The UK government's framework for cyber resilience, what it actually asks of you, and exactly where we fit versus what stays with you.
The Cyber Assessment Framework (CAF) is published by the NCSC (the National Cyber Security Centre) to help organisations, particularly those operating essential services, critical national infrastructure, and public sector bodies, assess and improve their cyber resilience. It's structured around 4 Objectives (Managing Security Risk, Protecting Against Cyber Attack, Detecting Cyber Security Events, Minimising the Impact of Incidents), broken down into 14 Principles and dozens of Contributing Outcomes, each rated Achieved, Partially Achieved, or Not Achieved.
Unlike ISO 27001 or Cyber Essentials, CAF isn't a certification you buy from an accredited body, it's usually applied through self-assessment, or assessment by your sector's regulator or lead government department (for example under the NIS Regulations). The outcome is a resilience profile, not a certificate.
The default reference point for public sector and local authority procurement, bid teams increasingly ask for demonstrable CAF alignment before a human even reviews the submission.
Also the expected framework if you supply, or want to supply, essential services or critical infrastructure sectors, or work with government departments who require it contractually.
The same complete security policy set, presented back through CAF's Objectives and Principles so you can point to exactly which document evidences which Contributing Outcome.
A live TIP tracking exactly which Contributing Outcomes are Achieved, Partially Achieved or Not Achieved, and what's needed to close each gap.
A category-by-category breakdown of where you stand across all 4 Objectives, so nothing about your current position is a guess.
Documented incident response testing that directly evidences CAF's "Minimising the Impact of Incidents" objective.
A working risk register evidencing "Managing Security Risk", the first of CAF's four objectives.
Update an answer and we automatically flag every document it affects. For real-world changes we wouldn't otherwise know about, a new supplier, a dropped control, tell us via your quarterly Narrative Check, so your CAF position stays genuinely current, not just accurate on the day you signed up.
Implementing the underlying technical and organisational controls in your live environment, the same real-world work (firewalls, access control, monitoring, backups, patching) that sits behind every framework on this page, typically done with your internal IT team or MSP.
Conducting the actual self-assessment, or engaging with your regulator or lead government department if a formal CAF-based assessment applies to your sector, the assessment decision and any external review sits with them, not with us.
We are not a regulator, a government department, or an accredited CAF assessor, and we don't perform or broker that assessment. Our job is to make sure the evidence behind your self-assessment is genuinely there, and that nothing you'd need to show a regulator is missing or stale.
CAF is deliberately self-assessed for most organisations, so in practice our role is making that self-assessment genuinely accurate rather than optimistic, real Contributing-Outcome-by-Contributing-Outcome evidence, kept current, rather than a document written once and never revisited. Where your sector does involve a regulator or lead government department reviewing your CAF position, that relationship and that review stay entirely between you and them.
You start by establishing which Contributing Outcomes apply to your organisation and sector, then honestly rate your current position against each: Achieved, Partially Achieved, or Not Achieved. Most organisations discover their real starting point is patchier than assumed, informal practices that were never actually evidenced don't count as Achieved.
Each Contributing Outcome needs to be backed by something a regulator or lead government department could actually look at, a policy, a log, a register, a completed exercise, not just "we do that already." This is the stage where most self-assessments quietly fall apart, because the evidence was never written down in the first place.
Contributing Outcomes rated Partially Achieved or Not Achieved feed a Targeted Improvement Plan. As gaps close and your environment changes, new suppliers, new systems, new risks, your profile needs revisiting. CAF isn't a one-off exercise; it's meant to reflect where you actually stand today.
CAF's 14 Principles all sit under one of these four objectives, understanding which one a gap belongs to makes the whole framework far less abstract.
Governance, risk management, asset management, and supply chain security. The foundation objective: you can't protect, detect, or respond to what you haven't identified and don't own responsibility for.
Access control, data security, system security, resilient networks, staff awareness and training. The largest objective by control volume, most day-to-day technical and procedural controls sit here.
Security monitoring and proactive discovery of anomalies. Often the weakest objective for smaller organisations, since detection tooling and processes tend to be built later than basic protective controls.
Response and recovery planning, and lessons learned. Evidenced through tested incident response plans and tabletop exercises, not just a policy document that's never actually been rehearsed.
The single most common issue: a Contributing Outcome gets marked Achieved because the practice exists informally, with nothing written down that a reviewer could actually check. If your regulator or lead government department ever asks to see it, "we do that" isn't an answer.
Detection gets less attention than protection because it's less visible day-to-day. Organisations that haven't defined what "normal" looks like for their systems can't credibly claim to detect abnormal activity.
Objective A explicitly covers supply chain risk, but it's frequently skipped on the assumption that a supplier's security is the supplier's problem. It isn't, it's a Contributing Outcome you're expected to evidence.
A CAF profile completed once and never updated drifts out of date within months as systems, staff, and suppliers change, which is exactly the gap our quarterly Narrative Check and drift detection exist to close.
The full ISO 27001, CAF and Cyber Insurance policy pack, built from your core questionnaire.