Cyber Assessment Framework
Cyber security guidance for organisations that support essential services or are critical to the UK’s security and prosperity.
Page 1 of 25
iStock.com/ThinkNeo
What is the Cyber Assessment Framework?
The Cyber Assessment Framework (CAF) is the UK’s approach to assessing and improving cyber resilience. Developed by the National Cyber Security Centre (NCSC), it provides a common structure for assessing cyber resilience, helping organisations understand whether they are managing cyber risk appropriately and identify where improvement is needed. It focuses on the resilience of network and information systems supporting essential functions or critical services whose disruption could have significant operational, economic or societal consequences.
Who is the CAF for?
It is used across sectors currently regulated under NIS and wider CNI, government and other sectors where maintaining operational resilience is essential. While originally developed to support cyber oversight and regulatory activities, the CAF can also be used by organisations seeking a structured, outcomes-based approach to managing cyber risk.
How the CAF works
The CAF is an outcomes-based framework. Rather than prescribing specific technologies or controls, it describes the outcomes organisations should achieve to manage cyber risk effectively. This allows organisations to apply the framework in ways that reflect their operational environment, technology landscape and risk profile.
The CAF is organised around 4 objectives:
-
Managing security risk
Ensuring effective governance, risk management, asset management and supply chain security.
-
Protecting against cyber attack
Implementing measures to protect systems, data and services from compromise.
-
Detecting cyber security events
Identifying malicious activity and potential cyber incidents.
-
Minimising the impact of cyber security incidents
Preparing for, responding to and recovering from cyber events.
A CAF assessment considers how well an organisation achieves the contributing outcomes within these objectives, using evidence and expert judgement rather than a simple checklist approach.
CAF profiles
A CAF profile sets a minimum level of achievement across the framework’s contributing outcomes. Profiles help organisations understand the level of cyber resilience expected in response to a defined threat level, and provide a consistent benchmark against which resilience can be assessed.
Profiles are informed by threat analysis and attacker capability. They help organisations focus investment and improvement activity on the areas most important for achieving resilience against relevant cyber threats.
CAF Core Profile
The CAF Core Profile establishes a common, threat-informed benchmark for cyber resilience. Developed collaboratively by regulators, government and the NCSC, it establishes a minimum level of cyber resilience for organisations facing moderately sophisticated cyber adversaries, and supports the transition to CAF version 4.0.
Important!
Some organisations may face more advanced threats or operational requirements that justify higher expectations than the minimum level of cyber resilience which the Core Profile describes.
The profile brings together lessons from years of CAF implementation and analysis of cyber attacks across multiple sectors. It identifies the outcomes required to counter the tools and techniques used by moderately capable adversaries, including ransomware, supply chain compromise, exploitation of legacy technology and other forms of moderately sophisticated cyber attack.
The Core Profile:
- establishes a common minimum baseline for cyber resilience across regulated sectors
- reflects the techniques and behaviours associated with moderately sophisticated adversaries
- supports greater consistency between sectors while allowing organisations and regulators to set higher expectations where required
- provides a foundation on which additional sector-specific requirements can be built
Why the Core Profile matters
Cyber threats continue to evolve in scale, sophistication and impact. Organisations which support essential services and those which are critical to the UK’s security and prosperity increasingly face similar attack techniques, regardless of sector. The Core Profile provides a shared reference point for cyber resilience expectations, helping organisations focus on the outcomes most likely to improve their ability to withstand, respond to and recover from cyber incidents.
By providing a consistent benchmark across sectors, the Core Profile supports greater alignment in how cyber resilience is understood, assessed and improved. At the same time, it preserves flexibility for regulators, oversight bodies and organisations to address sector-specific risks and requirements.
A minimum starting point, not an end state
The Core Profile should be viewed as a minimum benchmark rather than a final measure of cyber resilience. It reflects a baseline level of resilience against attack techniques used by moderately sophisticated adversaries. Some organisations may face more advanced threats, or have operational requirements that justify resilience measures beyond those represented in the profile. Achieving the Core Profile does not eliminate cyber risk and should not be treated as a one-off exercise.
CAF profiles are linked to specific CAF versions and should be reviewed as threats evolve and the framework develops. Organisations should continue to assess and manage cyber risk proactively, taking account of changes in their operating environment, technology and threat landscape.
Using the CAF
Effective use of the CAF starts with understanding the essential functions and services that matter most to an organisation. Assessments should be scoped carefully to include the systems, dependencies, interfaces and supporting functions that are critical to delivering those outcomes.
The CAF is designed to support:
- 1
Identification of essential functions and critical services.
- 2
Assessment of cyber resilience against a defined target profile.
- 3
Identification of strengths, weaknesses and risk exposures.
- 4
Prioritisation of improvement activity.
- 5
Ongoing monitoring and review of cyber resilience.
Organisations may choose to undertake self-assessments, but independent audit, assurance or testing activities generally provide greater confidence in assessment outcomes. Organisations seeking an independent assessment can use the NCSC’s Cyber Resilience Audit (CRA) scheme to find suitable audit providers. However, the appropriate approach will depend on the organisation's context, risk profile and any sector-specific expectations.
Assurance and claims
The CAF helps organisations assess and improve cyber resilience, but it is not a certification scheme. Achievement of a CAF Profile should not be interpreted as a guarantee of security or resilience, nor should it be presented as evidence of NCSC certification or endorsement.
Where organisations communicate CAF assessment outcomes, they should be clear about:
- the CAF version used
- the CAF profile used
- the scope of the assessment
- whether the assessment was self-assessed or independently reviewed
- any assumptions, limitations or ongoing improvement activity
