CAF 4.0 explained: what changed in the Cyber Assessment Framework
CAF 4.0 keeps the four objectives and 14 principles but adds new outcomes on understanding attackers and secure software, and rewrites threat hunting. It matters for the Cyber Security and Resilience Bill (CSRB) because regulators may use the framework, so re-score those outcomes first.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What CAF 4.0 is
The Cyber Assessment Framework (CAF) is the National Cyber Security Centre's (NCSC) tool for assessing how well an organisation manages cyber risks to its essential functions. It matters for the Cyber Security and Resilience Bill (CSRB) because regulators may use it to judge organisations, although the Bill's text does not name it.
Version 4.0 is dated 4 August 2025 and replaced v3.2 from April 2024. It keeps the same four objectives and 14 principles, and each principle breaks down into contributing outcomes, 41 in total according to the NCSC.
The four main changes
The NCSC described four major changes. The record of changes shows where each one lands.
| Change | Where it sits | What is now expected |
|---|---|---|
| Understanding attackers | New outcome A2.b Understanding Threat | Know the capabilities, methods and techniques of threat actors, what they could target, and use that to change your defences |
| Secure software | New outcome A4.b Secure Software Development and Support | Maximise use of secure, supported software, whether built in-house or bought |
| Monitoring | C1 revised, including C1.f on user and system behaviour and threat intelligence | Understand normal behaviour and use threat intelligence to detect incidents |
| Threat hunting | C2 rewritten as Threat Hunting | Run documented hunts, at a frequency that matches the risk, for activity your automated tools miss |
The NCSC also says coverage of AI-related risk has been strengthened across the framework. In the text itself this mostly appears through broader wording, such as risk assessments that consider "new or emergent technologies", and indicators on "automated decision-making technologies" being well understood and their decisions replicable. Don't expect a separate AI principle.
What this means in practice
Threat analysis has to be written down and used. At "achieved" on A2.b, you develop plausible attack scenarios, understand the steps a capable attacker would need to take, and justify the measures at each step. You must also document how you do the analysis. A generic threat report in a shared folder won't meet that.
Software questions go to your suppliers. A4.b asks whether suppliers understand the composition and provenance of what they ship, and whether updates reach you through secure channels. Open-source software is covered too. Expect to ask for evidence such as a software bill of materials or a named secure development framework. The CAF gives NIST SSDF and Microsoft SDL as examples.
Threat hunting moves into business as usual. Hunting only after a tip-off is described as a "partially achieved" trait. To reach "achieved", you deploy hunting as part of business as usual and turn hunts into automated detections where appropriate.
Board reporting is sharper. A1.a now says the board needs enough understanding to discuss how systems contribute to essential functions and what compromise would mean. Security should be treated as an enabler of resilience.
How to move from 3.2 to 4.0
- Find out which version applies to you. The NCSC has no regulatory powers and tells organisations to ask their regulator whether and how to use the CAF. Your regulator may also set its own timetable.
- Re-score the new and rewritten outcomes first: A2.b, A4.b, C1.f and C2.a. Old scores for C2 won't carry over cleanly because the outcomes were replaced.
- Read the record of changes in full. Many smaller indicator edits sit outside the four headline changes, and A2's assurance outcome moved from A2.b to A2.c, so old evidence references may now point to the wrong place.
- Update your evidence register and any supplier questionnaire to cover software provenance and support.
- Report the changed position to your board, explaining that a lower score can reflect a stricter framework and not a weaker control.
CAF 4.0 and the Bill
The Bill as brought from the Commons doesn't mention the CAF. It requires measures that are appropriate and proportionate, and it gives ministers power under Part 3 to set further security and resilience requirements through regulations. In the Lords, the minister was reported as saying forthcoming requirements would be aligned with the CAF. The details have not been settled, and the NCSC has said it plans further versions to keep pace with the Bill. Treat 4.0 as the current benchmark, not the final word.
Sources
Frequently asked questions
The NCSC record of changes is dated 4 August 2025, and the NCSC announced it on 6 August 2025. It replaced version 3.2 from April 2024.
It keeps 14 principles. The main additions are at outcome level, including A2.b Understanding Threat and A4.b Secure Software Development and Support, and C2 has been rewritten as Threat Hunting.
Not as such. The NCSC has no regulatory powers and tells organisations to ask their regulator whether to use the CAF. The Bill as brought from the Commons does not name it, though future requirements may draw on it.
The NCSC says coverage of AI-related cyber risk has been strengthened. In the text this mostly appears through wording on emergent technologies and automated decision-making, not a separate AI principle.