Cyber Security News and Insights
Category: Risk Analysis
CAF 4.0 has arrived, bringing major updates to the UK’s Cyber Assessment Framework. Compared to version 3.2, it introduces new contributing outcomes, over 100 new Indicators of Good Practice, and significant restructuring, especially in Objective C (cybersecurity monitoring and threat hunting). While many changes are minor or clarifications, around 60 require closer review, meaning organisations transitioning from CAF 3.2 will need to reassess key areas. Our blog breaks down where to focus your efforts when updating your assessment process.
For over a decade, 2T Security has been helping Critical National Infrastructure operators strengthen their defences by uncovering hidden cyber-risks in Operational Technology environments. Through focused, two-day workshops based on the NCSC’s Cyber Assessment Framework, our experts partner with your team to map IT-OT interconnections, expose legacy vulnerabilities, and deliver prioritised recommendations—rapidly improving resilience where it matters most.
We are delighted to launch a new and improved version of RiskTree. Read more to learn about the new features that have been added. Visit our RiskTree pages to learn more about RiskTree and how it can help you assess and prioritise your organisation's risks.
Why are bad actors targeting CNI? Which sectors are most at risk? And what can be done to offer better protection?
In this article, we discuss the approach to creating GovAssure profiles. We didn’t want to assume that government could use the existing CAF baseline profile based on a different threat profile to the private sector. Read more about how we ensured that the chosen profile reflected the threats faced by government.
A brief guide to using the Cyber Assessment Framework (CAF) in practice. If you’ve read our earlier blogs about the Cyber Assessment Framework (CAF), you'll know that it isn’t intended to be a checklist - find out more about outcome level dependencies and chord diagrams...
If you want to know more about the Cyber Assessment Framework you've come to the right place. In this article, we'll explain the what, why, who, where and when of the CAF!
Probability/impact graphs have been used for a long time to assess risk, especially in spreadsheet-based risk registers. They give a misleading impression of risk levels though and hence organisations should be using alternative, and better approaches.
When you start using RiskTree, a powerful risk assessment tool, it's important to grasp the nuances of different risk types: intrinsic, residual, and target. These terms sometimes spark confusion, as their meanings aren't always universally clear. Let's demystify these concepts for a clearer understanding.
This post details why we implemented bowtie analytics in RiskTree. And, how RiskTree users can now build bow tie diagrams from their existing trees.