GovAssure is the UK government's cyber security assurance scheme for central government departments and arm's length bodies. It provides a consistent, risk-based approach to assessing and improving cyber security across the public sector.
What is GovAssure?
GovAssure is the UK government's cyber security assurance scheme, developed by the Cabinet Office and the National Cyber Security Centre (NCSC). It provides a consistent, risk-based framework for central government departments and arm's length bodies to assess and improve their cyber security posture.
The scheme uses a tiered approach (Tiers 1-4) based on cyber risk profile, with requirements increasing in rigour as the tier increases. All in-scope organisations must complete an annual self-assessment, which is reviewed by the NCSC.
GovAssure is also increasingly relevant for suppliers to central government, as departments may require their key suppliers to demonstrate GovAssure-aligned security practices as part of supply chain risk management.
Compliance requirements
GovAssure uses a tiered approach based on cyber risk profile, with requirements increasing in rigour as the tier increases.
GovAssure uses the NCSC Cyber Assessment Framework, so the assessment is against the CAF objectives and principles rather than a separate GovAssure control set.
The target level is a CAF Profile. Basic applies across sectors against common attacks; Enhanced is sector-specific and assumes a better-resourced attacker.
Departments identify the systems supporting their most important functions, and it is those systems that are assessed rather than the whole estate.
Assessment is carried out through self-assessment and independent review. The NCSC is the technical authority for the framework, not the assessor or the regulator.
Senior ownership of cyber risk, with clear accountability for the security of the systems in scope and reporting into departmental leadership.
Findings feed a targeted improvement plan, reassessed over time rather than treated as a one-off exercise.
Audit process
Netru manages the complete GovAssure compliance journey, from determining your tier through to annual self-assessment completion and NCSC review support.
We identify the systems supporting your most important functions and agree whether the Basic or Enhanced CAF Profile applies.
We assess your current posture against the CAF objectives at the agreed profile, producing a prioritised remediation roadmap.
We develop a detailed remediation plan aligned to the profile, your budget and your timeline.
Your compliance manager guides implementation of required controls, with evidence collection throughout.
We complete the GovAssure self-assessment on your behalf, ensuring all responses are accurate, evidenced, and aligned to your tier.
We prepare the evidence package for independent review and handle queries and follow-up actions through to sign-off.
How Netru delivers it
Our UK-based team has deep experience in GovAssure and the NCSC Cyber Assessment Framework. We determine your tier, implement controls, complete your annual self-assessment, and manage the NCSC review process, helping you meet your government cyber security obligations.
Talk to our teamBefore you talk to anyone