The Complete Guide to the Cyber Assessment Framework

Critical services now depend on a chain of technology, people and suppliers that reaches well beyond one IT estate. The Cyber Assessment Framework (CAF), developed by the NCSC, helps organisations assess whether the cyber risks to a defined essential function are being managed well enough. This guide explains how CAF 4.0 is structured, what assessors look for and where to begin.

Key Takeaways

• CAF starts with the service
  It asks whether an attacker, or a failure in a critical dependency, could stop a defined essential function, then traces back through the people, suppliers and systems behind it.
• CAF 4.0 updated the framework in August 2025
  The update adds deeper threat analysis, secure software and supply-chain expectations, stronger monitoring and threat hunting, and broader treatment of AI-related cyber risk.
• Evidence from day-to-day work carries weight
  Assessors look for evidence from operation, such as a recent restore test or a dated risk decision, over a policy that only says the work happens.

What’s inside?

• How CAF 4.0 is organised: four objectives, 14 principles and 41 contributing outcomes
• How an assessor reaches a conclusion and how profiles set the target
• Weak and CAF-quality answers for a managed service provider
• Where CAF is used today, from sector regulators to NHS and government assurance
• How CAF relates to Cyber Essentials, ISO/IEC 27001 and sector requirements
• When CAF is proportionate, and a first 90 days for starting with one service