The Cyber Assessment Framework (CAF) is an NCSC set of objectives, principles, outcomes and indicators of good practice for assessing cyber resilience. It is used mainly by organizations running essential services in the UK, such as energy, healthcare, transport and digital infrastructure. The current version on the NCSC page is 4.0.
Who uses it
The NCSC page names these groups:
- Organizations running essential services, including energy, healthcare, transport, digital infrastructure and government.
- Organizations covered by the NIS Regulations.
- Operators of Critical National Infrastructure.
- Public sector bodies.
- Cyber oversight bodies that assess others.
How it is built
The page describes a layered structure: objectives, underlying principles, outcomes, and indicators of good practice (IGPs). The page does not state how many principles or IGPs there are or name the objectives. The full CAF 4.0 document linked from it does.
CAF 4.0 was published on 18 April 2024 and the page was reviewed on 6 August 2025.
Outcome based, not checklist based
A frequent surprise for first-time users is that the CAF asks for outcomes. You describe what you achieve, and indicators help judge whether you do it. Two organizations can meet an outcome in different ways. That suits mixed estates of IT and operational technology.
How to start
- Pick one essential service, not the whole company.
- List the systems that service depends on, including suppliers.
- Read the outcomes and mark each as achieved, partially achieved or not achieved, with a note on the evidence.
- Pick three gaps and give each an owner and a date.
Common mistakes in a first self-assessment
Scoring everything as achieved because a policy exists. A policy is a document, and the framework asks about outcomes. Another is assessing the whole company at once, which produces a long, vague result. Pick one service and go deep. A third is leaving suppliers out. Many outcomes depend on what third parties do, so list them and ask for evidence.
Keep the notes short and dated. When the same service is assessed next year, the difference between the two sets of notes is the most useful output.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how controls map to framework requirements. A CAF self-assessment benefits from the same habit of attaching evidence to each outcome.
Safeguard offers compliance and evidence automation. It does not issue a CAF rating.
Quick check
Is the CAF a certification?
The NCSC page describes it as a framework for assessment, not a certificate.
Is it only for UK government?
No. The page lists essential service operators, NIS-regulated organizations, CNI operators and public sector bodies.
Sources
Last reviewed: 19 October 2026.
