What is the Cyber Assessment Framework?
The Cyber Assessment Framework (CAF) is a cybersecurity and resilience framework developed by the UK National Cyber Security Centre (NCSC). It helps organizations assess how effectively they manage cyber risks to their essential functions and services.
CAF 4.0 is primarily relevant to organizations in critical sectors such as energy, healthcare, transportation, drinking water, digital infrastructure, telecommunications and government. It can also apply to suppliers and managed service providers that support essential services.
The framework is closely associated with the UK Network and Information Systems Regulations 2018. UK regulators and other cyber oversight bodies may use the CAF to assess regulated organizations. However, the CAF is not itself a law or a general certification scheme. Whether its use is mandatory depends on the organization’s regulator, sector or contractual obligations.
CAF 4.0 contains four objectives, 14 principles and 41 contributing outcomes. These cover managing security risk, protecting against cyberattacks, detecting cybersecurity events and minimizing the impact of incidents. Organizations assess each outcome as Achieved, Partially Achieved, Not Achieved or, where justified, Not Applicable.
Released in August 2025, CAF 4.0 introduced stronger coverage of threat-informed risk management, secure software development, security monitoring, threat hunting and AI-related cyber risks. It also introduced Basic and Enhanced Profiles for organizations facing different levels of threat.
What are the requirements for the Cyber Assessment Framework?
Organizations must first identify the essential functions being assessed and the systems, data, people, facilities and suppliers that support them. They must then assess their cybersecurity and resilience arrangements against the 41 CAF contributing outcomes and the related Indicators of Good Practice.
Basic organizational requirements include defined cybersecurity governance, senior-management accountability, risk and asset management, supply-chain security, access control, data protection, system security, secure software development, staff training, security monitoring, incident response and recovery planning.
Organizations should determine which CAF Profile and sector-specific requirements apply, complete a baseline assessment, collect supporting evidence and identify gaps. They must then assign responsible owners, implement remediation measures, test their controls and maintain evidence showing how each applicable outcome is achieved.
CAF can complement ISO/IEC 27001, ISO/IEC 27002, the NIST Cybersecurity Framework, Cyber Essentials and IEC 62443. Existing controls and evidence from these standards may support a CAF assessment, but they do not automatically demonstrate that the CAF outcomes have been achieved.
The NCSC develops and maintains the CAF but does not approve every assessment. The relevant regulator or cyber oversight body determines the required Profile, evidence and assessment process. Assessments may be completed internally or independently, including through an NCSC-assured Cyber Resilience Audit provider where required.
Why should you be compliant with Cyber Assessment Framework?
Meeting the applicable CAF 4.0 Profile helps an organization demonstrate that it is managing cyber risks to its essential functions in a structured and proportionate manner. It can support regulatory assurance, improve operational resilience and provide greater confidence to customers, government bodies and business partners.
CAF compliance can help organizations identify security weaknesses, prioritize improvements and strengthen their protection against ransomware, supply-chain compromise and service disruption. It also supports clearer accountability, improved monitoring and more effective incident response and recovery.
Failure to meet CAF expectations may lead to regulatory scrutiny, mandatory remediation, contractual limitations or difficulty participating in regulated and public-sector opportunities. It can also leave an organization more exposed to security incidents, operational disruption, financial loss and damage to essential services.
A low CAF result does not automatically create a legal penalty. However, organizations regulated under the NIS Regulations may face enforcement action and financial penalties if their security, resilience or incident-reporting arrangements do not meet the applicable legal requirements.
How to achieve compliance?
Centraleyes simplifies the path to CAF 4.0 compliance by turning complex requirements into a clear, actionable process. The platform identifies compliance gaps, assigns remediation tasks, centralizes evidence and tracks progress in real time.
With automated assessments, cross-framework control mapping and clear dashboards, Centraleyes reduces manual work and helps your organization move from assessment to audit readiness faster – all from one centralized platform.
Read more: NCSC Cyber Assessment Framework