Read the CAF the way an assessor reads it.

Outcomes, not ticked boxes.

The CAF asks you to evidence outcomes rather than tick a checklist. It sets four top-level objectives, and beneath them sit 14 principles, each with contributing outcomes and Indicators of Good Practice that describe what good actually looks like.

Every outcome is assessed as Achieved, Partially achieved or Not achieved, usually against a target profile set by the relevant regulator or oversight body. The framework is applied across NIS-regulated essential services and, for government, through GovAssure.

The four objectives

Objective	Focus
A: Managing security risk	Governance, risk management, asset and supply-chain understanding that underpins everything else.
B: Protecting against cyber attack	The proportionate measures that keep systems and data safe from compromise.
C: Detecting cyber security events	Monitoring and security event detection that surfaces problems while they can still be contained.
D: Minimising the impact of incidents	Response and recovery that limits harm and gets essential services back on their feet.

An assessor reads for evidence, not intent.

Where firms trip

1. Treating it as a checklistThe CAF is outcome-based. Reading it as a list of controls to tick misses what the assessment is actually looking for.
2. Claiming “Achieved” without the evidenceAn outcome only stands up if you can show it holds. Over-claiming is the fastest way to lose credibility with an assessor.
3. A gap between the policy and the practiceThe document says one thing; the day-to-day does another. Assessors look at what actually happens, not what’s written down.
4. No risk-based prioritisation of the gapsEvery Not achieved outcome gets treated the same, with nothing to say which ones matter most or get fixed first.