The NCSC CAF, made simple
Show your regulator and customers how well you manage cyber risk. AI drafts your CAF self-assessment from everything it knows about your organisation. You review, approve and build the evidence.
The NCSC Cyber Assessment Framework (CAF) describes what good cyber resilience looks like for organisations running important services. Rather than a checklist, it sets outcomes and gives Indicators of Good Practice to judge them against.
- objectives
- 4
- principles
- 14
- place for all your evidence
- 1
How it works
From scope to improvement plan
Add your organisation
Tell us who you are, and upload any security policies you already have so we can build on them.
Map your essential functions
List the services that matter most, and the people, systems and suppliers behind them.
Assess the outcomes
AI drafts a rating for each contributing outcome against the Indicators of Good Practice, with its reasoning. You review, amend and confirm.
Plan improvements
Turn the gaps into an improvement plan, with owners and dates, that you can share with your board or regulator.
Stay compliant
Keep evidence, incidents and reviews current, so your next assessment starts from where you left off.
Everything,
in one place
Your existing documents
Upload what you have. We compare it against each outcome and flag conflicts and gaps.
Every objective and principle
Questions covering all 4 objectives and 14 principles, with AI-drafted ratings you check and confirm.
Indicators of Good Practice
Each outcome laid out against its indicators, so you can see why it’s rated achieved, partially achieved or not achieved.
Improvement plan
Gaps against your target CAF profile turned into actions, with owners, target dates and progress you can report on.
Evidence library
Policies, records and screenshots linked to the outcomes they support, ready for an assessor.
Continuous compliance
Incidents, internal reviews and policy sign-offs, with evidence attached, so your assessment stays current between reviews.
Common questions
- What is the CAF?
- The Cyber Assessment Framework is published by the National Cyber Security Centre (NCSC). It has four objectives: managing security risk, protecting against cyber attack, detecting cyber security events and minimising the impact of cyber security incidents. Each one breaks down into principles and outcomes.
- Who uses it?
- It was written for organisations running essential services under the NIS Regulations, such as energy, transport, water and health. It’s now used more widely, including across critical national infrastructure, government and the NHS’s Data Security and Protection Toolkit.
- Is there a CAF certificate?
- No. The NCSC is clear that the CAF is not a certification scheme. Depending on your sector, you self-assess or are assessed independently, for example by your regulator or an assessor working on its behalf. Either way, we get your assessment and evidence ready.
- Already have Cyber Essentials or ISO 27001?
- A lot carries across. Both cover controls the CAF asks about, and your organisation, assets and suppliers are already in the same ComplySmart account.
Get assessment-ready
and stay that way.
The NCSC CAF is coming to ComplySmart. Book a call with our sales manager to hear what’s planned and get early access.
Book a call with our sales manager(opens in a new tab)