CAF self-assessment: how to do it and what evidence to keep

Why self-assess now

Organisations preparing for the Cyber Security and Resilience Bill (CSRB) often start with a Cyber Assessment Framework (CAF) self-assessment, because it gives them a structured view of their gaps and a way to explain them to the board. The Bill's text doesn't require one, so check with your regulator whether and how it expects you to use the CAF. The National Cyber Security Centre (NCSC) wrote the CAF so that it can be used for self-assessment or by an independent assessor.

How the scoring works

CAF 4.0 has four objectives, 14 principles and 41 contributing outcomes, according to the NCSC. Each outcome has a table of indicators of good practice.

Rating	What it typically means
Achieved	All the indicators in the column are present, unless compensating measures meet the same goal
Partially achieved	Only available for some outcomes. All the indicators are present, and the partial position delivers a specific, worthwhile benefit
Not achieved	Normally, any one of the listed indicators is enough to justify this rating

The NCSC is clear that the indicators are not "a checklist to be used in an inflexible assessment process". They inform expert judgement, so you need to justify each rating.

A seven-step method

1. Define your essential functions. Everything in the CAF is measured against them. If your scope is "the whole company", the assessment becomes too broad to be useful.
2. Map the systems they rely on, including suppliers and shared services. This becomes your assessment boundary.
3. Ask about a target. A CAF profile sets the level to reach for each outcome. The NCSC doesn't set profiles; a cyber oversight body or regulator does. If none exists for you, agree an internal target and record your reasoning.
4. Name an owner for each outcome, and pair them with someone independent of the control to challenge the score.
5. Gather evidence before you score. Scoring first tends to produce evidence that supports a rating you've already decided on.
6. Score, then test. Run a review session where someone argues the opposite case. Sample real records, not just policies.
7. Turn gaps into a plan with owners, dates and costs, then report it to the board.

What good evidence looks like

The NCSC doesn't publish a mandatory evidence list. These are our examples of what an assessor is likely to find persuasive.

Principle	Weak evidence	Stronger evidence
A1 Governance	A policy that names the CISO	Board minutes showing regular discussion and a board-level owner
A2 Risk management	A risk register entry	Threat scenarios linked to specific decisions and controls
A4 Supply chain	Supplier questionnaires on file	Contract clauses, a sub-contractor map, third-party connection records
B2 Identity and access	An access policy	Privileged account review records with actions completed
B4 System security	A patching policy	Patch and vulnerability reports over time, third-party test results
C1 Security monitoring	A list of log sources	Detection coverage mapped to threats, alert triage records
C2 Threat hunting	"We hunt when needed"	Hunt records with hypotheses, and detections created from them
D1 Response planning	An incident plan	Exercise reports, including whether you could meet a 24-hour notification
D2 Lessons learned	A post-incident template	Completed reviews and evidence the fixes were made

Keep a simple evidence register: outcome, rating, rationale, evidence link, date, owner and review date. Evidence ages quickly, so date everything.

Continuous improvement

The CAF has no outcome called "continuous improvement", but the idea runs through it. Assurance methods should be reviewed to check they remain appropriate, threat hunting should be reviewed against current risk, and incidents should drive improvements under D2.

The best way to show this is a repeat assessment. Keep each round's scores and rationale, and record why a rating changed. We have found no legal rule on what evidence proves improvement under the CAF, so don't treat any template as a legal standard.

Common mistakes

• Treating amber as a safe default. "Partially achieved" should deliver a specific benefit, not "something vaguely relevant".
• Copying last year's answers across a framework that has changed. See our CAF 4.0 guide.
• Scoring only your own systems when a supplier runs the critical part.
• Marking your own homework. Independent review doesn't have to be external, but it must have real challenge.
• Confusing a CAF score with legal compliance. A good score is useful evidence, but the legal test will be set by the final Act, regulations and regulator guidance.

When to bring in an independent assessor

An independent assessment helps when a regulator asks for one, when the board wants assurance, or when your team can't be objective. The NCSC refers to assured commercial service providers acting on a regulator's behalf, so ask your regulator what it will accept before you commission one.

Sources

• NCSC: Introduction to the CAF
• NCSC: Cyber Assessment Framework v4.0 (PDF)