OTCOGNISHIELD / ENGINEERING GUIDE
NCSC CAF asset and monitoring evidence for OT
Connect a passive asset record and its coverage limits to a practical CAF evidence discussion.
Published 4 November 2026 · OTCogniShield engineering notes
FOR BUSINESS LEADERS
Business value
Show how monitoring evidence supports a review, while making coverage limits and missing information visible.
What to ask
Which review questions does the evidence help answer, and who will confirm the interpretation and follow-up actions?
Important boundary
A monitoring tool provides inputs to a review. It does not establish that every required outcome has been achieved.
| Framework | NCSC Cyber Assessment Framework |
|---|---|
| Illustrative principles | A3 Asset Management; C1 Security Monitoring |
| Important boundary | Evidence contribution, not an assessed outcome or NCSC endorsement |
Asset records need a reason to exist
CAF principle A3 concerns asset management. A useful OT inventory connects recorded identity and communications to the operation they support. IP and MAC addresses are starting points; the site identifier, responsible owner, location and critical function need confirmation by people who know the plant.
Monitoring needs visible coverage limits
CAF principle C1 concerns security monitoring. A stored event is not proof that the relevant collection point is currently working. An evidence discussion should explain the monitoring source, available time range, freshness, gaps and the action taken when visibility stops.
For a passive pilot, agree which feed or capture represents which part of the network. Record whether both directions are present, whether any traffic is filtered and how restart or storage exhaustion affects visibility. Keep these operational checks alongside the asset and finding records.
Support a reviewer rather than filling a score
OTCogniShield can organise recorded observations and review snapshots. The CAF reference is a way to organise a discussion, not a direct conversion from a log entry to an achieved outcome. Governance, procedures, staff capability, response and other evidence remain relevant.
Suggested evidence bundle
- Owner-reviewed asset list and scope.
- Collection diagram and monitoring coverage statement.
- Sample observations with accurate timestamps and provenance.
- Known gaps, review actions and responsible owner.
- Recovery and retention checks for the agreed deployment.
Use the current NCSC framework and any applicable profile when preparing an assessment. This guide does not imply certification, assessment success or endorsement.