A CAF self-assessment stands or falls on evidence, and most first attempts rate outcomes on opinion because nobody agreed in advance what evidence each one needs. This workbook lists all 41 contributing outcomes in version 4.0 of the NCSC Cyber Assessment Framework (CAF), with examples of the evidence an assessor will typically ask for and a place to record the rating, the evidence reference and the gap. It suits operators of essential services and digital service providers under the UK NIS Regulations, CNI and public sector bodies, and large health and care organisations completing the CAF-aligned Data Security and Protection Toolkit (DSPT). For what the CAF is, how ratings work and what changed in 4.0, read the NCSC Cyber Assessment Framework (CAF) Guide first; this page does not repeat it.
How to use this template
- Confirm the version and profile. The NCSC CAF collection lists CAF 4.0, published 18 April 2024, as current (page reviewed 30 October 2026). Your regulator or sector body sets the profile, the minimum achievement per outcome. NCSC describes the CAF Core Profile as a threat-informed baseline for organisations facing moderately sophisticated adversaries. Record which profile applies in section 1.
- Agree evidence before rating. Walk through sections 3 to 6 with the outcome owners and agree the evidence list for each outcome. The evidence examples are NHI Mgmt Group suggestions, not NCSC text; the indicators of good practice (IGPs) on each NCSC principle page, such as Principle A1 Governance, remain the reference.
- Rate against the IGPs. Use Not achieved, Partially achieved or Achieved, applying the rules in section 2. Not every outcome has a Partially achieved column on the NCSC site.
- Record the gap. Every outcome below the profile target gets a gap line and an action in section 8.
- Replace placeholders in square brackets, such as [Organisation] and [Essential function], before circulating.
CAF is not a certification scheme: NCSC says assessments use evidence and expert judgement rather than a checklist. Use the workbook to organise judgement, not to replace it.
1. Assessment details
| Field | Entry |
|---|---|
| Organisation | [Organisation] |
| Essential function(s) or service(s) in scope | [Essential function]; network and information systems supporting it: [systems] |
| CAF version and profile | CAF 4.0; profile [Core Profile / regulator profile / DSPT] |
| Regime | [NIS Regulations / DSPT / public sector / internal] |
| Accountable executive | [Name, role] |
| Assessment lead and contributors | [Names] |
| Assessment period and date | [dd/mm/yyyy] |
| Independent review | [Internal audit / external assessor / none], date [dd/mm/yyyy] |
2. Rating rules
- Achieved: NCSC's guidance is that all the Achieved indicators would normally be present.
- Not achieved: the presence of any one Not achieved indicator would normally be enough for this rating.
- Partially achieved: use only where the column exists, and only for substantive progress, not for doing something vaguely relevant.
- Alternative routes: an outcome can be met in a way the IGPs do not describe if the evidence shows the outcome is achieved. Record the reasoning in the Notes column.
- Evidence reference: cite a document ID, record or system report with a date. "Discussed with IT" is not evidence.
3. Objective A: Managing security risk
| Contributing outcome | Evidence examples (ours) | Target | Rating | Evidence ref and gap |
|---|---|---|---|---|
| A1.a Board Direction | Board minutes discussing cyber risk in the last 12 months; named board-level accountable person; security policy approved by the board | [ ] | [NA/PA/A] | [ ] |
| A1.b Roles and Responsibilities | Security roles chart; job descriptions with security duties; evidence roles are filled and resourced | [ ] | [ ] | [ ] |
| A1.c Decision-making | Risk appetite statement; delegation and escalation matrix; examples of decisions made at the right level | [ ] | [ ] | [ ] |
| A2.a Risk Management Process | Risk method; risk register for systems supporting the essential function; review dates | [ ] | [ ] | [ ] |
| A2.b Understanding Threat | Threat assessment naming relevant actors and capabilities; how it feeds the risk register | [ ] | [ ] | [ ] |
| A2.c Assurance | Assurance plan; penetration test and audit reports; tracked remediation | [ ] | [ ] | [ ] |
| A3.a Asset Management | Inventory of hardware, software, data, services and identities supporting the essential function, with owners; dependency maps | [ ] | [ ] | [ ] |
| A4.a Supply Chain | Supplier register with criticality; contract security clauses; supplier assurance results; supplier access list | [ ] | [ ] | [ ] |
| A4.b Secure Software Development and Support | Secure development policy; evidence from in-house or supplier development (code review, testing, SBOM); support arrangements | [ ] | [ ] | [ ] |
4. Objective B: Protecting against cyber attack
| Contributing outcome | Evidence examples (ours) | Target | Rating | Evidence ref and gap |
|---|---|---|---|---|
| B1.a Policy, Process and Procedure Development | Policy set with owners and review dates, linked to risk | [ ] | [ ] | [ ] |
| B1.b Policy, Process and Procedure Implementation | Compliance checks, exceptions register, audit findings showing policies are followed | [ ] | [ ] | [ ] |
| B2.a Identity Verification, Authentication and Authorisation | MFA coverage report; authentication standard; access approval records; service account and API key inventory with owners | [ ] | [ ] | [ ] |
| B2.b Device Management | Device inventory; compliance policy for devices that access the systems; management of third-party devices | [ ] | [ ] | [ ] |
| B2.c Privileged User Management | Privileged account list; separate admin accounts; session logging; privileged access reviews | [ ] | [ ] | [ ] |
| B2.d Identity and Access Management (IdAM) | Joiner, mover, leaver records; access reviews with outcomes; removal of stale and orphaned accounts, human and non-human | [ ] | [ ] | [ ] |
| B3.a Understanding Data | Data inventory for the essential function; classification; data flow diagrams | [ ] | [ ] | [ ] |
| B3.b Data in Transit | Encryption standard; TLS configuration reports; protection of links to sites and suppliers | [ ] | [ ] | [ ] |
| B3.c Stored Data | Encryption at rest settings; access controls on stores; backup encryption | [ ] | [ ] | [ ] |
| B3.d Mobile Data | Mobile device management policy; remote wipe; controls on removable media | [ ] | [ ] | [ ] |
| B3.e Media / Equipment Sanitisation | Sanitisation procedure; destruction certificates | [ ] | [ ] | [ ] |
| B4.a Secure by Design | Architecture reviews; segmentation design; threat models for key systems | [ ] | [ ] | [ ] |
| B4.b Secure Configuration | Configuration baselines; drift reports; application allow-listing where used | [ ] | [ ] | [ ] |
| B4.c Secure Management | Dedicated admin workstations or jump hosts; management interfaces isolated from general networks | [ ] | [ ] | [ ] |
| B4.d Vulnerability Management | Scan coverage; patch timelines against policy; unsupported software register with mitigations | [ ] | [ ] | [ ] |
| B5.a Resilience Preparation | Business impact analysis; continuity and disaster recovery plans for the essential function | [ ] | [ ] | [ ] |
| B5.b Design for Resilience | Segregation of systems; removal of single points of failure; capacity planning | [ ] | [ ] | [ ] |
| B5.c Backups | Backup schedule; offline or immutable copies; restore test records with times | [ ] | [ ] | [ ] |
| B6.a Cyber Security Culture | Leadership messaging; reporting channel use; culture survey results | [ ] | [ ] | [ ] |
| B6.b Cyber Security Training | Training records by role; phishing exercise results; specialist training for admins | [ ] | [ ] | [ ] |
Objective B holds 20 of the 41 outcomes. For B2 in particular, include service accounts, API keys, certificates and AI agent identities in the evidence: the Audit Readiness for AI Agents and NHIs guide lists what to collect.
5. Objective C: Detecting cyber security events
| Contributing outcome | Evidence examples (ours) | Target | Rating | Evidence ref and gap |
|---|---|---|---|---|
| C1.a Sources and Tools for Logging and Monitoring | Log source inventory mapped to the essential function; host and network monitoring coverage; time synchronisation | [ ] | [ ] | [ ] |
| C1.b Securing Logs | Log access list; integrity protection; retention settings; audit trail of actions on log data | [ ] | [ ] | [ ] |
| C1.c Generating Alerts | Detection rule catalogue; tuning records; signature and IoC update cadence | [ ] | [ ] | [ ] |
| C1.d Triage of Security Alerts | Alert categorisation and severity scheme; runbooks; triage time metrics | [ ] | [ ] | [ ] |
| C1.e Personnel Skills for Monitoring Tools and Detection | Monitoring roles; training and skills matrix; evidence analysts can escalate beyond fixed process | [ ] | [ ] | [ ] |
| C1.f Understanding User's and System's Behaviour, and Threat Intelligence | Baselines of normal behaviour; threat intelligence sources chosen by risk; feedback on IoC effectiveness | [ ] | [ ] | [ ] |
| C2.a Threat Hunting | Hunting plan; hunt reports; detections created from hunts | [ ] | [ ] | [ ] |
6. Objective D: Minimising the impact of cyber security incidents
| Contributing outcome | Evidence examples (ours) | Target | Rating | Evidence ref and gap |
|---|---|---|---|---|
| D1.a Response Plan | Incident response plan covering the essential function; roles; regulator and NCSC reporting steps | [ ] | [ ] | [ ] |
| D1.b Response and Recovery Capability | Contracts or teams for response; tooling; recovery procedures and resources | [ ] | [ ] | [ ] |
| D1.c Testing and Exercising | Exercise reports with scenarios based on your threat assessment; actions tracked | [ ] | [ ] | [ ] |
| D2.a Post Incident Analysis | Root cause reports for incidents and near misses | [ ] | [ ] | [ ] |
| D2.b Using Incidents to Drive Improvements | Improvement actions from incidents and exercises, with completion evidence | [ ] | [ ] | [ ] |
7. Sector overlays
Health and care (DSPT): NHS England's CAF-aligned DSPT, announced on 3 September 2024 and rolled out first to a group of large health and care organisations, adds a health and care overlay and an Objective E, "Using and sharing information appropriately". Add a section 7a for Objective E using the outcomes published in the DSPT itself, and confirm with NHS England when your organisation transitions. See the NHS Data Security and Protection Toolkit guide.
Other regulators: record any sector-specific profile or additional expectations from your competent authority here: [Regulator, profile, date].
8. Summary and improvement plan
| Objective | Outcomes | Achieved | Partially achieved | Not achieved | Below profile target |
|---|---|---|---|---|---|
| A Managing security risk | 9 | [ ] | [ ] | [ ] | [ ] |
| B Protecting against cyber attack | 20 | [ ] | [ ] | [ ] | [ ] |
| C Detecting cyber security events | 7 | [ ] | [ ] | [ ] | [ ] |
| D Minimising the impact of incidents | 5 | [ ] | [ ] | [ ] | [ ] |
| Total | 41 | [ ] | [ ] | [ ] | [ ] |
For each outcome below target: [Outcome ID] | gap | action | owner | due date | evidence that will prove closure.
Sign-off: [Accountable executive], [dd/mm/yyyy].
Implementation guidance
- Scope first: rate the systems that support the essential function, not the whole estate. An unclear scope is the fastest way to an argument with an assessor.
- Owners per outcome: give each of the 41 outcomes one named owner who gathers the evidence; the assessment lead challenges it.
- Evidence library: store evidence in one place with dates and reuse it across ISO 27001, Cyber Essentials and DSPT where it genuinely fits. See the Audit Evidence Request Tracker Template.
- Challenge the Achieved ratings: ask an independent reviewer, such as internal audit, to sample at least the Achieved ratings in Objective B, where over-rating is most common in our experience.
- Repeat yearly: track movement per outcome against the profile and report the trend to the board, which itself supports A1.a.
- Mapping: CAF objectives broadly align with NIST CSF 2.0 functions (A with Govern and Identify, B with Protect, C with Detect, D with Respond and Recover). This alignment is ours; for detailed crosswalks see the Control Mapping Guide.
Related NHI Mgmt Group resources: NCSC Cyber Assessment Framework (CAF) Guide · UK NIS Regulations 2018 Guide · UK Cyber Security and Resilience Bill Guide · NCSC Cyber Resilience Audit (CRA) Scheme Guide