SecurityEurope & UK

NCSC CAF v3.2

Make resilience outcomes easier to assess and evidence

Bring essential-service risks, improvement work and assessment evidence into a connected programme.

Version note. This page covers CAF v3.2. NCSC published v4.0 in August 2025. Check which edition your authority requires.

Full title
Cyber Assessment Framework (CAF), version 3.2
Issued by
UK National Cyber Security Centre (NCSC), the national technical authority for cyber security
Published
April 2024. Superseded by CAF v4.0, published in August 2025.
Used by
UK regulators and oversight bodies, including competent authorities under the NIS Regulations 2018, and the public sector through GovAssure
Nature
An outcome-based assessment framework, not a law or a certification. Its legal force comes from the regulator that uses it.
Structure
4 objectives, 14 principles and 39 contributing outcomes, each with Indicators of Good Practice

Overview

What the CAF is

The Cyber Assessment Framework is the NCSC’s method for assessing how well an organisation manages the cyber risks to the network and information systems that support its essential functions. It was first published in April 2018 to support the Network and Information Systems Regulations 2018, and is now used by nearly all UK cyber regulators and across the public sector through GovAssure. The NCSC has no regulatory role itself. Each regulator or oversight body decides whether and how to use the CAF.

The CAF describes outcomes, not a checklist. It has four objectives: managing security risk, protecting against cyber attack, detecting cyber security events and minimising the impact of incidents. These contain 14 principles and 39 contributing outcomes. Each contributing outcome has a table of Indicators of Good Practice, which help an assessor judge whether the outcome is achieved, partially achieved where that rating is offered, or not achieved. The indicators support expert judgement; they are not mandatory or exhaustive.

Version 3.2, published in April 2024, made major revisions to the sections on remote access, privileged operations, user access levels and multi-factor authentication, in contributing outcomes B2.a and B2.c. It adjusted related Indicators of Good Practice, mirrored some Cyber Essentials requirements while keeping the outcome-focused approach, and consolidated references to NCSC guidance.

The NCSC published CAF v4.0 in August 2025. It adds new contributing outcomes on understanding threat (A2.b) and on secure software development and support (A4.b), updates security monitoring and threat hunting, and covers AI-related cyber risks throughout. The NCSC encourages system owners to adopt v4.0, but the edition used in an assessment is set by the relevant regulator or oversight body, so check which one applies.

Who it applies to

The CAF is used where a regulator or oversight body adopts it. That most often means:

  • Operators of essential services under the NIS Regulations 2018, in sectors such as energy, transport, health, drinking water and digital infrastructure, assessed by their sector competent authority
  • UK government departments and arm’s-length bodies assessed through GovAssure
  • Other public sector bodies that use the CAF, or an adapted version, as their assurance framework
  • Suppliers and service providers whose regulated customers ask them to evidence relevant CAF outcomes
  • Organisations outside regulation that want a structured, outcome-based view of their cyber resilience

Which edition, profile and target ratings apply is decided by the regulator or oversight body, not by the NCSC. For the EU equivalent of NIS, see NIS 2.

Structure

How CAF v3.2 is organised

Four objectives contain 14 principles. Each principle is broken into contributing outcomes, 39 in all, and each contributing outcome has an Indicators of Good Practice table.

Objective A

Managing security risk

Appropriate organisational structures, policies and processes are in place to understand, assess and manage security risks to systems that support essential functions.

A1 Governance
A1.a Board Direction, A1.b Roles and Responsibilities, A1.c Decision-making.
A2 Risk Management
A2.a Risk Management Process, A2.b Assurance.
A3 Asset Management
A3.a Asset Management.
A4 Supply Chain
A4.a Supply Chain.
Objective B

Protecting against cyber attack

Proportionate security measures are in place to protect the systems and networks that support essential functions.

B1 Service Protection Policies, Processes and Procedures
B1.a Policy, Process and Procedure Development, B1.b Policy, Process and Procedure Implementation.
B2 Identity and Access Control
B2.a Identity Verification, Authentication and Authorisation, B2.b Device Management, B2.c Privileged User Management, B2.d Identity and Access Management (IdAM).
B3 Data Security
B3.a Understanding Data, B3.b Data in Transit, B3.c Stored Data, B3.d Mobile Data, B3.e Media / Equipment Sanitisation.
B4 System Security
B4.a Secure by Design, B4.b Secure Configuration, B4.c Secure Management, B4.d Vulnerability Management.
B5 Resilient Networks and Systems
B5.a Resilience Preparation, B5.b Design for Resilience, B5.c Backups.
B6 Staff Awareness and Training
B6.a Cyber Security Culture, B6.b Cyber Security Training.
Objective C

Detecting cyber security events

Capabilities exist to make sure security defences remain effective and to detect cyber security events that affect, or could affect, essential functions.

C1 Security Monitoring
C1.a Monitoring Coverage, C1.b Securing Logs, C1.c Generating Alerts, C1.d Identifying Security Incidents, C1.e Monitoring Tools and Skills.
C2 Proactive Security Event Discovery
C2.a System Abnormalities for Attack Detection, C2.b Proactive Attack Discovery.
Objective D

Minimising the impact of cyber security incidents

Capabilities exist to minimise the adverse impact of a cyber security incident on essential functions, including restoring those functions where necessary.

D1 Response and Recovery Planning
D1.a Response Plan, D1.b Response and Recovery Capability, D1.c Testing and Exercising.
D2 Lessons Learned
D2.a Incident Root Cause Analysis, D2.b Using Incidents to Drive Improvements.
Assessment

Indicators of Good Practice and ratings

Achieved
Typically, all the indicators in the achieved column are present, unless an indicator does not apply and the outcome is met by other means.
Partially achieved
Offered only for some contributing outcomes, where a partial position delivers a real and specific security benefit.
Not achieved
Any one indicator in the not achieved column is normally enough to justify this rating.
CAF profiles
A regulator or oversight body can set a profile: the subset of outcomes and target ratings that matter most for the organisations it oversees. Achieving all 39 outcomes indicates security well beyond basic cyber hygiene.
v4.0

What changed in CAF v4.0

Published by the NCSC in August 2025. The 14 principles remain, with new and renamed contributing outcomes.

A2.b Understanding Threat
A new contributing outcome on understanding attackers’ methods and motivations to inform risk decisions. Assurance moves to A2.c.
A4.b Secure Software Development and Support
A new contributing outcome on developing and maintaining software used for essential functions securely.
Monitoring and threat hunting
Contributing outcomes under C1 are renamed and updated, and detection and threat hunting are strengthened.
AI-related risk
Coverage of AI-related cyber risks is extended across the framework.

Implementation roadmap

How to implement it, step by step

A typical route to a first CAF self-assessment for an organisation that a regulator or oversight body assesses against v3.2.

  1. 1

    Confirm the edition and profile

    Ask the regulator or oversight body which CAF edition, profile and target ratings apply, and the date the assessment is due.

    OutputsConfirmed editionTarget profile
  2. 2

    Identify essential functions and scope

    Define the essential functions and the network and information systems that support them, including dependencies on suppliers and shared services.

    OutputsEssential function listSystem and dependency map
  3. 3

    Assign owners to contributing outcomes

    Give each of the 39 contributing outcomes, or those in the profile, an accountable owner and a clear link to the systems in scope.

    OutputsOutcome ownership matrix
  4. 4

    Self-assess against the indicators

    Work through each Indicators of Good Practice table and propose a rating, citing evidence for each judgement rather than relying on assertion.

    OutputsDraft self-assessmentEvidence references
  5. 5

    Plan improvements

    Where outcomes fall short of the target profile, agree improvement actions with owners and dates, prioritised by risk to essential functions.

    OutputsImprovement planRisk register updates
  6. 6

    Board review and submission

    Brief the board on ratings, gaps and the improvement plan, then submit the self-assessment as the regulator or oversight body requires.

    OutputsBoard briefingSubmitted assessment
  7. 7

    Respond to review and track actions

    Answer questions from the regulator or independent assessor, agree any changes to ratings and track improvement actions to closure.

    OutputsAgreed ratingsAction tracker
  8. 8

    Prepare for v4.0

    Map the new v4.0 outcomes, especially understanding threat and secure software development, against current practice so the next assessment does not start from scratch.

    Outputsv4.0 gap list

Audit and evidence guide

What auditors look for, and the evidence to keep

The CAF is applied by regulators and oversight bodies in their own way. Most start with the organisation’s self-assessment, then review it, and some require independent assurance or inspection.

A typical assessment cycle

  1. Step 1

    Profile set

    The regulator or oversight body confirms the edition and the target profile for the organisation or sector.

  2. Step 2

    Self-assessment

    The organisation rates each contributing outcome against the Indicators of Good Practice and records its evidence.

  3. Step 3

    Review or independent assurance

    The regulator, or an assessor it accepts, reviews the ratings and evidence and may challenge or change them.

  4. Step 4

    Improvement plan

    Gaps against the profile are addressed through an agreed improvement plan, which the regulator may monitor.

  5. Step 5

    Reassessment

    The cycle repeats at the frequency the regulator or oversight body sets.

What reviewers look for

  • A clear definition of essential functions and the systems that support them
  • Board direction and accountability for cyber risk
  • A working risk management process that reflects real threats
  • An asset inventory that matches the systems in scope
  • Supply chain risks understood and managed
  • Identity, authentication, privileged access and MFA, revised in v3.2
  • Vulnerability management and secure configuration in practice
  • Logging and monitoring coverage that would detect an attack
  • Response and recovery plans that have been tested
  • Lessons learned from incidents feeding improvements

Key timelines

CAF v3.2 publishedApril 2024
CAF v4.0 publishedAugust 2025
Self-assessmentAs the regulator sets
Edition usedAs the regulator sets
Improvement actionsAs agreed in the plan

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Governance

  • Board minutes on cyber risk
  • Roles and responsibilities
  • Decision records

Risk and assets

  • Risk register
  • Asset inventory
  • Essential function and dependency map

Supply chain

  • Supplier risk assessments
  • Contract security clauses
  • Supplier assurance records

Protection

  • Access and MFA configuration
  • Privileged user reviews
  • Vulnerability and patch records
  • Backup tests

Detection

  • Logging coverage
  • Alert handling records
  • Threat hunting outputs

Response and recovery

  • Incident response plan
  • Exercise reports
  • Root cause analyses

People

  • Training records
  • Awareness activity

Areas that often need attention

  • Essential functions and supporting systems not clearly defined
  • Ratings claimed without evidence for each indicator
  • Supply chain dependencies not identified or assessed
  • Privileged access and MFA short of the revised v3.2 indicators
  • Monitoring that does not cover the systems in scope
  • Response plans that have never been exercised
  • Improvement actions without owners or dates
  • Assuming v3.2 is still the edition required without checking with the regulator

How Netra helps

Where each part of the work lives in Netra

Netra loads CAF v3.2 as outcomes, tasks and policies, so ratings can be traced to the work and evidence behind them. Work done here also counts towards frameworks such as ISO 27001:2022 (Requirements) and NIS 2 wherever the same control applies.

Contributing outcomes owned and evidenced

Task Engine

Requirements arrive as tasks with owners and due dates, and recurring tasks keep evidence current between assessments.

Position on each contributing outcome

Compliance Centre

Status is derived from completed tasks and evidence, never typed in, which supports a self-assessment that can be traced to evidence.

Risk management (A2)

Risk Manager

A risk register with inherent and residual heatmaps. Risks come down as linked tasks are completed.

Asset management (A3)

Asset Management

Assets are linked to the tasks that protect them.

Supply chain (A4)

Third-Party Risk

Vendors found from what Accounts and Purchase pay, assessed through a vendor portal, with decisions and ratings recorded.

Policies and procedures (B1)

Policy Hub

A policy library generated at onboarding, with a policy score.

Assessment findings and improvement plan

Audit Centre

Record internal or regulatory assessments end to end, with findings and corrective actions and evidence in a tamper-evident vault.

Board direction (A1)

Dashboard & Reports

A live Posture Score and a one-click board report for the framework.

Netra organises the work, evidence and reviews. It is not a SIEM or monitoring service, not a regulator or assessor, and not a reporting channel to a competent authority. It does not by itself establish that any CAF outcome is achieved; ratings are judged by the organisation and its regulator or assessor. Check which CAF edition your regulator requires before relying on the v3.2 entry.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Security

NIS 2

Connect cyber-risk responsibilities across your organisation

Security

NIST CSF 2.0

Connect cyber governance with day-to-day action

Security

Cyber Essentials

Get the basics organised before your assessment

See NCSC CAF v3.2 in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.