The short answer
The Cyber Assessment Framework (CAF) is the NCSC's outcome-based method for assessing how well an organisation manages cyber risk to the essential functions it provides. Version 4.0, released in August 2025, has 4 objectives, 14 principles and 41 contributing outcomes, each judged achieved, partially achieved or not achieved.
On this page
- What is the NCSC Cyber Assessment Framework?
- What are the four CAF objectives and 14 principles?
- How is each CAF outcome assessed?
- What are CAF profiles?
- What is CAF 4.0 and what changed?
- Who has to use the CAF?
- How do you carry out a CAF self-assessment?
- How do you benchmark against the CAF if you are not regulated?
- How does the CAF map to ISO 27001 and Cyber Essentials?
- Where does testing evidence fit in a CAF assessment?
- Why Sovereign Secure?
- What should you do next?
The Cyber Assessment Framework (CAF) is the National Cyber Security Centre’s framework for judging how well an organisation manages cyber risk to the essential functions it delivers, such as supplying energy, running a hospital or paying benefits. Instead of a checklist, it describes 41 outcomes an organisation should achieve, and an assessor decides whether each one is achieved, partially achieved or not achieved.
The CAF first appeared in April 2018 to support the UK’s Network and Information Systems (NIS) Regulations. CAF 4.0, the current version, was released in August 2025 (we last checked the NCSC CAF collection on 13 October 2026, and 4.0 is still current). It is now used well beyond NIS: by central government, by large NHS organisations and, on a voluntary basis, by councils.
What is the NCSC Cyber Assessment Framework?
The NCSC Cyber Assessment Framework is a structured set of objectives, principles, contributing outcomes and indicators of good practice (IGPs) describing good cyber security and resilience for organisations running essential functions. The framework is free on the NCSC CAF collection.
Two features set it apart from a standard such as ISO 27001. It is outcome-based, describing what should be true and leaving you to decide how to get there. And it relies on expert judgement: the IGPs guide the assessor, but they are not exhaustive and not every indicator fits every organisation.
The NCSC has no regulatory powers, so whether you must use the CAF, and what result you must reach, is set by your regulator or oversight body.
What are the four CAF objectives and 14 principles?
The CAF has four objectives, A to D, divided into 14 principles. Each principle is assessed through its contributing outcomes, which are labelled by objective, principle number and letter (A1.a, A1.b and so on).
| Objective | Principles | Contributing outcomes in CAF 4.0 |
|---|---|---|
| A. Managing security risk | A1 Governance, A2 Risk management, A3 Asset management, A4 Supply chain | 9: board direction, roles and responsibilities, decision-making, risk management process, understanding threat, assurance, asset management, supply chain, and secure software development and support |
| B. Protecting against cyber attack | B1 Service protection policies, processes and procedures, B2 Identity and access control, B3 Data security, B4 System security, B5 Resilient networks and systems, B6 Staff awareness and training | 20, including privileged user management, data in transit, stored data, secure configuration, vulnerability management, design for resilience, backups and cyber security culture |
| C. Detecting cyber security events | C1 Security monitoring, C2 Threat hunting | 7: logging sources and tools, securing logs, generating alerts, triage, monitoring skills, understanding user and system behaviour and threat intelligence, and threat hunting |
| D. Minimising the impact of cyber security incidents | D1 Response and recovery planning, D2 Lessons learned | 5: response plan, response and recovery capability, testing and exercising, post-incident analysis, and using incidents to drive improvements |
How is each CAF outcome assessed?
Every contributing outcome has an IGP table with up to three columns, and the assessor compares the organisation’s evidence with each column.
- Achieved (green): all the indicators would normally be present, unless a compensating measure meets the same aim.
- Not achieved (red): any one indicator is normally enough to justify this rating.
- Partially achieved (amber): used for some outcomes only. The partial result must deliver a real security benefit, not credit for doing something loosely related.
The result is 41 separate judgements. The NCSC notes that achieving all 41 would mean security some way beyond basic cyber hygiene, so oversight bodies set a target profile instead: the outcomes that must be achieved, those where partially achieved is enough, and any that are not applicable.
What are CAF profiles?
A CAF profile is a target level of resilience against attackers with a given level of capability. The NCSC describes a Basic profile that applies across sectors and is aimed at attackers with basic capability, and Enhanced profiles set sector by sector for organisations facing more capable, better-resourced attackers. Central government uses its own pair, called Baseline and Enhanced, under GovAssure.
Ask your regulator or scheme which profile applies before you start. It decides which outcomes you must evidence, and to what level.
What is CAF 4.0 and what changed?
CAF 4.0 is the version the NCSC released in August 2025, replacing v3.2 from April 2024. It grows from 39 to 41 contributing outcomes and puts more weight on understanding threats and on software.
| Change in CAF 4.0 | Outcome | In plain terms |
|---|---|---|
| New outcome | A2.b Understanding threat | Your risk decisions draw on a documented understanding of who might attack you and how |
| New outcome | A4.b Secure software development and support | You have assurance over how the software you build or buy is developed and maintained |
| New outcome | C1.f Understanding user and system behaviour, and threat intelligence | You know what normal looks like and use threat intelligence to spot attacks |
| Restructured | C2 Threat hunting | The principle formerly called proactive security event discovery now has a single threat hunting outcome |
Regulators and schemes adopt new CAF versions on their own timetables, so confirm which version your next assessment should use before you update your evidence.
Who has to use the CAF?
No single law requires every organisation to use the CAF. It applies where a regulator or scheme adopts it.
| Who | How the CAF applies |
|---|---|
| Operators of essential services under the NIS Regulations 2018 | Many NIS competent authorities use the CAF, or a sector version of it, to assess the operators they regulate |
| Central government departments and other government organisations | GovAssure, the government’s cyber assurance scheme since April 2023, uses the CAF with Baseline and Enhanced profiles |
| NHS trusts, integrated care boards, commissioning support units and DHSC arm’s length bodies | Since 2024-25 these organisations complete a CAF-aligned version of the Data Security and Protection Toolkit (see our NHS DSPT guide) |
| Local authorities in England | The CAF for local government, developed by MHCLG’s Local Digital team and piloted with councils, is voluntary and sits alongside PSN rather than replacing it |
| Organisations brought in by future legislation | The Cyber Security and Resilience Bill, introduced to Parliament in November 2025, would extend the NIS regime to more organisations, including managed service providers and data centres |
| Everyone else | A voluntary benchmark, often requested by public sector customers and regulated clients |
How do you carry out a CAF self-assessment?
Most CAF work starts as a self-assessment. A credible one follows the order an independent assessor would:
- Define your essential functions, the services whose disruption would cause real harm.
- Scope the systems, suppliers and cloud services each function depends on.
- Confirm the target profile and CAF version with your regulator or scheme.
- Gather evidence: policies, risk registers, asset inventories, test reports, exercise reports and incident reviews.
- Rate each outcome against its IGP table, recording the reasoning and evidence, not just the colour.
- Build an improvement plan that prioritises gaps against the target profile, with owners and dates.
- Arrange independent review where your scheme requires it.
How do you benchmark against the CAF if you are not regulated?
Many organisations use the CAF voluntarily because it is the framework their public sector and regulated customers understand. Suppliers to the NHS, government, utilities and transport operators can reuse one set of CAF ratings when answering security questionnaires.
A practical approach is to score every outcome once, set the Basic profile as an initial target and re-score each year. Consistent ratings let the board see progress, and the gaps point to specific work. The exercise also exposes areas that certification schemes do not cover, notably monitoring, threat hunting and tested incident response.
How does the CAF map to ISO 27001 and Cyber Essentials?
The CAF does not replace either scheme, but there is considerable overlap. ISO 27001 is a certifiable management system, Cyber Essentials certifies five technical controls, and the CAF assesses outcomes for essential functions. The table below is our indicative mapping to ISO 27001:2022 Annex A controls, not an official NCSC mapping.
| CAF principle | ISO 27001:2022 clauses and Annex A | Cyber Essentials control |
|---|---|---|
| A1 Governance | Clause 5; A.5.1, A.5.2, A.5.4 | Not covered |
| A2 Risk management | Clauses 6.1, 8.2 and 8.3; A.5.7 | Not covered |
| A3 Asset management | A.5.9 | Partly, through the device scope |
| A4 Supply chain | A.5.19 to A.5.23; A.8.25, A.8.28 to A.8.30 | Not covered |
| B1 Policies, processes and procedures | A.5.1, A.5.37 | Not covered |
| B2 Identity and access control | A.5.15 to A.5.18; A.8.2, A.8.5 | User access control |
| B3 Data security | A.5.12, A.5.14, A.7.14, A.8.10, A.8.24 | Not covered |
| B4 System security | A.8.7 to A.8.9, A.8.20, A.8.22, A.8.27 | Firewalls, secure configuration, security update management, malware protection |
| B5 Resilient networks and systems | A.5.30, A.8.13, A.8.14 | Not covered |
| B6 Staff awareness and training | Clause 7.3; A.6.3 | Not covered |
| C1 and C2 Monitoring and threat hunting | A.5.7, A.8.15, A.8.16 | Not covered |
| D1 Response and recovery planning | A.5.24 to A.5.26, A.5.29, A.5.30 | Not covered |
| D2 Lessons learned | Clause 10.2; A.5.27 | Not covered |
The pattern is clear. An ISO 27001 management system covers most CAF ground at the management level, while Cyber Essentials touches only parts of principles B2 and B4, plus the device scope behind A3. Organisations holding both usually still have gaps in objective C, in resilience (B5) and in evidence that incident response has been tested.
Two other frameworks help close those gaps. The CIS Controls give a prioritised technical checklist for much of objectives B and C, including logging, network monitoring and data recovery. The board-level duties behind principle A1 are set out in the Cyber Governance Code of Practice, which DSIT has mapped to the CAF.
Where does testing evidence fit in a CAF assessment?
Several outcomes ask for proof that controls work, not just that they exist:
- A2.c Assurance: independent penetration testing and audits show that your view of risk matches reality.
- B4.d Vulnerability management: regular vulnerability scans and patch records show weaknesses are found and closed on time.
- B2 and B4: Cyber Essentials Plus includes hands-on testing of a sample of in-scope devices, supporting access control, configuration and patching outcomes for that scope.
- D1.c Testing and exercising: a documented cyber tabletop exercise shows your incident response plan has been rehearsed.
For a structured review before a formal assessment, see our guide to a cyber security audit.
Why Sovereign Secure?
Sovereign Secure Ltd has been a UK company since 2012 (Companies House 08334453), headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. We are an IASME-licensed Cyber Essentials certification body, ISO 27001 certified, a PCI SSC-approved QSA, QPA and CPSA company, and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028.
For CAF work, our services produce evidence that maps to specific contributing outcomes: Cyber Essentials and Cyber Essentials Plus certification, ISO 27001 consultancy, penetration testing and vulnerability scanning. We do not set your target profile or replace your regulator’s assessment, and where a scheme requires an assessor from an approved list, check that list first.
What should you do next?
Download CAF 4.0 from the NCSC, confirm your target profile with your regulator and list the evidence you already hold against each objective. Then tell us which outcomes are weakest and we will say which of our services, if any, would close the gap. Use the enquiry form on this page or call +44 161 523 5276.
Your next step
- ISO 27001 checklistClause-by-clause readiness and a Stage 1 and Stage 2 audit checklist, free in Excel.Get the checklist
- Statement of Applicability templateAll 93 Annex A controls in a free spreadsheet, with a worked example.Get the SoA template
- Get an ISO quoteConsultancy from an ISO 27001-certified firm, with audits through our partner certification body, MQA International.Get an ISO quote
Last reviewed October 2026 by the Sovereign Secure assessment team.
