NCSC CAF

The Cyber Assessment Framework (CAF) is the UK National Cyber Security Centre's outcome-based framework for assessing the cyber resilience of organizations that run essential functions.

It was created in 2018 to give competent authorities under the NIS Regulations a common assessment tool and is now used by nearly all UK cyber regulators, by the GovAssure scheme for central government departments, and increasingly by devolved administrations and public bodies.

The CAF has four objectives (managing security risk, protecting against cyber attack, detecting cyber security events, minimizing the impact of incidents), 14 principles, and a set of contributing outcomes, each with indicators of good practice used to rate the outcome as Achieved, Partially Achieved, or Not Achieved.

Version 3.1 (April 2022) introduced the Partially Achieved level widely; version 3.2 (April 2024) made targeted changes; version 4.0 (August 2025) added outcomes on secure software development, AI-related risk, and threat hunting and realigned wording for NIS2-style expectations (verify the current version on the NCSC collection page).

The CAF is not a certificate. Operators self-assess against the CAF profile their regulator sets (each competent authority publishes the outcomes it expects for its sector), regulators review and may inspect, and GovAssure uses independent assurance reviewers to verify departmental self-assessments.

In writing, an organization needs the CAF self-assessment with evidence per contributing outcome, its risk management framework and governance records, asset and dependency inventories, security policies and their implementation evidence, monitoring and detection capabilities, incident response and recovery plans with exercise records, and improvement plans agreed with the regulator.