meet UK compliance requirements, including those outlined in the CAF. This includes generating necessary documentation and reports for audits.

We invite you to learn more about Cylera’s healthcare IoT asset intelligence and cybersecurity platform and how your IT and information security teams can use the Cylera platform to prepare for CAF compliance in 2025.

Contact us today to talk to one of our UK-based healthcare cybersecurity experts or schedule a demo with one of our senior technical sales engineers. Discover for yourself how Cylera is uniquely designed to help ensure your NHS Trust is fully prepared to successfully demonstrate CAF compliance well before the 2025 deadline.