The NCSC Cyber Assessment Framework (CAF)
The structured assessment framework UK regulators use to evaluate cyber resilience. Under the Cyber Security and Resilience Bill, the CAF is the benchmark every in-scope organisation should prepare for.
What is the Cyber Assessment Framework?
The Cyber Assessment Framework (CAF) is a structured methodology developed by the National Cyber Security Centre (NCSC) to assess how well organisations manage cyber risk to their essential functions. Rather than a checklist, the CAF is an outcome-based framework: it defines what good looks like through indicators of good practice, then lets assessors judge whether an organisation meets that standard.
The framework is built around 4 objectives, 14 principles, and a set of contributing outcomes. Each outcome is rated as achieved, partially achieved, or not achieved based on evidence. The current version is CAF v4.0, published in August 2025.
Who uses it?
Nearly every UK cyber regulator uses the CAF as their assessment approach. It underpins NIS Regulations assessments, GovAssure for government departments, and is the expected standard under the Cyber Security and Resilience Bill.The CAF objectives explained
The framework is organised into four high-level objectives, each addressing a critical dimension of cyber resilience.
Objective A: Managing security risk
Appropriate organisational structures, policies, and processes are in place to understand, assess, and systematically manage security risks to essential functions. Covers governance (A1), risk management (A2), asset management (A3), and supply chain (A4).
Objective B: Protecting against cyber attack
Proportionate security measures are in place to protect essential functions from cyber attack. Covers service protection policies (B1), identity and access control (B2), data security (B3), system security (B4), resilient networks and systems (B5), and staff awareness and training (B6).
Objective C: Detecting cyber security events
Capabilities exist to ensure security defences remain effective and to detect cyber security events affecting essential functions. Covers security monitoring (C1) and proactive security event discovery (C2).
Objective D: Minimising the impact of incidents
Capabilities exist to minimise the adverse impact of a cyber security incident on essential functions. Covers response and recovery planning (D1) and lessons learned (D2).
How the CAF works with the CSRB
The Cyber Security and Resilience Bill reinforces the CAF as the standard for assessing regulated organisations.
The CAF as the regulatory benchmark
The CSRB empowers sector-specific competent authorities (regulators such as Ofgem, Ofcom, the Department for Transport, and the ICO) to assess the cyber resilience of regulated entities. These regulators are expected to use the CAF as their primary assessment framework, creating a consistent national standard across sectors.
This means that organisations in scope of the CSRB — including operators of essential services, managed service providers, and data centres — should expect their regulatory assessments to be structured around CAF objectives and contributing outcomes.
Expanded scope under the CSRB
While the CAF was originally developed for operators of essential services under the NIS Regulations, the CSRB significantly expands the population of regulated entities. Managed service providers (MSPs) and data centres are now explicitly designated as in-scope, meaning they too will face CAF-based assessments.
Additionally, the CSRB introduces supply chain obligations through the designation of "critical suppliers," whose security posture may also be assessed using CAF principles.
The NCSC is not a regulator
The NCSC developed the CAF but has no regulatory responsibilities. Your sector regulator (competent authority) is the body that will assess your organisation. Contact your regulator directly to confirm how the CAF applies to your specific circumstances.How a CAF assessment works
Understanding the assessment process, profiles, and what evidence assessors look for.
CAF profiles
The NCSC defines two assessment profiles. The Basic Profile sets a baseline level of cyber resilience against common attack methods, applicable across all sectors. The Enhanced Profile is sector-specific and aimed at organisations facing more sophisticated threat actors, typically critical national infrastructure operators. Your regulator determines which profile applies.
Indicators of Good Practice (IGPs)
Each contributing outcome is supported by indicators of good practice (IGPs) that describe what an assessor expects to see. These are not prescriptive checklists but evidence-led judgements. Assessors evaluate whether your controls, processes, and documentation demonstrate the intent of each outcome.
Self-assessment vs external assessment
Organisations can conduct self-assessments using freely published CAF materials. However, for regulatory compliance, competent authorities may require or strongly recommend an independent external assessment. Self-assessment is valuable for identifying gaps early, but should not be relied upon as the sole measure of readiness.
Outcome grading
Each contributing outcome is graded as achieved, partially achieved, or not achieved. Assessors base their judgement on evidence provided, including policies, procedures, technical configurations, and interviews with key personnel.
CAF objectives and CSRB obligations
How the four CAF objectives align with the duties and obligations in the Cyber Security and Resilience Bill.
| CAF Objective | Key Principles | CSRB Connection |
|---|---|---|
| A: Managing security risk | A1 Governance, A2 Risk management, A3 Asset management, A4 Supply chain | CSRB duties on security risk management; supply chain regulation via "critical suppliers" designation (Reg 14H) |
| B: Protecting against cyber attack | B1 Policies, B2 Identity & access, B3 Data security, B4 System security, B5 Resilient networks, B6 Staff training | Proportionate security measures required of all regulated entities; expanded to MSPs and data centres |
| C: Detecting cyber events | C1 Security monitoring, C2 Proactive event discovery | CSRB incident detection obligations; supports the 24-hour initial notification requirement |
| D: Minimising incident impact | D1 Response & recovery planning, D2 Lessons learned | CSRB incident reporting duties (24h initial, 72h full report); near-miss reporting; cost recovery for failures |
How to prepare for a CAF assessment
A structured approach to getting your organisation ready for a CAF-based regulatory assessment.
Confirm your scope and essential functions
Work with your regulator to confirm which services and systems constitute your essential functions under the regulations. Everything else in the assessment flows from this boundary.
Map controls to CAF principles and outcomes
For each of the 14 principles and their contributing outcomes, document your existing security controls, policies, and processes. Identify where you have coverage and where gaps exist.
Gather and organise evidence
Assessors need to see evidence: policies, risk registers, network diagrams, access control records, incident response plans, training records, and monitoring configurations. Ensure evidence is current, owned, and accessible.
Conduct an internal gap analysis
Rate yourself honestly against each contributing outcome. Where you fall short of "achieved," document the gap and the remediation plan. This internal assessment becomes your roadmap.
Address supply chain risks
Under the CSRB, supply chain security is elevated. Review your third-party and supplier arrangements against CAF principle A4. Ensure contracts, assessments, and ongoing oversight are documented.
Engage an external assessor
Consider a pre-assessment review by an independent assessor. This identifies blind spots your internal team may have missed and gives you confidence before the formal regulatory assessment.
Precursor Security CAF readiness assessment
Not sure where you stand against the CAF? Our readiness assessment maps your current security posture against all 14 CAF principles, identifies gaps, and provides a prioritised remediation plan tailored to your sector and regulator.
Take the readiness assessmentThe 14 CAF principles
Each objective contains specific principles that define the areas of focus for assessment.
Objective A: Managing security risk
A1: Governance
Appropriate governance structures, including board-level accountability, are in place to direct and oversee the security of network and information systems.
A2: Risk management
The organisation has a systematic approach to identifying, analysing, and managing security risks to essential functions.
A3: Asset management
All assets relevant to the security of essential functions are identified, documented, and managed throughout their lifecycle.
A4: Supply chain
The organisation understands and manages the security risks posed by third-party suppliers and partners to its essential functions.
Objective B: Protecting against cyber attack
B1: Service protection policies
Policies and processes direct the organisation's approach to securing systems that support essential functions.
B2: Identity and access control
Access to systems and data is controlled and managed to authorised users, processes, and devices only.
B3: Data security
Data stored or transmitted electronically is protected from actions that may compromise confidentiality, integrity, or availability.
B4: System security
Systems that support essential functions are protected from cyber attack through secure configuration, patching, and vulnerability management.
B5: Resilient networks and systems
Networks and systems are designed to be resilient to cyber attack, with appropriate architectural controls and redundancy.
B6: Staff awareness and training
Staff are appropriately trained, aware of their security responsibilities, and equipped to fulfil them.
Objective C: Detecting cyber security events
C1: Security monitoring
The organisation monitors the security status of networks and systems supporting its essential functions to detect potential security events.
C2: Proactive security event discovery
The organisation proactively discovers security events that have evaded standard monitoring, through threat hunting and anomaly detection.
Objective D: Minimising the impact of incidents
D1: Response and recovery planning
Incident response and recovery plans are in place, tested, and understood by relevant staff, with clear roles and communication procedures.
D2: Lessons learned
The organisation learns from incidents and near misses, feeding improvements back into its security practices and risk management processes.
Ready to assess your CAF readiness?
Whether you are preparing for a first CAF assessment or looking to close gaps before your regulator visits, our team has deep experience across all 14 CAF principles and multiple regulated sectors.