Cyber Assessment Framework
Cyber security guidance for organisations that support essential services or are critical to the UK’s security and prosperity.
Page 2 of 25
Core Profile
The CAF Core Profile defines a consistent baseline of cyber resilience for organisations facing moderately sophisticated cyber adversaries. Built on the NCSC's Cyber Assessment Framework (CAF) v4.0, it brings together lessons from years of sector-specific profile development and reflects the common cyber threats that organisations increasingly face, including ransomware, supply chain compromise, exploitation of legacy technology, and attacks enabled by emerging technologies.
The profile describes the minimum level of cyber security and resilience required of organisations that provide essential services, support critical national infrastructure, or are critical to the UK’s security and prosperity.
The CAF Core Profile has been developed through analysis of real world attack scenarios and is designed to provide a threat-informed benchmark for cyber resilience across sectors, improving consistency while still allowing regulators and organisations to set higher expectations where circumstances require. It supports a more coherent approach to cyber resilience, helping organisations focus on the outcomes that matter most for withstanding and recovering from moderately sophisticated cyber attacks.
The profile will also play an important role in supporting the implementation of the Cyber Security and Resilience Bill (CSRB) by providing a shared reference point for cyber resilience expectations across the UK's essential services and nationally significant organisations.
An X indicates the expected achievement level for each contributing outcome:
- Partially achieved – met through implementation of the Indicators of Good Practice expected at the Partially achieved level.
- Achieved – met through implementation of the Indicators of Good Practice expected at the Achieved level.
| Objective | Principle | Contributing outcome | Not achieved | Partially achieved | Achieved |
|---|---|---|---|---|---|
| A. Managing security risk | A1. Governance | A1.a Board Direction | X | ||
| A1.b Roles & Responsibilities | X | ||||
| A1.c Decision-making | X | ||||
| A2. Risk Management | A2.a Risk Management Process | X | |||
| A2.b Understanding Threat | X | ||||
| A2.c Assurance | X | ||||
| A3. Asset Management | A.3.a Asset Management | X | |||
| A4. Supply Chain | A4.a Supply Chain | X | |||
| A4.b Secure Software Development and Support | X | ||||
| B. Protecting against cyber attack | B1. Service Protection Policies, Processes and Procedures | B1.a Policy & Process Development | X | ||
| B1.b Policy & Process Implementation | X | ||||
| B2. Identity & Access Control (IDAC) | B2.a Identity Verification, Authentication and Authorisation | X | |||
| B2.b Device Management | X | ||||
| B2.c Privileged User Management | X | ||||
| B2.d Identity and Access Management (IDAM) | X | ||||
| B3. Data Security | B3.a Understanding Data | X | |||
| B3.b Data in Transit | X | ||||
| B3.c Stored Data | X | ||||
| B3.d Mobile Data | X | ||||
| B3.e Media/Equipment Sanitisation | X | ||||
| B4. System Security | B4.a Secure By Design | X | |||
| B4.b Secure Configuration | X | ||||
| B4.c Secure Management | X | ||||
| B4.d Vulnerability Management | X | ||||
| B5. Resilient Networks & Systems | B5.a Resilience Preparation | X | |||
| B5.b Design for Resilience | X | ||||
| B5.c Backups | X | ||||
| B6. Staff Awareness & Training | B6.a Cyber Security Culture | X | |||
| B6.b Cyber Security Training | X | ||||
| C. Detecting Cyber Security Events | C1. Security Monitoring | C1.a Sources and Tools for Logging and Monitoring | X | ||
| C1.b Security Logs | X | ||||
| C1.c Generating Alerts | X | ||||
| C1.d Triage of Security Alerts | X | ||||
| C1.e Personnel Skills for Monitoring and Detection | X | ||||
| C1.f Understanding Users' and Systems' Behaviour, and Threat Intelligence (within Security Monitoring) | X | ||||
| C2. Threat Hunting | C2.a Threat Hunting | X | |||
| D. Minimising the Impact of Cyber Security Incidents | D1. Response & Recovery Planning | D1a. Response Plan | X | ||
| D1.b Response & Recovery Capability | X | ||||
| D1.c Testing & Exercising | X | ||||
| D2. Lessons Learned | D2.a Post Incident Analysis | X | |||
| D2.b Using Incidents to Drive Improvements | X |
