Electrical substation infrastructure

REGULATION — NCSC CAF

Read the CAF the way an assessor reads it.

The Cyber Assessment Framework is the NCSC's outcome-based standard for cyber resilience — used across NIS-regulated essential services and by government through GovAssure.

WHAT IT IS

Outcomes, not ticked boxes.

The CAF asks you to evidence outcomes rather than tick a checklist. It sets four top-level objectives, and beneath them sit 14 principles — each with contributing outcomes and Indicators of Good Practice that describe what good actually looks like.

Every outcome is assessed as Achieved, Partially achieved or Not achieved, usually against a target profile set by the relevant regulator or oversight body. The framework is applied across NIS-regulated essential services and, for government, through GovAssure.

THE FOUR OBJECTIVES

ObjectiveFocus
A — Managing security riskGovernance, risk management, asset and supply-chain understanding that underpins everything else.
B — Protecting against cyber attackThe proportionate measures that keep systems and data safe from compromise.
C — Detecting cyber security eventsMonitoring and security event detection that surfaces problems while they can still be contained.
D — Minimising the impact of incidentsResponse and recovery that limits harm and gets essential services back on their feet.
Achieved Partially achieved Not achieved
Harbour with cranes and infrastructure at dusk

An assessor reads for evidence, not intent.

WHERE FIRMS TRIP

  1. Treating it as a checklistThe CAF is outcome-based. Reading it as a list of controls to tick misses what the assessment is actually looking for.
  2. Claiming "Achieved" without the evidenceAn outcome only stands up if you can show it holds. Over-claiming is the fastest way to lose credibility with an assessor.
  3. A gap between the policy and the practiceThe document says one thing; the day-to-day does another. Assessors look at what actually happens, not what's written down.
  4. No risk-based prioritisation of the gapsEvery "Not achieved" outcome gets treated the same, with nothing to say which ones matter most or get fixed first.

HOW WE HELP

01

Honest self-assessment

We rate each outcome the way an assessor would — Achieved, Partially, Not achieved — and record why, so the picture holds up to challenge.

02

Evidence pack

The proof behind each outcome, mapped to the contributing outcomes and IGPs, closing the gap between the policy and what actually happens.

03

Prioritised remediation roadmap

The "Not achieved" outcomes ordered by risk, so the board knows what gets fixed first and why — and can stand behind the plan.

RELATED

EU

NIS2

The wider EU cyber baseline, where the CAF's UK regime has its European counterpart. →

 SECTOR

Critical infrastructure

Where the CAF and essential-services regulation bite hardest — the sector we know best. →

The CAF rewards firms that can show their work.

Start a conversation