Impacts on ICS from the updated Cyber Assessment Framework (CAF)

UK NCSC’s CAF v3.2 introduces material changes requiring multi-factor authentication for all user access to systems supporting essential functions and mandates removal or disablement of generic/shared/default accounts (or changing their credentials where removal is not possible). While these updates aim to raise baseline security for NIS-regulated organizations, they may pose challenges for legacy ICS/OT environments; organizations should review and update security programs, budget for necessary changes, justify best-practice authentication choices, and implement compensating controls where full compliance is temporarily infeasible.