Cyber Resilience Audit
Cyber Resilience Audit (CRA) scheme members are companies that have been assessed as meeting the standards set by the National Cyber Security Centre (NCSC) to deliver independent cyber security audits. These audits will be conducted against the Cyber Assessment Framework (CAF).
The CRA is aimed mainly at organisations who are classed as Operators of Essential Services (OES), although it can be used by any company seeking an independent audit of their cyber resilience.
The Cyber Assessment Framework helps organisations achieve and demonstrate that they have a proportionate level of cyber security and resilience relating to the essential functions they provide.
It helps organisations meet legal and regulatory requirements by providing a framework for assessing how well (or not) expected cyber security requirements defined within a CAF Profile.
What does the Cyber Assessment Framework consist of?
There are 4 high-level objectives:
Underpinning these are 14 principles of cyber security and resilience which provide the foundations of the CAF. These in turn lead to 41 contributing outcomes that are assessed to the following:
This approach allows for an outcome-based audit rather than a compliance tick-box exercise.