In short: The NCSC Cyber Assessment Framework (CAF) is an outcome-based framework for assessing how well organisations that run essential services manage cyber risk. Version 4.0, released in August 2025, has four objectives and 14 principles, broken into contributing outcomes judged against indicators of good practice rather than a fixed checklist.
What the CAF is
The Cyber Assessment Framework (CAF) was created by the National Cyber Security Centre to give a consistent way of assessing the cyber resilience of organisations whose failure would hurt the public: energy, transport, health, drinking water, digital infrastructure and government. It supports both an organisation's own self-assessment and external oversight, and helps organisations meet legal duties such as those under the NIS Regulations 2018.
Unlike Cyber Essentials, which sets out specific technical controls, the CAF describes outcomes. It says what good looks like, for example that you understand your supply chain risks or can detect an attack in progress, and leaves it to you to decide how to achieve it. The NCSC is explicit that the framework is meant to discourage tick-box assessments; the indicators are a starting point for expert judgement, not an exhaustive checklist.
The NCSC CAF collection holds the full framework, guidance for each principle and a downloadable version of CAF v4.0.
How the CAF is structured
The framework is layered:
- Four objectives (A to D), the high-level aims.
- Fourteen principles that sit under the objectives.
- Contributing outcomes that break each principle into specific results.
- Indicators of good practice (IGPs) that help an assessor decide whether each outcome has been met.
| Objective | Principles |
|---|---|
| A. Managing security risk | A1 Governance; A2 Risk management; A3 Asset management; A4 Supply chain |
| B. Protecting against cyber attack | B1 Service protection policies, processes and procedures; B2 Identity and access control; B3 Data security; B4 System security; B5 Resilient networks and systems; B6 Staff awareness and training |
| C. Detecting cyber security events | C1 Security monitoring; C2 Threat hunting |
| D. Minimising the impact of cyber security incidents | D1 Response and recovery planning; D2 Lessons learned |
Each contributing outcome is rated achieved (green), not achieved (red) or, where the framework offers it for that outcome, partially achieved (amber). Achieved normally means all the listed good-practice indicators are met, while a single not-achieved indicator is usually enough for a not-achieved rating. Partially achieved has to reflect specific, worthwhile security benefits, not loosely related activity. An indicator may not apply where compensating measures meet the same aim, and assessments can be carried out by the organisation itself or by an independent party such as a regulator or an NCSC-assured provider.
What changed in CAF v4.0
The NCSC changelog records version 4.0 as released on 4 August 2025, replacing version 3.2 from 15 April 2024. The NCSC announced it on 6 August 2025 as a response to a growing threat to essential services. It described four major changes:
- Understanding attackers. New material to help organisations understand the methods and motivations of attackers, so they make better risk decisions.
- Secure software. A new section on making sure the software used in essential services is developed and maintained securely.
- Monitoring and threat hunting. The security monitoring and threat hunting material under objective C was updated to improve detection.
- AI. Better coverage of the cyber risks that come with artificial intelligence, spread across the framework.
The 14 principles and four objectives are unchanged in name. If your organisation last self-assessed against an earlier version, ask your regulator or sector body which version and profile it expects you to assess against, and when. The NCSC publishes a changelog document for each release on its changelog page.
Who uses the CAF
The NCSC describes the CAF as aimed mainly at operators of essential services in sectors such as energy, healthcare, transport, digital infrastructure and government. In practice that means:
- Operators of essential services regulated under the NIS Regulations 2018, for whom it is a way to show they meet their legal security duties.
- Regulators and other cyber oversight bodies, which set the target levels and interpret the results. The NCSC itself has no regulatory role.
- Other organisations that play a vital role in UK life and choose to use it to assess and improve their resilience.
NHS England has also produced a CAF-aligned version of the Data Security and Protection Toolkit for some health and care organisations.
To set a target level, the NCSC publishes CAF profiles. The Basic Profile is a cross-sector target suited to defending against attackers with basic capability. Enhanced Profiles build on it for sectors facing more capable, better-resourced attackers. The NCSC also runs the Cyber Resilience Audit (CRA) scheme, launched in October 2024, which assures providers of CAF-based audits.
If the Cyber Security and Resilience Bill becomes law and brings more organisations into the NIS regime, more of them are likely to meet the CAF.
CAF vs Cyber Essentials
| Cyber Essentials | Cyber Assessment Framework | |
|---|---|---|
| Approach | Specific technical controls | Outcomes and indicators of good practice |
| Breadth | Five controls on devices, accounts and cloud services | Governance, risk, supply chain, protection, detection, response and recovery |
| Who it is for | Any organisation | Operators of essential services and other organisations vital to UK life |
| Result | A certificate, valid for 12 months | Outcome ratings, with target levels set and results interpreted by a regulator or oversight body |
| Effort | Days to weeks for most organisations | A substantial, ongoing programme |
The two are complementary. The five Cyber Essentials controls cover ground that sits mostly within objective B, such as identity and access control and system security, but say nothing about threat hunting, incident exercises or lessons learned. A CAF-assessed organisation will still benefit from Cyber Essentials across its corporate IT and from asking its suppliers to hold it (see Cyber Essentials for supply chain assurance).
How we help
Forever Systems is not a CAF auditor and does not provide Cyber Resilience Audits. Where we help is the technical foundation the CAF assumes: identity and access control with MFA, patching, secure device configuration, endpoint protection and monitoring, and Cyber Essentials certification for your estate and suppliers, working alongside an IASME-licensed Certification Body. Contact us to discuss where your gaps are.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the latest version of the NCSC CAF?
Version 4.0. The NCSC changelog dates it 4 August 2025, and it replaced version 3.2, released in April 2024.
Is the CAF mandatory?
Not for everyone. It helps operators of essential services meet their duties under the NIS Regulations, and their regulators set the target levels and interpret the results. Some health and care organisations complete a CAF-aligned version of the NHS DSP Toolkit. For other organisations it is voluntary guidance.
What are the four CAF objectives?
A: managing security risk; B: protecting against cyber attack; C: detecting cyber security events; D: minimising the impact of cyber security incidents. Together they contain 14 principles.
Is the CAF a checklist?
No. It sets outcomes and gives indicators of good practice to guide expert judgement. The NCSC says the indicators are not an exhaustive checklist and that the framework is designed to discourage tick-box assessments.
What are CAF profiles?
CAF profiles set a target level of achievement. The Basic Profile is a cross-sector target for defending against attackers with basic capability, typically common cyber attacks. Enhanced Profiles are sector-specific and build on the Basic Profile for organisations facing more capable, better-resourced attackers.
Do CAF-assessed organisations still need Cyber Essentials?
The CAF does not replace Cyber Essentials, and the two do different jobs. Many CAF-assessed organisations also hold Cyber Essentials for their corporate IT and require it from suppliers.