Build Essential Eight maturity without the spreadsheet scramble

CAF is the UK's flagship cybersecurity assessment framework developed by the National Cyber Security Centre. It provides an outcome-focused, systematic approach for assessing how effectively organisations manage cyber risks to essential functions. Unlike prescriptive control frameworks, CAF focuses on what you achieve rather than dictating how you achieve it.

The ACSC recommends the Essential Eight as a cyber security baseline for organisations. It is relevant to small and medium businesses, large organisations, critical infrastructure and government; each organisation should set its target maturity level according to its own risk profile and requirements.

The Essential Eight covers application control, application patching, Microsoft Office macro settings, user application hardening, restriction of administrative privileges, operating-system patching, multi-factor authentication and regular backups.

The ACSC Essential Eight Maturity Model provides advice on implementing the eight mitigation strategies. Organisations can use it to assess current practices, set a risk-informed target maturity level and prioritise improvement work.

Baseline Profile: Minimum standard for most critical systems. Modeled on untargeted attacks by unskilled adversaries.

Enhanced Profile: Higher standard for CNI and high-value targets. Modeled on attacks by moderately skilled or expert adversaries (nation-state actors, APTs).

Profile assignment depends on risk to life, sensitive data handling, national security functions, and threat landscape.

Released August 2025, CAF 4.0 introduced significant enhancements:

• Enhanced threat understanding (A2.b): Proactive threat intelligence integration into risk decisions
• Secure software development lifecycle (A4.b): Secure-by-design principles and SBOM requirements
• Advanced monitoring and threat hunting (C1 & C2): Behavioral baseline analysis and repeatable threat hunting
• AI and automated decision-making: AI-specific risk assessments integrated across outcomes
• Elevated threat model: Focus on capable, well-resourced adversaries rather than just common threats

CAF: Outcome-focused NCSC framework for essential services and CNI. Assesses what you achieve against capable adversaries.

ISO 27001: International ISMS standard with prescriptive controls. Certifiable, focuses on information security management system.

Many organisations implement both—ISO 27001 for international recognition, CAF for UK essential services compliance. Evidence overlap is significant.

NHS DSPT aligned with CAF in September 2024. CAF-aligned DSPT includes:

• 47 contributing outcomes (41 core CAF + 6 health-specific)
• Same maturity assessment (Not Achieved, Partially Achieved, Achieved)
• Independent audit requirements for Category 1 & 2 NHS organisations

DSPT is essentially CAF applied to healthcare with sector-specific additions.

There is no fixed timeframe. An Essential Eight uplift depends on current maturity, target level, technology, available resources and the remediation required. Start with a baseline assessment, assign accountable owners and prioritise changes by risk.

Most sectors require independent assurance reviews from:

• NCSC Cyber Resilience Audit Scheme providers
• Competent Authority oversight
• Third-party validation of self-assessments
• Annual review cycles for CNI and OES

Category 1 & 2 NHS DSPT organisations require independent audits. OES under NIS Regulations face Competent Authority assessment.

We automate outcome management: 41 contributing outcomes tracked with IGP evidence mapping, maturity scoring across objectives, profile management (Baseline/Enhanced switching), threat intelligence integration for CAF 4.0, and assurance-ready documentation exports. You focus on achieving resilience outcomes; we handle evidence coordination and maturity tracking. When NCSC-assured assessors arrive, documentation exports in their expected format.

Yes. CAF and ISO 27001 have significant control overlap. Hicomply's unified evidence management means documentation collected for CAF supports ISO 27001 requirements and vice versa. One evidence collection process, multiple framework outputs. That satisfying moment when one control achieves outcomes in both frameworks.