NCSC Cyber Resilience Audit (CRA) Scheme Guide: CAF-Based Audits

UK regulators and government departments increasingly want an independent view of how well essential service operators meet the Cyber Assessment Framework (CAF), and a self-assessment alone no longer satisfies them. The NCSC Cyber Resilience Audit (CRA) scheme assures the companies that carry out those independent audits, so that an oversight body can rely on the result. This guide explains how the scheme works, which sectors use it, what auditors check (with particular attention to identity and access control, where CAF audits most often find gaps), and how to prepare. It is written for security leads at operators of essential services, NHS bodies, government departments and other organisations facing a CAF audit, and for the oversight teams that commission them. Status details were checked on NCSC pages on 27 October 2026. For the framework itself, see the NCSC Cyber Assessment Framework (CAF) Guide.

Key takeaways

• The CRA scheme assures auditors, not audited organisations. NCSC assesses Assured Service Providers (ASPs) against the CRA Scheme Standard; ASPs then audit organisations on behalf of a Cyber Oversight Body.
• Oversight bodies decide whether it is required. Scheme Partners such as DHSC and NHS England, DSIT (GovAssure), the Office for Nuclear Regulation and DOF Northern Ireland may encourage, recommend or require CRA audits in their sectors.
• Audits are CAF-based for now. The scheme launched in October 2024 as a minimum viable product auditing against the CAF, and NCSC says it is designed to extend to other standards.
• Auditor seniority is defined. The Head Consultant must hold UK Cyber Security Council Chartership in the Cyber Audit and Assurance specialism, and the audit Team Leader must hold at least Principal registration.
• Identity outcomes are evidence-heavy. CAF principle B2 expects MFA, privileged account control, device trust and at least annual review of system-to-system access, which is where machine identities and service accounts usually fail an audit.

What it is and who it applies to

NCSC lists the Cyber Resilience Audit among its assured professional services, alongside CHECK penetration testing, Cyber Incident Response and Assured Cyber Security Consultancy. Its purpose, in NCSC's words, is to give consumers confidence in companies assessed as meeting the NCSC standard for delivering independent cyber audits. Audit outputs help oversight bodies understand the resilience of individual organisations and build a picture at sector and national level.

Scheme Partners and sectors

NCSC's Scheme Partners page (checked 27 October 2026) lists these current and prospective partners.

The main audience is operators of essential services under the NIS Regulations, but NCSC also says any organisation can buy a CRA audit for its own due diligence. See the UK NIS Regulations 2018 Guide.

Legislative context: the Cyber Security and Resilience (Network and Information Systems) Bill was in the House of Lords at the time of writing, with HL Bill 49 published as amended in Grand Committee on 7 September 2026 and no Royal Assent shown on the Parliament bill page (checked 27 October 2026). If enacted, it is expected to widen the set of regulated organisations, which would make independent CAF assurance relevant to more sectors. See the UK Cyber Security and Resilience Bill Guide.

Structure and key requirements

Timeline and scheme documents

• 15 August 2024: NCSC announced that applications were open for providers.
• 30 October 2024: NCSC announced the launch, with assured CRA services offering CAF-based audits.
• Scheme documents: CRA Scheme Standard v1.0 (July 2024), read with the Working Practices (v1.1, October 2024) and an Ecosystem Agreement; application form and terms v1.2 (August 2024).
• 2026 status: NCSC states that provider applications are closed for the rest of 2026 while the scheme standard is updated, with new application dates to be announced in December and future applications assessed against the new standard.

The CAF as the audit baseline

The CAF (version 4.0 on NCSC's collection page, last reviewed 6 August 2025) has four objectives and 14 principles: A Managing security risk (A1 Governance, A2 Risk management, A3 Asset management, A4 Supply chain), B Protecting against cyber attacks (B1 to B6, including B2 Identity and access control), C Detecting cyber security events (C1 Security monitoring, C2 Threat hunting) and D Minimising the impact of incidents (D1 Response and recovery planning, D2 Lessons learned). Each principle breaks into contributing outcomes, and each outcome has statements in Not achieved, Partially achieved and Achieved columns (some outcomes have no partial tier). On NCSC's principle pages, an outcome is Not achieved if at least one statement in that column is true, and Achieved only if all statements in the Achieved column are true.

The target is set by a CAF profile. NCSC publishes a Basic Profile for all sectors and an Enhanced Profile, which is sector-specific and aimed at organisations facing more capable attackers. The oversight body, not the auditor, decides which profile applies.

Auditor requirements

For the professional titles, see the UK Cyber Security Council Chartered Status Guide.

Identity and NHI requirements

Principle B2 Identity and Access Control is where CAF audits look hardest at evidence, and it explicitly covers access by automated functions, not only people. Its four contributing outcomes and the points that most often trip up audited organisations are below.

Practical consequences for audit preparation:

• Inventory first: an auditor cannot sample a review that does not cover service accounts. Build a register with owner, purpose, privilege level and last review date. See the Service Account Inventory Template.
• Privileged non-human accounts: treat domain service accounts, backup agents and SCADA engineering accounts as privileged users under B2.c. See the Service Account Security Guide.
• Third-party support access: B2.c's time-bound expectation applies to supplier remote access, which links to A4 Supply chain. See the Third-Party Access Guide.
• Logs that tie to identity: B2.d's correlation expectation and C1 monitoring both need logs that name the account, including non-human ones.

Implementation steps

1. Confirm the requirement with your oversight body. NCSC advises buyers to check whether and how their oversight body uses the scheme, which CAF profile applies and whether it will become a requirement.
2. Complete or refresh your CAF self-assessment. Rate every contributing outcome with evidence references. An independent audit of an organisation that has not self-assessed is expensive and finds the obvious.
3. Close the cheap gaps first. Typical early fixes: MFA on remaining remote access paths, removal of default and shared privileged accounts, and a first annual review of system-to-system access.
4. Select an ASP. Use NCSC's list of assured CRA providers. NCSC is not a party to the contract, so do your own commercial due diligence (independence, sector experience, availability of chartered staff). Public sector buyers can use the Crown Commercial Service Cyber Security Services 3 dynamic purchasing system (RM3764.3).
5. Agree scope and terms of reference. Name the essential functions and systems in scope, the profile, the period and how the report will be shared with the oversight body.
6. Prepare an evidence pack. Organise it by CAF outcome: policies, configuration exports, review records, logs and test results, with a named owner for each outcome.
7. Support fieldwork. Expect interviews, document review and technical sampling. Make system owners available and provide read-only access where the auditor needs to verify configuration.
8. Respond to findings. Agree a remediation plan with owners and dates for every Not achieved or Partially achieved outcome, and track it through to the next assessment.

Evidence and assessment

CAF outcomes are judged on evidence, not on policy statements. The table lists evidence that typically satisfies an auditor for the identity outcomes and a few adjacent ones.

Useful measures to track between audits:

• Percentage of contributing outcomes rated Achieved against the applicable profile.
• Percentage of service and integration accounts with a named owner and a review in the last 12 months.
• Number of shared, generic or default-named privileged accounts remaining.
• Percentage of remote and privileged access paths covered by MFA.
• Median age of open audit findings, and the number overdue against the remediation plan.

Mapping to other frameworks

Most CRA evidence can be reused. The table aligns CAF B2 and related outcomes to other frameworks; this is NHI Mgmt Group's own alignment, not an official NCSC mapping.

For a wider crosswalk see the NIST CSF to ISO 27001 Mapping Guide. Organisations already holding Cyber Essentials will find it covers only a small, technical subset of CAF objective B; see the Cyber Essentials Guide.

Common pitfalls

• Self-assessment optimism. Ratings of Achieved that rely on policy rather than system evidence are the first thing an independent auditor overturns, and the gap undermines trust in the rest of the submission.
• Human-only access reviews. B2.d explicitly calls out device and system-to-system access. Reviews that skip service accounts and integrations produce a Not achieved rating.
• Shared and default privileged accounts. Common on OT, clinical and legacy systems, and listed by NCSC as a Not achieved indicator under B2.c. Document compensating controls if they cannot be removed yet.
• Supplier access with no expiry. Standing remote access for vendors conflicts with B2.c and A4. The Marks and Spencer cyberattack shows how third-party user access becomes the route in.
• Unclear scope. Auditing "the organisation" instead of the systems that support essential functions wastes the budget and leaves the oversight body unable to compare results.
• Assuming the scheme vouches for the contract. NCSC assures the provider, not the engagement; buyers still own due diligence and contract terms.

Practitioner checklist

• Ask your oversight body in writing whether CRA audits are encouraged, recommended or required, and which CAF profile applies.
• Complete a current CAF self-assessment with evidence references for every contributing outcome.
• Build an identity inventory covering human, privileged, device and system-to-system accounts with owners.
• Remove or document every shared, generic or default-named privileged account.
• Run and record an access review that includes service accounts, API keys and integrations.
• Choose an ASP from NCSC's list and confirm the Head Consultant and Team Leader credentials.
• Agree scope, profile, reporting and sharing arrangements before fieldwork.
• Organise the evidence pack by CAF outcome with a named owner per outcome.
• Track remediation of every Not achieved and Partially achieved outcome to a dated plan.

Standards and references

• NCSC: Cyber Resilience Audit scheme
• NCSC: Cyber Resilience Audit Scheme Partners
• NCSC: Cyber Resilience Audit information for buyers
• NCSC: Cyber Resilience Audit information for service providers
• NCSC: Cyber Assessment Framework
• NCSC: CAF Principle B2 Identity and Access Control
• NCSC: Assured services
• UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill

Related NHI Mgmt Group resources: NCSC Cyber Assessment Framework (CAF) Guide · NCSC Assured Services Guide · UK NIS Regulations 2018 Guide · Access Reviews Guide · Internal Audit for Cybersecurity Guide