A CAF assessment can feel manageable when someone who has done it before is working alongside you. The requests that land in your inbox are specific rather than open ended. You get guidance on which evidence supports an outcome, and where more is needed, before you spend time collecting it.
Somebody is keeping the schedule, talking to the people who hold the records, and telling you what happens next. That is the experience E2E Security Consulting's consultants are there to create, and they bring practical, hands-on knowledge of the framework to it.
The National Cyber Security Centre (NCSC) is the UK's national technical authority for cyber security. Its Cyber Assessment Framework (CAF) is organised as four objectives across fourteen principles, written as outcomes to achieve rather than a checklist to tick. Each principle divides into contributing outcomes, and an assessment records a position against every one of them together with the reasoning behind it. The current NCSC version is 4.0, released on 4 August 2025.
An assessment can be a self-assessment by the responsible organisation. It can also be carried out by an independent external entity such as a regulator, a cyber oversight body, or a suitably qualified organisation acting on a regulator's behalf. Alongside the technical assessment, there is coordination, judgement and writing: work an experienced consultant can carry with you.
Experience helps turn framework language into practical work. A consultant who knows the CAF can help you judge what evidence a reviewer will expect behind a contributing outcome. That reduces the guesswork in planning the assessment.
In practice, that means a few concrete things. Requirements become a short list of named tasks rather than a wall of framework language. Control owners are asked clear questions in their own vocabulary, so a network engineer is not handed a governance outcome to interpret alone. Evidence you already hold gets used: change records, ticket histories, review minutes and monitoring reports can support the assessment, and identifying them early helps avoid unnecessary collection.
We also work to make the engagement itself straightforward, collaborative and, as far as an assurance exercise can be, enjoyable. People do their best thinking when they are not braced for an interrogation.
A CAF assessment is not a document hunt. It moves from the records you already hold, to a reasoned status for each outcome, to a plan your organisation can run.
Use the change records, ticket histories, review minutes and monitoring you already produce. Identify it early so you collect only what is genuinely missing.
Assess each contributing outcome against the indicators of good practice and the applicable profile, explaining the basis for each status as it is made.
Turn gaps into a prioritised plan, each item with a named owner and a date, ready for the independent review.
A supported assessment follows a clear sequence. Each stage has an owner, and the output of one feeds the next.
The four objectives give the assessment its shape: Objective A, managing security risk; Objective B, protecting against cyber attack; Objective C, detecting cyber security events; and Objective D, minimising the impact of incidents.
CAF v4.0 has 41 contributing outcomes. For GovAssure, current UK Government Security guidance assigns each assessed system one of two Government CAF Profiles, Basic or Enhanced, and each profile sets a target for every one of those 41 outcomes. Other applications differ: Ofgem's guidance for downstream gas and electricity operators of essential services works to 39 contributing outcomes and adds three physical security outcomes of its own, and some older GovAssure material still refers to 39 judgements from an earlier CAF version.
On 30 October 2026 the NCSC also published the CAF Core Profile: a common minimum benchmark, built on CAF v4.0, for organisations that provide essential services or support critical national infrastructure. Regulators and organisations can set higher expectations where circumstances require. So the practical point is short: confirm the programme, version, profile and scope that govern you before any evidence is collected, and that is what we do first. No consultant can lower a target that has been set. What we can do is confirm which target applies, identify where your evidence supports it, and show where work remains.
Scope follows. Start with the essential functions, then the critical systems they rely on. Under GovAssure, stage 2 has the organisation identify those systems and decide which it will assess during the current year; objectives A and D are generally organisational-level with answers potentially reusable across systems, while B and C are generally assessed per system. We record why something sits outside the boundary at the same time as why something sits inside, so the boundary holds up under challenge.
Contributing outcomes cut across cyber security, information governance, IT operations and service ownership. NHS England's CAF-aligned Data Security and Protection Toolkit guidance puts the expectation plainly: organisations are expected to plan their approach, scope their essential functions and allocate ownership of contributing outcomes ahead of submission, bearing in mind that the majority of outcomes require joint working across cyber security and information governance teams.
Drawing that map together helps avoid duplicated requests and missed owners. We agree the owners with you, brief them on what they are being asked for, and then do the chasing.
We work from what exists. Each outcome gets a short, answerable request, and what comes back is checked against four questions before it goes anywhere near a judgement: what would show this operated, when did it last operate, who owns it, and what record did it leave.
GovAssure requires organisations to demonstrate how they meet each contributing outcome and the stated indicators of good practice (IGPs) by providing statements and evidence. Finding gaps at this stage gives you time to agree next steps before review.
The NCSC states that assessing contributing outcomes is primarily a matter of expert judgement and that IGPs are not a checklist. Normally, all the 'achieved' indicators would be present to support an 'achieved' status, and any one 'not achieved' indicator would normally justify 'not achieved'. There is an exception: an indicator may not be applicable where compensating measures would meet the requirements of the relevant objective.
The written rationale is the artefact that carries the assessment. Ofgem requires operators of essential services to provide rationale and evidence for the assessed status of each contributing outcome, including for outcomes recorded as not required or not yet assessed. UK Government Security adds that an organisation is not expected to receive an 'achieved' status for every outcome, as that would likely be disproportionate for an OFFICIAL system. The applicable profile determines the target for each outcome, and we help you understand those targets and the evidence each requires.
A gap register ordered by what is easiest to close produces a different programme from one ordered by consequence to the essential function. We work with you on the second, while weighing the deadlines and dependencies that legitimately shape sequencing. Every action leaves the engagement with a named owner and a date.
Preparation and independent assurance are different roles, and we are firmly in the first. UK Government Security states that the CAF is used both for the organisation's self-assessment and by the independent assessor during the assurance review. For a GovAssure stage 4 Independent Assurance Review, suppliers must be registered as Assured Service Providers on the NCSC Cyber Resilience Audit scheme to be eligible to deliver it, and organisations should use the Cyber Security Services 3 agreement for that procurement. That scheme assures the auditor, not the audited organisation.
So we prepare you for that conversation: rehearsing the questions, making sure contributors can speak to their own evidence, and tidying anything that would waste the reviewer's time. The CAF is not a certification scheme, and no engagement can promise a particular assessed outcome. What a good one can do is make sure the position you submit is one you are ready to defend. Our note on preparing for GovAssure covers the five-stage sequence in more detail.
A defensible CAF position needs evidence that fits the outcome being assessed. Policies and designs show the intended arrangement, implementation evidence shows what has been put in place, and operational records show what actually happened. All three can matter, and the assessment weighs them together against the indicators of good practice. What design evidence cannot do on its own is show that a control ran: a policy, a procedure and an architecture diagram cannot establish that an access review took place. A completed review with a date, a named reviewer, a stated scope and a recorded result can.
A completed review may legitimately find no accounts to remove; the review still operated and still left a record. This is illustrative guidance; the table sets no review frequency. Your oversight body, your profile and your own risk judgement set the cadence.
What follows is fictional. It describes no client and no engagement.
Outcome judgement: pending. Indicators in view: under B2.c, the NCSC expects the identities of individuals with privileged access to be known and managed, including third parties, and privileged user access rights to be regularly reviewed. Evidence reviewed: the privileged access review for the in-scope service, completed on 14 September 2026 and signed by the service owner as reviewer, checked against the privileged account register for that service. It covered twelve of the fourteen privileged accounts on the register, and removed none, which is a legitimate result and still a record of operation.
Limit of this evidence: two contractor accounts do not appear in the review's record, so nothing here shows their access was checked this cycle. Because B2.c names third parties explicitly, that omission matters more than its size suggests. This record speaks to part of the indicators above. The remaining indicators for B2.c have not yet been assessed.
Next action: review the access of the two contractor accounts already on the privileged account register and record the result, rather than waiting for the next cycle. Owner: the service owner. Agreed deadline: within ten working days of the finding (illustrative).
'Judgement pending' is a working label in our own tracker, not a CAF grade. B2.c is judged once the full indicator set has been assessed against the applicable profile, with any compensating measures taken into account.
The record does two things deliberately. It does not grade the outcome from a single artefact, because an outcome is judged against a set of indicators rather than one document. And it does not park a known access gap until the next quarter; it sets an action and deadline to address it. One review is not the whole assessment. It is one line in a register that will hold many, and a consultant who has built that register before can help distinguish completed records from those needing more work.
Six checks, run before anything is handed over:
Some engagements use E2ERisk, E2E Security Consulting's own platform, to hold that record between cycles. Its CAF module keeps evidence against individual indicators of good practice alongside the scoring rationale, tracks per-indicator gaps with action plans and owners, and provides a multi-stakeholder review workflow with comment threads and approval gates. It is there where it helps rather than being a requirement of working with us.
If a CAF assessment has landed on your desk, we would be glad to talk it through. Bring whatever you have - which body is asking, which systems you think are in scope, which profile applies if you know it, and what evidence already exists.
If you cannot answer all of those yet, that is a perfectly normal place to start, and working out the answers is a good first conversation. You can also see how our consultants support this work on our GovAssure support services page.
The CAF is the NCSC's framework for assessing cyber resilience, organised as four objectives across fourteen principles and written as outcomes to achieve rather than a checklist. Each principle divides into contributing outcomes, judged as achieved or not achieved, with partially achieved available for those outcomes whose indicator tables provide for it, and each status is supported by evidence and a written rationale.
CAF v4.0 has 41 contributing outcomes, and for GovAssure the Basic and Enhanced Government CAF Profiles set a target for each of them. Other applications differ: Ofgem's guidance for downstream gas and electricity operators works to 39 and adds three physical security outcomes, and older GovAssure material refers to 39 judgements from an earlier version. Confirm the programme, version, profile and scope that govern you before collecting evidence.
Evidence that fits the outcome being assessed. Policies, procedures and designs show the intended arrangement; implementation evidence shows what is in place; operational records, such as a completed review with its date, the person who signed it off, its scope and its result, show the control actually ran. The assessment weighs the combined evidence against the indicators of good practice for that outcome.
For a GovAssure stage 4 Independent Assurance Review, the reviewer must be registered as an Assured Service Provider on the NCSC Cyber Resilience Audit scheme, procured through the Cyber Security Services 3 agreement. That scheme assures the auditor, not the audited organisation, and preparation is a separate role from the review itself.
No. The CAF records an evidenced position against outcomes, measured against the profile that applies to you - it is not a pass or fail certificate. An organisation is not expected to reach an achieved status for every outcome, and under GovAssure that would usually be disproportionate for an OFFICIAL system.
More from the E2ERisk team on UK public-sector cyber assurance, GovAssure and the CAF.
Occasional, practical notes on UK public-sector cyber risk and compliance. No spam, unsubscribe anytime.
A 30-minute walkthrough on your own assessment - the live platform, no slides. Or send us a question and we will get back to you.