Cyber security compliance involves more than documenting policies or demonstrating that security controls exist. Organisations must also understand whether those controls are effective and capable of protecting essential services against evolving threats.
For UK organisations responsible for critical systems and services, the NCSC Cyber Assessment Framework (CAF) provides a structured way to assess cyber security and resilience.
But what does a CAF assessment involve, which organisations need to consider it, and how can businesses prepare?
This guide explains the Cyber Assessment Framework, its key requirements, and the practical steps organisations can take to improve their CAF readiness.
What Is the NCSC Cyber Assessment Framework?
The Cyber Assessment Framework (CAF) is a cyber security assessment framework developed by the UK’s National Cyber Security Centre (NCSC).
It helps organisations assess how effectively they manage cyber risks affecting essential services and critical business functions.
Unlike a traditional compliance checklist, CAF focuses on security outcomes rather than prescribing specific technologies or solutions.
For example, an organisation may have access controls in place, but a CAF assessment considers whether those controls adequately protect the systems and information needed to deliver essential services.
The framework provides a consistent approach to identifying security weaknesses, evaluating resilience and prioritising improvements.
Who Needs to Comply with CAF?
CAF is primarily intended for organisations delivering or supporting essential services and critical national infrastructure.
It is particularly relevant to sectors such as:
- Energy and utilities
- Healthcare
- Transport
- Digital infrastructure
- Government and public services
- Suppliers supporting essential functions
CAF is also used to support cyber security assessments within regulatory and government assurance programmes.
However, CAF is not itself a law or certification scheme. Whether an organisation must undergo a CAF-based assessment depends on its regulatory obligations and relevant sector requirements.
Organisations outside regulated sectors may also use CAF voluntarily to evaluate their cyber security maturity and strengthen resilience.
Understanding the Four CAF Objectives
CAF version 4.0 is structured around four high-level objectives, supported by 14 principles and 41 contributing outcomes.
Together, these establish the capabilities organisations should assess when evaluating cyber resilience.
A. Managing Security Risk
Organisations must understand the cyber risks affecting their essential functions and establish appropriate governance.
This includes security accountability, risk management, asset visibility and supply chain security.
B. Protecting Against Cyber Attack
Appropriate security controls should protect critical systems, networks and information.
This includes identity and access management, data protection, secure system configuration, vulnerability management and staff awareness.
C. Detecting Cyber Security Events
Organisations need capabilities to identify suspicious activity and potential security incidents.
Security monitoring, logging, alerting and threat hunting help detect attacks before they cause significant disruption.
D. Minimising the Impact of Cyber Security Incidents
Organisations must prepare to respond to incidents and restore affected services.
This includes incident response planning, recovery procedures, testing and improvements based on lessons learned.
What Is New in CAF 4.0?
The NCSC released CAF version 4.0 in August 2025, introducing updates to reflect changing cyber threats.
These include greater emphasis on understanding attacker methods, secure software development, security monitoring, threat hunting and risks associated with artificial intelligence.
On 30 October 2026, the NCSC also introduced the CAF Core Profile.
The Core Profile provides a common baseline for cyber resilience against moderately sophisticated cyber adversaries.
It establishes target achievement levels for relevant CAF outcomes, giving organisations a clearer benchmark against which to assess their capabilities.
However, the Core Profile represents a minimum benchmark rather than a universal requirement. Some organisations may need to demonstrate higher levels of resilience depending on their risks and regulatory expectations.
How to Prepare for a CAF Assessment
Preparing for a CAF assessment requires a clear understanding of the organisation’s essential functions, security controls and supporting evidence.
The following steps can help establish an effective assessment process.
1. Identify Critical Systems and Assets
Start by identifying the systems, applications, information and suppliers supporting essential services.
Understanding these dependencies helps establish an appropriate assessment scope and identify areas of greatest operational risk.
2. Determine Applicable CAF Requirements
Review the relevant CAF principles, contributing outcomes and indicators of good practice.
Consider whether an applicable regulator has established a specific CAF profile or additional sector requirements.
3. Gather Security Evidence
Collect documentation and technical evidence demonstrating how security controls operate.
Examples include:
- Cyber security policies and risk assessments
- Asset inventories and supplier records
- Identity and access-control configurations
- Vulnerability assessment and penetration testing results
- Security monitoring and incident records
- Backup, recovery and incident response test results
Evidence should demonstrate the effectiveness of controls rather than simply confirming their existence.
4. Assess Controls and Identify Gaps
Evaluate existing capabilities against the relevant CAF outcomes and indicators of good practice.
Assessments may identify outcomes as achieved, partially achieved or not achieved, depending on the applicable indicators and evidence.
Document weaknesses, missing evidence and areas requiring further investigation.
5. Prioritise and Validate Improvements
Develop remediation plans based on the risks associated with identified weaknesses.
Prioritise issues affecting essential services, critical assets and significant operational dependencies.
Following remediation, reassess the relevant controls to establish whether the expected security outcomes have been achieved.
Common CAF Compliance Challenges
Organisations often encounter difficulties when translating framework requirements into measurable security outcomes.
Incomplete visibility: Unknown systems, suppliers or dependencies can create gaps in risk assessments.
Insufficient evidence: Security controls may exist without adequate documentation or testing results to demonstrate their effectiveness.
Inconsistent implementation: Different departments or environments may apply security requirements differently.
Limited validation: Policies and procedures may appear compliant without being tested against realistic threats.
Poor remediation tracking: Identified weaknesses may remain unresolved without clear ownership, prioritisation and follow-up assessments.
Addressing these challenges requires a continuous approach to security assurance rather than treating compliance as a one-off exercise.
Turning CAF Requirements into Measurable Cyber Resilience
The NCSC Cyber Assessment Framework provides a structured approach to evaluating cyber security and resilience across essential services.
By assessing governance, protection, detection and incident response capabilities, organisations can identify weaknesses and make more informed security decisions.
However, effective CAF readiness requires more than understanding framework requirements. Organisations need reliable evidence, appropriate technical validation and a clear understanding of the risks affecting their critical systems.
SeCore’s Security Assurance services help organisations assess security controls, organise supporting evidence and identify areas requiring improvement.
Through structured assessments, quantitative security scoring and risk-based prioritisation, SeCore helps organisations develop a clearer picture of their security posture and make measurable progress towards stronger cyber resilience.
