The NCSC's Cyber Assessment Framework provides a systematic approach to assessing the extent to which cyber risks to essential services are being managed. It is the primary tool for NIS Regulations compliance in the UK.
What is the CAF?
The NCSC Cyber Assessment Framework (CAF) provides a systematic and comprehensive approach to assessing the extent to which cyber risks to essential services are being managed. It is the primary tool used by UK competent authorities to assess compliance with the Network and Information Systems (NIS) Regulations 2018.
The CAF is structured around four objectives (A-D) and 14 principles, each with contributing outcomes that describe what good looks like. Operators of Essential Services (OES) in sectors including energy, transport, water, health, and digital infrastructure must demonstrate compliance with the CAF to their relevant competent authority.
The CAF is also used as the basis for GovAssure and is increasingly adopted by organisations outside the OES definition as a comprehensive cyber security framework aligned to UK government expectations.
Compliance requirements
The CAF is structured around four objectives covering governance, protection, detection, and response, with 14 principles providing detailed guidance on what good looks like.
Appropriate structures, policies and processes to understand, assess and manage security risks to the networks and information systems supporting essential functions.
Proportionate security measures to protect those networks and information systems from cyber attack, covering areas such as access control, data security and system security.
Capabilities to ensure security defences remain effective and to detect cyber security events affecting, or with the potential to affect, essential functions.
Capabilities to minimise the adverse impact of a cyber security incident on the operation of essential functions, including recovery and lessons learned.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
We determine whether CAF applies to your organisation as an Operator of Essential Services (OES) or relevant digital service provider.
We assess your current cyber security posture against all CAF objectives and contributing outcomes, producing a prioritised improvement plan.
We develop a detailed improvement plan aligned to CAF requirements, your risk profile, and regulatory expectations.
Your compliance manager guides implementation of required controls across all CAF objectives, with evidence collection throughout.
We complete the CAF self-assessment on your behalf, ensuring all responses are accurate, evidenced, and aligned to regulatory expectations.
We prepare the CAF submission for your relevant competent authority (e.g., Ofcom, FCA, BEIS) and manage any follow-up queries.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone