NCSC CAF Guide: Objectives, Principles and Profiles

The NCSC Cyber Assessment Framework is the yardstick UK regulators, government and the NHS use to judge whether an organisation can keep an essential function running under cyber attack, yet many organisations still treat it as a questionnaire to fill in once a year. The CAF is written as outcomes, not controls, so a good assessment depends on evidence and expert judgement rather than ticking boxes. Version 4.0, dated August 2025, added contributing outcomes on understanding threat and secure software development, and reworked security monitoring. This guide explains the four objectives, the 14 principles and 41 contributing outcomes, how indicators of good practice and achievement ratings work, CAF profiles, and how the CAF is used under the NIS Regulations, GovAssure and the NHS Data Security and Protection Toolkit. It is for CISOs, security and compliance leads in operators of essential services, public sector bodies and their suppliers.

Key takeaways

The CAF is outcome based. NCSC describes its principles as a "specification of what needs to be achieved rather than a checklist of what needs to be done", so assessors judge whether the outcome is met, not whether a named tool exists.
Version 4.0 has 41 contributing outcomes. Four objectives (A to D) and 14 principles break down into 41 outcomes, each with indicators of good practice for Achieved, Partially achieved and Not achieved.
Profiles set the target, not the framework. NCSC publishes Basic and Enhanced CAF profiles; sector regulators, government and NHS England set the expected rating for each outcome in their own regime.
Several UK regimes run on the CAF. NIS competent authorities, GovAssure for government critical systems and the CAF-aligned DSPT for large NHS organisations all assess against it, with their own scope, profile and deadlines.
Identity is assessed directly. Principle B2 covers users "or automated functions", so service accounts, API keys and machine access are in scope of identity and access control outcomes.

What the CAF is and who uses it

The NCSC says the CAF is "primarily designed for organisations operating essential services" in sectors such as energy, healthcare, transport, digital infrastructure and government. It supports both internal self-assessment and external oversight, and gives a structured way to judge how well an organisation meets the cyber security and resilience outcomes described in a CAF profile. Its main audiences are organisations regulated under the Network and Information Systems (NIS) Regulations 2018, UK critical national infrastructure operators, public sector bodies supporting core government functions, and the cyber regulators that oversee them.

The unit of assessment is the essential function: the service whose disruption would cause significant harm, together with the network and information systems that support it. Scoping the CAF to the whole enterprise usually produces vague ratings; scoping it to the systems that keep the essential function running produces findings an operator can act on.

CAF, Cyber Essentials or ISO 27001? They answer different questions. Cyber Essentials is a fixed set of technical controls against common internet attacks, useful as a floor and for supply chain requirements; see the Cyber Essentials Guide. ISO/IEC 27001 certifies a management system for the scope you choose. The CAF judges outcomes for a specific essential function against a threat-based profile and is the expected route wherever a UK regulator, GovAssure or the DSPT applies. Many operators hold all three and reuse evidence across them.

The current version of the NCSC CAF is v4.0. The NCSC change log is dated "Version as of 4th August 2025", and the CAF collection page records a review on 6 August 2025.

CAF objectives, principles and contributing outcomes

There are four CAF objectives. Objective A covers managing security risk, Objective B protecting against cyber attack, Objective C detecting cyber security events and Objective D minimising the impact of cyber security incidents. Each objective is split into CAF principles, and each principle into CAF contributing outcomes: 41 in v4.0.

Objective	Principle	Contributing outcomes (v4.0)
CAF objective A: Managing security risk	A1 Governance	A1.a Board Direction; A1.b Roles and Responsibilities; A1.c Decision-making
	A2 Risk Management	A2.a Risk Management Process; A2.b Understanding Threat; A2.c Assurance
	A3 Asset Management	A3.a Asset Management
	A4 Supply Chain	A4.a Supply Chain; A4.b Secure Software Development and Support
CAF objective B: Protecting against cyber attacks	B1 Service Protection Policies, Processes and Procedures	B1.a Policy, Process and Procedure Development; B1.b Policy, Process and Procedure Implementation
	B2 Identity and Access Control	B2.a Identity Verification, Authentication and Authorisation; B2.b Device Management; B2.c Privileged User Management; B2.d Identity and Access Management (IdAM)
	B3 Data Security	B3.a Understanding Data; B3.b Data in Transit; B3.c Stored Data; B3.d Mobile Data; B3.e Media / Equipment Sanitisation
	B4 System Security	B4.a Secure by Design; B4.b Secure Configuration; B4.c Secure Management; B4.d Vulnerability Management
	B5 Resilient Networks and Systems	B5.a Resilience Preparation; B5.b Design for Resilience; B5.c Backups
	B6 Staff Awareness and Training	B6.a Cyber Security Culture; B6.b Cyber Security Training
CAF objective C: Detecting cyber security events	C1 Security Monitoring	C1.a Sources and Tools for Logging and Monitoring; C1.b Securing Logs; C1.c Generating Alerts; C1.d Triage of Security Alerts; C1.e Personnel Skills for Monitoring and Detection; C1.f Understanding User's and System's Behaviour, and Threat Intelligence
CAF objective C: Detecting cyber security events	C2 Threat Hunting	C2.a Threat Hunting
CAF objective D: Minimising the impact of incidents	D1 Response and Recovery Planning	D1.a Response Plan; D1.b Response and Recovery Capability; D1.c Testing and Exercising
CAF objective D: Minimising the impact of incidents	D2 Lessons Learned	D2.a Post Incident Analysis; D2.b Using Incidents to Drive Improvements

Objective B carries 20 of the 41 outcomes and usually generates most findings. Objectives C and D are where mature operators separate themselves: an organisation can harden well and still fail C1.d or D1.c because it has never tested how quickly an alert becomes a decision.

Indicators of good practice and achievement ratings

Every contributing outcome has a table of CAF indicators of good practice (IGPs) in up to three columns: Not achieved, Partially achieved and Achieved. The rules for reading them are short but often misapplied:

CAF achieved: NCSC says "all the indicators would normally be present" in the Achieved column.
CAF not achieved: "the presence of any one indicator would normally be sufficient" to reach this rating. One serious weakness outweighs a list of strengths.
CAF partially achieved: NCSC warns this should "represent more than giving credit for doing something vaguely relevant". Not every outcome has a Partially achieved column.
Expert judgement: IGPs inform judgement rather than replace it. An organisation can meet the outcome by a route the IGPs do not describe, if the evidence shows the outcome is achieved.

The IGPs read as concrete expectations. Under B2.a, an Achieved indicator is the use of "additional strong authentication mechanisms, such as multi-factor authentication (MFA), for all user access"; under B2.d, a Not achieved indicator is that "User access rights remain active when users leave your organisation"; and under C2.a, Achieved includes "You turn threat hunts into automated detections and alerting where appropriate." Evidence for each rating should be something an assessor can inspect: a report, a configuration export, a log query, an exercise record.

What changed in CAF 4.0

CAF v4.0 replaced v3.2. The NCSC change log lists the following structural changes, alongside wording updates across most of Objective B and new or reworded indicators in A1, A2 and C1.

Change	CAF v3.2	CAF v4.0
New outcome on threat	A2.b was Assurance	A2.b Understanding Threat added; Assurance moves to A2.c
New outcome on software	No dedicated outcome	A4.b Secure Software Development and Support
Risk management scope	Security risk	Security and resilience risk in A2 and A2.a
Monitoring sources	C1.a Monitoring Coverage	C1.a Sources and Tools for Logging and Monitoring
Alert handling	C1.d Identifying Security Incidents	C1.d Triage of Security Alerts
Monitoring skills	C1.e Monitoring Tools and Skills	C1.e Personnel Skills for Monitoring and Detection
Board direction	Existing indicators	Two new Achieved indicators in A1.a

For a CAF v4 transition, map each v3.2 rating to the new outcome, reassess A2.b, A4.b and C1 from scratch, and expect some prior Achieved ratings to fall to Partially achieved where new indicators were added. Check which version your regulator or scheme requires before you start: regimes adopt new versions on their own timetable.

CAF profiles: Basic, Baseline and Enhanced

NCSC defines a CAF profile as "a target level for cyber security and resilience in response to threat actors". A profile states, for each contributing outcome, whether the target is Achieved, Partially achieved or Not achieved.

Basic Profile: applies to all sectors and assumes attackers with basic capability, typically common cyber attacks. Government guidance calls it "appropriate for most critical systems". Earlier GovAssure guidance used the name CAF baseline profile, described as "the minimum baseline standard for all organisations", and counted 39 contributing outcomes, against 41 in v4.0.
Enhanced Profile: the CAF enhanced profile is sector specific and builds on the Basic Profile for organisations facing more capable, better-resourced attackers. In GovAssure it is required for critical national infrastructure systems.
Regulator and sector profiles: NIS competent authorities set their own targets. Ofgem's NIS guidance for downstream gas and electricity (v3.0, January 2026) refers to "CAF target profiles issued by DESNZ and Ofgem" and adds an Objective E for physical security. NHS England sets the expected achievement level for each DSPT outcome.

Choosing a target: an organisation outside a regulated regime can use the Basic Profile as its first target and adopt Enhanced for the systems an advanced attacker would target. Setting Enhanced everywhere at the outset tends to produce a long list of Partially achieved ratings and no clear priority.

How UK regimes apply the CAF

Regime	Who	How the CAF is used	Notable features
NIS Regulations 2018	Operators of essential services in energy, transport, health, water and digital infrastructure; relevant digital service providers	Competent authorities assess OES against the CAF; Ofgem, for example, requires an "accurate positional report against the CAF" as evidence for the regulation 10 duty to "take appropriate and proportionate technical and organisational measures"	Incident notification under regulation 11 no later than 72 hours after the OES becomes aware; Ofgem expects a NIS annual report by the end of July
GovAssure	Central government departments and their OFFICIAL critical systems, including government CNI	Annual cyber health review using the CAF against a government profile	Announced 20 April 2023 and run by the Government Security Group; stage 3 WebCAF self-assessment, stage 4 independent review, stage 5 Targeted Improvement Plans
Data Security and Protection Toolkit (DSPT)	Large NHS organisations: Trusts, CSUs, ALBs and ICBs	CAF-aligned DSPT since the 2024-25 edition, with requirements set out as objectives, principles and outcomes	47 contributing outcomes in 2024-25, including information governance outcomes; "Standards Met" requires the NHS England profile level for each outcome

The UK Cyber Security and Resilience Bill would update the NIS Regulations, so check the current position before relying on the NIS scope or deadlines above. For the EU equivalent see the NIS2 Directive Guide, and for operational technology operators see the OT Security Maturity Model, which maps its levels to the CAF.

Running a CAF assessment

A CAF self assessment is only as good as its scope and evidence. This sequence works for a first assessment and for annual reassessment.

Define the essential functions and in-scope systems. List the network and information systems each essential function depends on, including cloud services, OT, identity infrastructure and suppliers with remote access.
Confirm the profile and version. Get the target profile and CAF version from your regulator, scheme or board, and record it at the top of the assessment.
Assign outcome owners. Each of the 41 outcomes needs a named owner who gathers evidence; governance outcomes in A1 belong with the board or executive, not the security team.
Collect evidence before rating. Rate each outcome only after reading every IGP for it. Record the evidence reference against each indicator, not just against the outcome.
Calibrate. Run a review session where someone independent of the owner challenges every Achieved rating. Any single Not achieved indicator present should pull the outcome down.
Compare to the profile. List outcomes below target, rate their risk to the essential function and build an improvement plan with owners and dates.
Test before you claim. For D1.c and C1.d, run an exercise and record times; for B5.c, restore from backup. If a new control causes disruption during testing (for example stricter conditional access locking out operators), roll back to the previous policy, record the issue and re-plan rather than leave the outcome rated on a control nobody can use.
Report and repeat. Present ratings, movement since last year and the improvement plan to the board, and reassess annually or after major change.

Small vs large organisations: a small operator with one essential function can complete the assessment in a workshop format with one evidence pack. A large group should assess each essential function separately and roll results up, because one well-defended function can mask a weak one.

Principle B2 and where identity fits

CAF principle B2 states that "Users (or automated functions) that can access data or systems are appropriately verified, authenticated and authorised." That wording brings non-human identities into scope. Under B2.d, failing to review the access rights granted to devices or systems to reach other devices and systems is a Not achieved indicator, and B2.c expects strong authentication for all privileged user access to systems supporting the essential function.

B2.a: enforce MFA for all user access, including suppliers. The Snowflake breach showed what happens when infostealer credentials meet accounts without MFA. See the MFA Guide.
B2.c: grant privileged access by role, time-bound where possible, and review it regularly. See the Privileged Access Management Guide.
B2.d: include service accounts, API keys and integration credentials in joiner, mover and leaver processes and access reviews. See the Service Account Security Guide.
Help desk and identity recovery: social engineering of support staff sits across B2.a and B6. The Co-op cyber attack started with help desk social engineering.

Measuring progress and framework mapping

Track a small set of measures alongside the ratings so the board sees movement between annual assessments:

Profile gap: number of contributing outcomes below the target profile, by objective.
Evidence freshness: percentage of Achieved ratings backed by evidence less than 12 months old.
Improvement plan delivery: actions closed by their due date.
MFA coverage: percentage of user and privileged accounts on in-scope systems with strong authentication (B2.a, B2.c).
Detection speed: median time from alert to triage decision in exercises (C1.d).
Restore success: percentage of backup restore tests for essential function systems that met their recovery objective (B5.c).

The mapping below is indicative and useful for reusing evidence across frameworks; it is not an official NCSC crosswalk.

CAF principle	NIST CSF 2.0	ISO/IEC 27001:2022 Annex A	CIS Controls v8.1
A1 Governance	GV.RR, GV.OV	5.1, 5.2, 5.4	n/a
A2 Risk Management	GV.RM, ID.RA	Clause 6.1, 5.7 Threat intelligence	n/a
A3 Asset Management	ID.AM	5.9	1, 2
A4 Supply Chain	GV.SC	5.19 to 5.23, 8.25 to 8.30	15, 16
B2 Identity and Access Control	PR.AA	5.15 to 5.18, 8.2, 8.5	5, 6
B3 Data Security	PR.DS	5.12, 7.14, 8.24	3
B4 System Security	PR.PS, ID.RA-01	8.8, 8.9	4, 7
B5 Resilient Networks and Systems	PR.IR, PR.DS-11	5.30, 8.13, 8.14	11, 12
B6 Staff Awareness and Training	PR.AT	6.3	14
C1 and C2 Monitoring and Threat Hunting	DE.CM, DE.AE	8.15, 8.16	8, 13
D1 and D2 Response, Recovery and Lessons	RS.MA, RC.RP, ID.IM	5.24 to 5.29	17

See the NIST CSF 2.0 Guide and the ISO 27001 Certification Guide for those frameworks.

Common failure patterns

Rating intent, not evidence: marking outcomes Achieved because a policy exists, when the IGP asks whether it operates. Read the Not achieved column first.
Averaging away a weakness: treating a single Not achieved indicator as outweighed by several Achieved ones, contrary to the NCSC rule.
Enterprise-wide scope: assessing the whole organisation instead of the systems behind each essential function, which hides the weak link.
Supplier access out of view: A4 and B2 rated on internal controls while suppliers hold remote and privileged access. The Marks and Spencer cyberattack involved impersonation of a third-party user.
Untested recovery: D1 rated on a written plan with no exercise. The Jaguar Land Rover cyberattack showed how long recovery takes when operations depend on interconnected systems.
Machine identities ignored: B2 assessed only for staff accounts, leaving service accounts and API keys outside access review.

Practitioner checklist

Confirm the CAF version and target profile your regulator or scheme requires, and record both in the assessment.
Scope the assessment to essential functions and the systems, suppliers and identities they depend on.
Assign an owner to each of the 41 contributing outcomes, with A1 owned at board or executive level.
Rate each outcome against every IGP, applying the rule that one Not achieved indicator is normally enough.
Reassess A2.b, A4.b and C1 in full if your last assessment used CAF v3.2.
Include service accounts, API keys and supplier accounts in B2 evidence and access reviews.
Exercise incident response and backup restore before rating D1 and B5.c.
Track the improvement plan and six measures quarterly and report movement to the board.

NCSC Cyber Assessment Framework (CAF) Guide: Objectives and Principles