Say Hi to CAF that treats you like CNI, not a checklist

CAF is the UK's flagship cybersecurity assessment framework developed by the National Cyber Security Centre. It provides an outcome-focused, systematic approach for assessing how effectively organisations manage cyber risks to essential functions. Unlike prescriptive control frameworks, CAF focuses on what you achieve rather than dictating how you achieve it.

Operators of Essential Services (OES): Mandatory under NIS Regulations (energy, transport, water, digital infrastructure, health)
Critical National Infrastructure: Energy, finance, government, emergency services, transport
Local government: 201+ councils using CAF for cyber resilience
Healthcare: NHS organisations via DSPT CAF alignment (47 outcomes including 41 core CAF)
Government departments: Central and local government using CAF as assurance standard

If you operate essential functions or protect CNI, CAF is your assessment framework.

Objective A: Managing Security Risk - Governance, risk management, asset management, supply chain
Objective B: Protecting Against Cyber Attack - Identity, access, data security, system protection, resilience, staff awareness
Objective C: Detecting Cyber Security Events - Security monitoring, threat hunting
Objective D: Minimising the Impact of Cyber Security Incidents - Response and recovery planning, lessons learned

These break down into 14 principles and 41 contributing outcomes assessed on maturity levels.

Each contributing outcome is assessed using Indicators of Good Practice (IGPs) on a three-point scale:

Not Achieved (RED): Significant gaps in security controls or outcomes
Partially Achieved (AMBER): Some measures in place with room for improvement
Achieved (GREEN): Comprehensive controls meeting framework requirements

A single red indicator typically results in "Not Achieved" status. Achieving green requires all relevant IGPs present.

Baseline Profile: Minimum standard for most critical systems. Modeled on untargeted attacks by unskilled adversaries.

Enhanced Profile: Higher standard for CNI and high-value targets. Modeled on attacks by moderately skilled or expert adversaries (nation-state actors, APTs).

Profile assignment depends on risk to life, sensitive data handling, national security functions, and threat landscape.

Released August 2025, CAF 4.0 introduced significant enhancements:

• Enhanced threat understanding (A2.b): Proactive threat intelligence integration into risk decisions
• Secure software development lifecycle (A4.b): Secure-by-design principles and SBOM requirements
• Advanced monitoring and threat hunting (C1 & C2): Behavioral baseline analysis and repeatable threat hunting
• AI and automated decision-making: AI-specific risk assessments integrated across outcomes
• Elevated threat model: Focus on capable, well-resourced adversaries rather than just common threats

CAF: Outcome-focused NCSC framework for essential services and CNI. Assesses what you achieve against capable adversaries.

ISO 27001: International ISMS standard with prescriptive controls. Certifiable, focuses on information security management system.

Many organisations implement both—ISO 27001 for international recognition, CAF for UK essential services compliance. Evidence overlap is significant.

NHS DSPT aligned with CAF in September 2024. CAF-aligned DSPT includes:

• 47 contributing outcomes (41 core CAF + 6 health-specific)
• Same maturity assessment (Not Achieved, Partially Achieved, Achieved)
• Independent audit requirements for Category 1 & 2 NHS organisations

DSPT is essentially CAF applied to healthcare with sector-specific additions.

Preparation: 45 hours (team formation, scheduling)
Scoping: 35-40 hours (essential service identification, system prioritization)
Self-assessment: 40+ hours organisational, 60+ hours per critical system

‍Assurance review: 15-25 hours (independent validation)
Implementation planning: 20+ hours (improvement roadmap)

With automation handling evidence collection and IGP mapping, most organisations reach assessment readiness in 8-12 weeks.

Most sectors require independent assurance reviews from:

• NCSC Cyber Resilience Audit Scheme providers
• Competent Authority oversight
• Third-party validation of self-assessments
• Annual review cycles for CNI and OES

Category 1 & 2 NHS DSPT organisations require independent audits. OES under NIS Regulations face Competent Authority assessment.

We automate outcome management: 41 contributing outcomes tracked with IGP evidence mapping, maturity scoring across objectives, profile management (Baseline/Enhanced switching), threat intelligence integration for CAF 4.0, and assurance-ready documentation exports. You focus on achieving resilience outcomes; we handle evidence coordination and maturity tracking. When NCSC-assured assessors arrive, documentation exports in their expected format.

Yes. CAF and ISO 27001 have significant control overlap. Hicomply's unified evidence management means documentation collected for CAF supports ISO 27001 requirements and vice versa. One evidence collection process, multiple framework outputs. That satisfying moment when one control achieves outcomes in both frameworks.