NCSC Cyber Assessment Framework (CAF)

The UK’s Cyber Assessment Framework (CAF), developed by the NCSC, is an outcome-based method for assessing how well an organisation protects its essential functions from cyber risks. It employs a hierarchical structure of four objectives, 14 principles, 41 contributing outcomes, and Indicators of Good Practice (IGPs) to guide expert judgement, not act as a rigid checklist.

Regular cyber security audits are the cornerstone of any effective security strategy.

A cyber security audit is an essential, independent review of an organisation’s people, processes, and technology, verifying protective measures and ensuring compliance. In 2025, these audits are crucial due to escalating threats, increasing regulatory scrutiny, and insurer demands, offering significant ROI by reducing breach costs and lowering premiums.

What is the NCSC Cyber Assurance Framework?

The Cyber Assessment Framework assesses how well you manage cyber risks to your essential functions. It looks at the systems and services that deliver those functions, plus the organisation-wide controls that govern them. You begin by defining the essential function, identifying the critical systems that support it and their suppliers, then assess the 41 contributing outcomes that span prevention, detection and response.

Essential functions and supporting systems: scope, dependencies, assets and supplier touchpoints.
System-level controls (Objectives B & C): identity and access, data/system security, resilient networks, security monitoring.
Organisation-wide controls (Objectives A & D): governance, risk management, asset and supply chain, incident response, recovery, lessons learned.

Key Advantages of conducting Cyber Security Audits

CAF shouldn’t be an annual event; bake its outcomes into business‑as‑usual (BAU). Use the agreed profile as your north star, and fold the 41 contributing outcomes into governance, risk and change. Give the board simple, outcome‑level status, and drive continuous improvement through established rhythms (risk committees, service reviews, supplier management, exercises) with evidence refreshed on a defined cadence.

Governance cadence: quarterly checkpoints; annual reassessment aligned to planning.
Risk/register: assign owner, due date, and risk acceptance.
Metrics: board dashboard per objectives A–D; refresh IGP‑evidence regularly.
Change & procurement: gate changes/contracts against IGPs; include SLA evidence.
Assurance & learning: internal audit, independent review; D2 lessons close gaps.

Why are Cyber Security Audits important?

The NCSC Cyber Assessment Framework is critically significant as it offers a comprehensive, structured, and methodical approach for evaluating and enhancing an organisation’s cybersecurity posture. This framework facilitates the identification of potential vulnerabilities that may exist within an organisation’s network and information systems. Additionally, it prioritises remediation efforts, enabling organisations to allocate resources effectively to the most pressing areas of concern. By ensuring alignment with recognised industry best practices, the framework ultimately strengthens the organisation’s resilience against a diverse range of cyber threats. This systematic evaluation not only enhances security protocols but also promotes a proactive security culture within the organisation, thereby reinforcing defences against future cyber incidents.

Managing security risk effectively requires a comprehensive understanding of potential vulnerabilities and threats.
Protecting against cyber attacks involves not only implementing advanced technological defences but also educating staff..
Detecting cybersecurity events promptly is crucial; this requires the right tools and processes to monitor for unusual activity within our networks.
Minimising the impact of incidents is essential for maintaining business continuity and ensuring we have contingency plans in place.

4 Objectives

Popular Managed Services:

Outcomes that clearly articulate what must be achieved are essential for maintaining focus and direction, emphasising the importance of not just identifying the results we aim to attain, but also ensuring that our efforts are deeply rooted in these intended outcomes. By concentrating intently on these results, we can navigate the complexities of the journey ahead with greater clarity and purpose, rather than simply outlining the specific methods or processes to be employed. It is crucial to underscore the significance of these outcomes, as they serve as a guiding compass for our actions and strategies.

14 Principles

Popular Managed Services:

The assessable units associated with each principle are not only critical but also integral, contributing significantly to a comprehensive understanding and effective implementation of these principles across various contexts and applications. These units function as essential building blocks that enhance our knowledge while ensuring the principles can be applied practically in real-world scenarios and integrated into related practices or strategies. By gaining a thorough understanding of these components, we can more effectively appreciate how each principle operates and interacts within distinct frameworks, ultimately leading to improved outcomes.

Popular Managed Services:

Contributing outcomes

What to expect our Cyber Assessment Framework services from TrustedIA

An audit is a conveyor belt: each stage passes labelled evidence to the next until the board receives an actionable report. The six-step flow below suits most engagements and mirrors ISO 27001’s Plan-Do-Check-Act cycle.

Scoping and Planning

Establish clear objectives, identify assets, comply with regulatory requirements, and define success criteria. Formalize a Non-Disclosure Agreement, outline timelines, budgets, and key contacts. Thorough project scoping mitigates risks of audit scope expansion and unforeseen issues during the project lifecycle.

Information Gathering & Documentation Review

Our auditors conduct thorough examinations of policies, supporting information, diagrams, logs, and tickets, followed by structured interviews with staff utilising brief questionnaires. Their process begins with understanding the established protocols before assessing actual performance.

Technical Evaluation

Our team employs vulnerability scanners, conducts thorough configuration reviews, and performs physical assessments to evaluate representative systems. Findings are systematically assessed using a risk matrix to ensure that critical vulnerabilities are promptly identified.

Gap Analysis and Risk Assessment

Results are mapped to the chosen framework—ISO/IEC 27001, MoD Secure by Design. NCSC CAF, NIST CSF, NIST 800-53, PCI DSS—then scored for likelihood × impact. This translation turns raw issues into business risks the board recognises.

Reporting and Recommendations

A draft report is circulated to ensure factual accuracy, followed by an executive summary, comprehensive findings, and a prioritized action plan. Clear visuals and RAG status facilitate effective decision-making and expedite budget approval.

Follow-Up and Verification

Following remediation, auditors may conduct re-assessments of identified hotspots or facilitate a concluding workshop. Insights gained will contribute to continuous improvement dashboards and inform the audit scope for the upcoming year, thereby completing the PDCA cycle.