NCSC Cyber Assessment Framework (CAF) Assessments & Implementation
The Cyber Assessment Framework is the NCSC’s outcome-based method for assessing how well an organisation manages cyber risk to essential functions. It is used by NIS regulators, NHS England (through the DSPT), UK government (GovAssure) and increasingly by critical-infrastructure suppliers.
It has four objectives — managing security risk, protecting against cyber attack, detecting cyber security events and minimising the impact of incidents — broken into principles and contributing outcomes. Mutex Systems runs independent CAF assessments and helps you reach the profile your regulator expects.
- Category
- Compliance Framework
- Jurisdiction
- United Kingdom
- Issuing Body
- National Cyber Security Centre (NCSC)
- Current Version
- CAF version 4.0 (2025)
- Who It's For
- Operators of essential services under the NIS Regulations, relevant digital service providers, NHS organisations, government departments and their critical suppliers.
Core Domains
A Practical Compliance Path
- 01
Scope essential functions
Identify the networks and systems that support your essential functions.
- 02
Assess outcomes
Rate each contributing outcome as achieved, partially achieved or not achieved, with evidence.
- 03
Compare to target profile
Measure against your regulator’s or sector’s expected profile.
- 04
Improvement plan
Prioritised plan, often combining monitoring (SOC), identity and supply-chain work.
Outcomes backed by evidence
CAF is not a checklist. We test claims technically — for example by checking monitoring coverage against Objective C — so assessments stand up to regulator review.
- Independent CAF assessments
- Technical validation of key outcomes
- Improvement plans tied to budget and timescale
CAF outcomes tracked over time
grComply holds CAF objectives, principles and contributing outcomes with evidence and ratings, cross-mapped to ISO 27001 and NIS2, so progress against your target profile is always visible.
- Contributing outcomes with achievement ratings
- Evidence reuse from ISO 27001
- Target-profile gap view
- Mapping to DSPT and NIS
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About NCSC CAF
What is the NCSC Cyber Assessment Framework?
A framework from the UK National Cyber Security Centre for assessing how well an organisation protects the systems that support essential functions, using four objectives (A–D), fourteen principles and a set of contributing outcomes.
Who uses the CAF?
NIS competent authorities for operators of essential services, NHS England through the CAF-aligned DSPT, UK government departments through GovAssure, and organisations that want a rigorous, outcome-based assessment.
What is a CAF profile?
A set of target achievement levels for each contributing outcome, defined by a regulator or sector. Your assessment is compared with the profile to show where improvement is needed.
How is CAF different from ISO 27001?
ISO 27001 certifies a management system and its controls. CAF assesses outcomes for essential functions and is used by UK regulators. They complement each other, and evidence from ISO 27001 often supports CAF outcomes.
Ready to Start Your NCSC CAF Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.