In this article 7 sections
The NCSC Cyber Assessment Framework (CAF) was written for organisations that run essential services. MSPs now meet it in two places: the Cyber Security and Resilience Bill, and supplier questions from regulated clients. It is also a sound way to check your own security.
What is the NCSC CAF?
The NCSC calls the CAF “the UK’s approach to assessing and improving cyber resilience”. It gives a common structure for judging whether an organisation manages cyber risk well, and where it needs to improve. It is used in sectors regulated under NIS, wider critical national infrastructure and government, and the NCSC says any organisation that wants a structured, outcomes-based approach to cyber risk can use it (NCSC, Cyber Assessment Framework).
Two points matter most for an MSP.
- It is outcomes-based. The principles are a “specification of what needs to be achieved rather than a checklist of what needs to be done” (NCSC, Introduction to the CAF). The CAF doesn’t tell you which products to buy.
- It is not a certificate. The NCSC says the CAF “is not a certification scheme”, and that achieving a CAF profile should not be presented “as evidence of NCSC certification or endorsement” (NCSC, Cyber Assessment Framework).
How CAF 4.0 is built
Version 4.0 was released on 4 August 2025 (NCSC, CAF changelog). It has four layers.
4 objectives and 14 principles
| Objective | Principles |
|---|---|
| A. Managing security risk | A1 Governance, A2 Risk management, A3 Asset management, A4 Supply chain |
| B. Protecting against cyber attacks | B1 Service protection policies, processes and procedures, B2 Identity and access control, B3 Data security, B4 System security, B5 Resilient networks and systems, B6 Staff awareness and training |
| C. Detecting cyber security events | C1 Security monitoring, C2 Threat hunting |
| D. Minimising the impact of cyber security incidents | D1 Response and recovery planning, D2 Lessons learned |
Version 4.0 removed the old C2, Proactive security event discovery, and added a new C2, Threat hunting (NCSC, CAF v4.0 record of changes).
41 contributing outcomes
Each principle breaks into contributing outcomes, “all of which will normally need to be achieved to fully satisfy the top-level principle”. Applying the CAF produces “41 individual assessments”, one for each contributing outcome (NCSC, Introduction to the CAF).
Indicators of good practice
Each contributing outcome has a table of indicators of good practice (IGPs). The assessor judges the outcome against them:
- Achieved: all the indicators in the green column would normally be present.
- Not achieved: any one indicator in the red column would normally be enough.
- Partially achieved: used for some outcomes only. It must deliver “specific worthwhile cyber security and resilience benefits”, not credit for “doing something vaguely relevant”.
IGPs inform expert judgement. The NCSC says they are not “a checklist to be used in an inflexible assessment process” (NCSC, Introduction to the CAF).
What a CAF profile is
A CAF profile “sets a minimum level of achievement across the framework’s contributing outcomes” (NCSC, Cyber Assessment Framework). In practice it mixes outcomes to be met at achieved, some at partially achieved and some marked not applicable (NCSC, Introduction to the CAF).
Profiles are informed by threat analysis. The NCSC’s CAF Core Profile sets a minimum level of cyber resilience for organisations facing “moderately sophisticated cyber adversaries”, including ransomware and supply chain compromise. The NCSC calls it a minimum starting point, not an end state (NCSC, Cyber Assessment Framework).
The NCSC doesn’t set targets itself: “Any target set for organisations to achieve in terms of CAF results is for the relevant cyber oversight body to define.” It also says regulated organisations should ask their regulator whether to use the CAF (NCSC, Introduction to the CAF).
Why the CAF matters to a growing MSP
- Regulation. Once it becomes law, the Cyber Security and Resilience Bill will bring medium and large MSPs into the NIS regime as Relevant Managed Service Providers. Our Bill guide for MSPs covers where it stands and what it asks beyond CAF 4.0.
- Your clients’ supply chain. A4, Supply chain, is one of the 14 principles. A client assessed against the CAF has to consider its suppliers, and its MSP is one of them. So the questions reach you as a supplier questionnaire, often before you are in scope yourself.
- Your own security. You check every client’s systems. The CAF gives you an outcome-based way to check your own, well beyond the five technical controls of Cyber Essentials.
Using the CAF before anyone asks
The NCSC says the CAF supports identifying essential functions, assessing against a target profile, finding strengths and weaknesses, prioritising improvement, and ongoing monitoring and review (NCSC, Cyber Assessment Framework). For an MSP, that becomes five steps:
- Name the systems your clients depend on: remote management, the PSA, remote access, backup and the admin accounts behind them.
- Scope the assessment to those systems and the suppliers they rely on.
- Work through the 41 contributing outcomes and gather the evidence for each.
- Fix the outcomes rated not achieved first.
- Repeat it. The NCSC says achieving the Core Profile “should not be treated as a one-off exercise”.
Self-assessment is allowed. The NCSC adds that “independent audit, assurance or testing activities generally provide greater confidence in assessment outcomes” (NCSC, Cyber Assessment Framework).
Saying “CAF” in a proposal
The NCSC asks organisations that communicate CAF outcomes to be clear about (NCSC, Cyber Assessment Framework):
- the CAF version used
- the CAF profile used
- the scope of the assessment
- whether it was self-assessed or independently reviewed
- any assumptions, limitations or ongoing improvement activity
“CAF aligned” on its own gives a prospect nothing to check. Those five points do.
How Assurix’s 40 security controls align to CAF 4.0
The Assurix Trustmark covers 59 controls: 40 security controls aligned to NCSC CAF 4.0, and 19 operational controls built for MSPs, which sit outside the CAF. The 40 security controls follow the CAF’s objectives.
| CAF objective | Assurix security controls | Examples |
|---|---|---|
| A. Managing security risk | 9 | Board-level ownership of cyber risk, Supplier risk |
| B. Protecting against cyber attacks | 20 | Proving who is signing in, Backups |
| C. Detecting cyber security events | 6 | Monitoring coverage, Acting on alerts |
| D. Minimising the impact of cyber security incidents | 5 | A response plan, Learning from incidents |
Each control sits under a CAF principle: A1 to A4, B1 to B6, C1, D1 and D2. Threat hunting (C2) has no control of its own. The controls page lists every control in plain English.
How it is checked. An Assurix assessor signs off. Live-measured controls are checked every six hours from the MSP’s own tools, and the rest on a set cycle. A failure opens a 30-day window to fix it. If it isn’t fixed, the Trustmark is suspended publicly.
Where you start. In Launchpad, Rosie reads your existing policies and documents and maps them to the controls. You work from 2 hours a week, at the pace you set.
