NCSC CAF
the UK Cyber Assessment Framework for essential services
The NCSC Cyber Assessment Framework (CAF) is the UK National Cyber Security Centre framework used to assess organisations responsible for essential services and digital infrastructure. The CAF is structured around four objectives, fourteen principles, and thirty-nine contributing outcomes, each evaluated against indicators of good practice. Run a defensible CAF assessment from scoping through evidence, gap analysis, and remediation tracking on one workspace, with the assessor, the cyber regulator, and the in-scope service operator working from the same engagement record rather than parallel spreadsheets.
No credit card required. Free plan available forever.
The NCSC Cyber Assessment Framework explained
The Cyber Assessment Framework, published by the National Cyber Security Centre, is the UK framework used to assess the cyber resilience of organisations responsible for essential services and digital infrastructure. The CAF is structured around four objectives, fourteen principles, and thirty-nine contributing outcomes, each evaluated against indicators of good practice (IGPs) that describe what the assessor expects to see. The framework is outcome based rather than control based: the contributing outcomes describe the security state the in-scope service is expected to reach, and the assessor judges whether the evidence supports that state.
The CAF is the assessment backbone underneath several UK assurance regimes. The Network and Information Systems Regulations apply CAF expectations to Operators of Essential Services and Relevant Digital Service Providers across sectors, with sector regulators inheriting and sometimes profiling the framework for their populations. GovAssure, the cross-government cyber security assurance scheme run by the Cabinet Office with NCSC technical authority, applies CAF-aligned reviews to government departments and arms-length bodies. Critical national infrastructure operators outside formal NIS designation increasingly use the CAF as a common reference framework, especially where sector regulators expect a comparable cyber assurance picture.
Who the CAF applies to and how the in-scope population is determined
The CAF in-scope population covers four broad routes. The route into the cycle determines the regulator, the cadence, and the profile (baseline or enhanced) the service is being held to. The CAF itself is technology and sector neutral; the route into it is what makes the cycle sector specific.
Operators of Essential Services (OES) under the NIS Regulations
Energy, water, transport, healthcare, and digital infrastructure providers designated under the UK Network and Information Systems Regulations. Sector-specific regulators (Ofgem, Ofcom, Ofwat, the CAA, DfT, the DHSC, BEIS) inherit the CAF as the baseline assessment framework for their populations and may layer sector profiles on top.
Government departments and arms-length bodies under GovAssure
GovAssure is the cross-government cyber security assurance scheme run by the Cabinet Office Government Security Group with NCSC technical authority. Departments, agencies, and arms-length bodies undergo CAF-aligned reviews on rolling cycles, with the cyber regulator and the lead government security function reviewing the resulting evidence pack.
Relevant Digital Service Providers (RDSPs)
Online marketplaces, online search engines, and cloud computing services designated under the NIS Regulations. The Information Commissioner is the regulator for RDSPs, applying CAF principles in proportion to the size of the entity and the materiality of the service to the UK economy.
Critical National Infrastructure (CNI) operators outside the NIS perimeter
Many CNI operators sit outside formal NIS designation but inside sector regulator expectations or government supplier obligations. The CAF is increasingly used as a common reference framework across CNI sectors, even where the regulatory route into the assessment differs by sector.
The four objectives, fourteen principles, and thirty-nine contributing outcomes
The CAF is built as a tree. Four objectives sit at the top, each containing principles, and each principle containing contributing outcomes. The contributing outcomes are the unit of assessment: the assessor scores each one against the indicators of good practice attached to it, and the per-outcome scores roll up into the principle and objective view. The framework is designed to be navigable end to end without secondary reference material, and the in-scope organisation is expected to follow it at the same level of granularity the assessor uses.
Objective A: Managing security risk
Governance (A1), risk management (A2), asset management (A3), supply chain (A4). Eleven contributing outcomes covering board oversight, the security policy framework, the risk assessment cycle, the asset inventory of essential service systems, and supplier risk management.
Objective B: Protecting against cyber attack
Service protection policies and processes (B1), identity and access control (B2), data security (B3), system security (B4), resilient networks and systems (B5), staff awareness and training (B6). Sixteen contributing outcomes; the broadest objective by control surface.
Objective C: Detecting cyber security events
Security monitoring (C1), proactive security event discovery (C2). Five contributing outcomes covering the monitoring strategy, the log sources, the detection use cases, the alert triage workflow, and the proactive hunting cycle that surfaces threats the monitoring did not.
Objective D: Minimising the impact of cyber security incidents
Response and recovery planning (D1), lessons learned (D2). Seven contributing outcomes covering the incident response plan, the recovery plan, the exercise programme that tests them, and the discipline that turns the lessons learned into changes to controls and policies.
How contributing outcomes, IGPs, and CAF profiles interact
The mechanics of CAF scoring matter because the framework is not a binary checklist. The assessor reads the contributing outcome, weighs the IGPs underneath, and makes a judgement on Achieved, Partially Achieved, or Not Achieved against the profile (baseline or enhanced) the service is being held to. The same contributing outcome can be Achieved under a baseline profile and Partially Achieved under an enhanced profile because the IGP bar is higher; the artefact has not changed but the standard the artefact is judged against has.
- Each principle carries between two and six contributing outcomes, totalling thirty-nine across the framework, each scored Achieved, Partially Achieved, or Not Achieved.
- Indicators of Good Practice (IGPs) sit underneath each contributing outcome and describe the observable behaviour the assessor expects to see; they are not a checklist but a rubric.
- The CAF profile (baseline or enhanced) sets which contributing outcomes the in-scope service must reach and at which level; the profile is set by the regulator or the lead assurance function, not by the assessed organisation.
- Partially Achieved is a real state, not a failure to fully achieve; capture the IGP-by-IGP determination so the partial state is defensible rather than ambiguous.
- Evidence walks back to a verifiable artefact: a policy version, a configuration file, a scan output, a board minute reference. Narrative without artefact is the assessor finding the rest of the cycle has to fix.
- CAF versions evolve. The framework moved through v3.0, v3.1, and v3.2 as the NCSC refined the IGPs against operational experience; the version of CAF the cycle was assessed against stays attached to the engagement record.
The CAF assessment lifecycle in practice
A CAF cycle runs as a structured assessment, not a one-off review. The work happens in phases that build on each other, and the engagement record carries forward across cycles so the next iteration starts from the prior baseline rather than a blank page. The lifecycle below is the pattern most CAF cycles follow under both NIS-route and GovAssure-route reviews; the regulator-specific procedural detail varies by sector.
- 1Confirm the in-scope essential service or system, the regulator or assurance route into the CAF cycle, the profile (baseline or enhanced) the service is being held to, and the assessor running the cycle.
- 2Build the engagement record: the named accountable executive, the security function point of contact, the cycle dates, the prior CAF profile version (if any), and the artefacts already in place from earlier reviews.
- 3Walk each contributing outcome with the IGPs in front of the team; collect evidence per IGP, identify gaps, and decide a draft Achieved, Partially Achieved, or Not Achieved per outcome with the rationale captured at the time rather than reconstructed during write-up.
- 4Triage gaps into remediation actions with owners and deadlines; tie each action to the contributing outcome it raises against the profile so the post-cycle action register stays auditable rather than detaching from the framework.
- 5Produce the CAF assessment report: the per-outcome scoring, the IGP-level evidence, the gap analysis, the remediation plan, and the version of CAF the cycle followed. The assessor signs the report and the in-scope organisation acknowledges acceptance.
- 6Run the remediation work between cycles, refresh the CAF profile against the new evidence, and roll the engagement record forward so the next cycle inherits the prior IGPs, prior gaps, and prior remediation status as starting context rather than a blank page.
Where penetration testing and red team evidence land inside the CAF
Three contributing outcomes routinely consume penetration testing and adversary simulation evidence: B4 (system security), C1 (security monitoring), and C2 (proactive security event discovery). The CAF expects to see test scope, findings, remediation evidence, and retest outcomes that link back to the in-scope essential service rather than a generic test report bolted onto the submission. Holding the test record on the same workspace as the CAF engagement keeps the line between finding and contributing outcome traceable.
The wider penetration testing operating model that produces this evidence is covered in the penetration testing workflow and the red teaming workflow. For programmes that need a continuous discovery cadence to evidence outcome C2 between formal CAF cycles, the continuous penetration testing workflow keeps the coverage record and the proactive hunting cycle visible against the same engagement record the CAF assessor reviews.
Tagging findings against the MITRE ATT&CK taxonomy sharpens the evidence narrative under Objective C and aligns CAF assessment work with regulator-led intelligence-led testing regimes. The MITRE ATT&CK framework page covers the tagging discipline end to end.
Evidence the assessor expects to see, organised against the framework
CAF cycles that struggle on submission usually struggle because the evidence is scattered across drives, ticketing systems, and email threads, with no clear line from contributing outcome to the artefact that proves it. Build the evidence pack as the work happens, retain raw evidence alongside the structured engagement record, and tie every artefact back to the contributing outcome and IGP it supports. The CAF assessment report reads the way the underlying record reads.
- Information security policy framework with version history, board endorsement, and a named owner per policy area
- Risk register entries scoped to essential service systems, with treatment decisions, residual risk acceptance, and review dates
- Asset inventory of essential service systems, dependencies, and the third parties supporting them
- Identity and access management evidence including privileged access reviews, joiner/mover/leaver logs, and break-glass account audit trails
- Vulnerability scanning, penetration testing, and red team findings tied to the contributing outcome and IGP they evidence (especially under B4, C1, and C2)
- Security monitoring scope, log source coverage of essential service systems, detection use cases, and alert triage workflow records
- Incident response plan, recovery plan, and exercise records covering realistic scenarios with completed actions from prior exercises
- Supplier risk records covering supplier inventories, contractual security clauses, and any in-flight supplier security incidents tied to essential services
- Staff awareness and training completion records segmented by role and scoped to essential service operators where relevant
- CAF profile version, the assessor identity, the cycle date, the assessment report, and the regulator acknowledgement of submission
How the CAF relates to NIS2, DORA, ISO 27001, and the wider UK regime
The CAF is one assessment framework inside a wider regulatory picture. Groups that operate across the UK and the EU, or across multiple sectors, usually find that a single underlying body of evidence satisfies several regimes when it is structured against contributing outcomes rather than against a single submission template. The relevant comparison points include:
- The NIS2 framework page covers the EU successor regime to the NIS Directive that the UK NIS Regulations were aligned with. Many UK groups in scope of the CAF are simultaneously in scope of NIS2 for their EU operations, and the contributing outcomes underpinning a CAF cycle map cleanly against the NIS2 risk management measures.
- The DORA framework page covers the EU Digital Operational Resilience Act for the financial sector. UK financial firms that report under CAF for their UK obligations often map the same evidence base into DORA reporting where they operate across the EU.
- The ISO 27001 framework page covers the international information security management system standard. Many CAF contributing outcomes can be evidenced from ISO 27001 Annex A controls; an organisation with a mature ISMS already holds most of the artefacts a CAF cycle expects.
- The CBEST framework page covers the Bank of England intelligence-led testing regime for UK financial services. The CBEST closure pack feeds directly into CAF outcome C2 (proactive security event discovery) and B4 (system security) for in-scope financial entities. The TIBER-EU framework page covers the EU equivalent.
- The Cyber Essentials framework page and the Cyber Essentials Plus framework page cover the NCSC baseline scheme that smaller UK organisations use when CAF is not the right fit; CAF and Cyber Essentials are complementary rather than alternative.
Where SecPortal fits in the CAF workflow
SecPortal is the operating layer for the CAF engagement, not a replacement for the assessor, the regulator, or the in-scope organisation accountable for the contributing outcomes. The platform handles scope, evidence per outcome, gap analysis, remediation tracking, and the audit trail so the cycle runs as a structured workflow rather than a mailbox of attachments. The same workspace that hosts the CAF cycle hosts the penetration testing, vulnerability scanning, and incident response evidence the contributing outcomes consume, so the line from artefact to outcome stays traceable.
- Engagement management dedicated to the CAF cycle, with phases (scoping, evidence collection, scoring, gap analysis, remediation) tracked as workstreams rather than as one document stitched together at the end
- Findings management with CVSS 3.1 scoring and 300+ templates so vulnerability and red team findings tie back to the contributing outcome they evidence under B4, C1, or C2
- AI report generation that turns the per-outcome evidence and the gap analysis into a structured CAF assessment report and a board-ready summary without manual rewriting
- Compliance tracking that maps the same evidence pack to ISO 27001, NIST CSF, NIS2, and DORA where the in-scope service has parallel obligations across regimes
- Continuous monitoring with scheduled scans so the proactive security event discovery outcome under C2 has a coverage record and a baseline of evidence between cycles
- Attack surface management to map the external footprint of essential service systems before the assessor walks B5 (resilient networks and systems) and B4 (system security)
The remediation work between cycles is where most of the leverage lives. Findings raised against contributing outcomes need owners, deadlines, and verification evidence that walks back to the IGP they affected. The remediation tracking workflow keeps that line auditable; the retesting workflow keeps the verification evidence paired to the original finding rather than opening a parallel record. The compliance audits workflow covers the wider audit cycle that CAF, ISO 27001, and SOC 2 share at the operating layer.
For consultancies delivering CAF assessments to in-scope clients, the security consultants workspace bundles the platform with branded client portals and AI report generation so the CAF assessment report reads as polished as the work behind it. For internal security teams running the CAF cycle in-house against their own essential services, the internal security teams workspace covers the same mechanics from the in-scope-organisation angle.
For programmes that want continuous detection and trend evidence between CAF cycles, the continuous monitoring capability and the attack surface management capability produce the cadence and coverage record that outcome C2 (proactive security event discovery) is expected to evidence. For analytical context on how findings age across remediation cycles, the aging pentest findings research covers what tends to happen to CAF gap actions when the cycle does not carry forward against a structured engagement record.
Key control areas
SecPortal helps you track and manage compliance across these domains.
Objective A: Managing security risk
Objective A covers governance, risk management, asset management, and supply chain. Four principles sit underneath (A1 governance, A2 risk management, A3 asset management, A4 supply chain) with eleven contributing outcomes between them. Capture board oversight, the named accountable executive, the risk register entries linked to essential services, the inventory of assets supporting those services, and the supplier risk records on a structured engagement so the assessor can walk straight from outcome to evidence rather than hunting through shared drives.
Objective B: Protecting against cyber attack
Objective B covers six principles (B1 service protection policies and processes, B2 identity and access control, B3 data security, B4 system security, B5 resilient networks and systems, B6 staff awareness and training). Capture identity and access reviews, network segmentation evidence, data protection controls, hardening baselines, vulnerability management cycles, and security awareness completion records on the same workspace that the rest of the CAF evidence sits on, so the contributing outcomes connect to the artefacts that prove them.
Objective C: Detecting cyber security events
Objective C covers two principles (C1 security monitoring, C2 proactive security event discovery) with five contributing outcomes between them. Document the monitoring strategy, the log sources covering essential service systems, the detection use cases, the alert triage workflow, the threat intelligence feed mapping, and the proactive hunting cycle. Penetration testing reports, vulnerability scan output, and red team exercise findings live on the same record as the monitoring evidence so the proactive discovery outcome reads as one body of work rather than a folder per artefact type.
Objective D: Minimising the impact of cyber security incidents
Objective D covers two principles (D1 response and recovery planning, D2 lessons learned). Hold the incident response plan version history, exercise records, lessons-learned actions, and the evidence that the lessons fed back into the CAF profile assessment. The CAF reviewer expects to see exercises that test the plans against realistic scenarios, completed actions from prior exercises, and a clear line from incident closure to the policy or control change that resulted, not a binder of plans the team has not exercised.
CAF profiles, IGPs, and the achieved/partial/not-achieved scoring
Each contributing outcome carries indicators of good practice (IGPs) that the assessor weighs to assign Achieved, Partially Achieved, or Not Achieved. The CAF profile (baseline or enhanced) determines which contributing outcomes the in-scope service must reach, and which level. Capture the IGP-by-IGP determination, the supporting evidence per IGP, and the rationale where evidence is partial. The scoring should walk back to verifiable artefacts; the assessor narrative reads the way the underlying record reads.
GovAssure, NIS Regulations, and sector regulator inheritance
CAF underpins multiple UK regimes. GovAssure is the cross-government cyber security assurance scheme operated by the Cabinet Office and NCSC, applied to government departments and arms-length bodies through CAF-aligned reviews. The Network and Information Systems Regulations apply CAF expectations to operators of essential services and relevant digital service providers across sectors, with sector-specific regulators (Ofgem, Ofcom, Ofwat, ICO, CAA, DfT, DHSC, BEIS) overseeing inherited CAF profiles. Hold the regime mapping, the regulator contact tree, and the cycle dates on the same engagement record so a single CAF body of work satisfies the regulators that share its underlying evidence.
Pentest, vulnerability assessment, and red team evidence inside CAF
CAF outcomes B4 (system security), C1 (security monitoring), and C2 (proactive security event discovery) explicitly expect penetration testing, vulnerability scanning, and adversary simulation evidence. Hold the engagement scope, findings, remediation evidence, and retest outcomes on the same workspace so the assessor sees the test that produced the finding, the fix that closed it, the verification that proved closure, and the date the contributing outcome moved against the IGP because of that work.
Continuous review cycle, not a point-in-time submission
The CAF is structured for continuous assessment rather than a one-off audit. Profiles refresh over time, IGPs evolve with NCSC guidance versions (the framework moved through v3.0, v3.1, and v3.2 as the threat picture matured), and the regulator expects evidence of ongoing operation rather than a snapshot. Hold the version history of the CAF profile, the dates the assessment was refreshed, the IGP changes between cycles, and the actions taken in response, so the cycle reads as a programme rather than a once-a-year scramble.
Related features
Run an NCSC CAF assessment on one defensible record
Hold the four objectives, the contributing outcomes, the IGP evidence, and the remediation trail in one workspace. Start free.
No credit card required. Free plan available forever.