The National Cyber Security Centre's Cyber Assessment Framework is a method for judging how well an organisation protects the systems behind essential services. The current version, CAF 4.0, was released on 4 August 2025, and it sets out 41 contributing outcomes under four objectives and 14 principles.
Central government applies the CAF through GovAssure, and councils in England have an adapted version with its own profile. The GovAssure self-assessment page names "third-party suppliers" among the people who contribute, which puts the company hosting your website inside the evidence trail.
What is the cyber assessment framework?
The cyber assessment framework is a set of four objectives and 14 principles that the NCSC says are "written in terms of outcomes", a "specification of what needs to be achieved". Each principle breaks down into contributing outcomes, and each contributing outcome carries a set of indicators of good practice, which the NCSC shortens to IGPs.
The NCSC describes the CAF as "primarily designed for organisations operating essential services", and as support for "legal and regulatory requirements like the NIS Regulations". The objectives and principles in CAF 4.0 are these.
| Objective | Principles |
|---|---|
| A. Managing security risk | A1 Governance, A2 Risk management, A3 Asset management, A4 Supply chain |
| B. Protecting against cyber attack | B1 Service protection policies, processes and procedures; B2 Identity and access control; B3 Data security; B4 System security; B5 Resilient networks and systems; B6 Staff awareness and training |
| C. Detecting cyber security events | C1 Security monitoring, C2 Threat hunting |
| D. Minimising the impact of cyber security incidents | D1 Response and recovery planning, D2 Lessons learned |
The NCSC's announcement of version 4.0 adds material on attacker methods, secure software, monitoring and threat hunting, and AI risk, and says the NCSC would "encourage all system owners to adopt CAF 4.0". The secure software material sits in contributing outcome A4.b, inside the supply chain principle.
How a CAF assessment reaches a result
Every contributing outcome is judged achieved or not achieved, and some also allow partially achieved. The CAF 4.0 document says that for achieved "all the indicators would normally be present", while for not achieved "the presence of any one indicator would normally be sufficient".
The NCSC does not set the pass mark, saying "it is not the responsibility of the NCSC to mandate what represents appropriate and proportionate cyber security". The target comes from a CAF profile, "a mixture of some contributing outcomes to be met at 'achieved', some at 'partially achieved'". Meeting all 41 at achieved would sit "some way beyond the bare minimum 'basic cyber hygiene' level".
Who has to use the CAF in central government?
Government organisations use the CAF through GovAssure, "the cyber security scheme for assessing government critical systems against NCSC's Cyber Assessment Framework". It is mandatory for OFFICIAL systems considered government-sector critical national infrastructure, and the guidance says it "is not suitable for systems processing information at SECRET and above".
The Cabinet Office announced GovAssure on 20 April 2023, with all central government departments to be reviewed annually. The Government Cyber Unit in DCMS now oversees it.
The guidance sets five stages in a fixed order, ending in a Targeted Improvement Plan. At stage 2 each in-scope system is assigned a Government CAF profile, "Basic or Enhanced". Lead government departments and arm's-length bodies with critical national infrastructure must use an independent reviewer registered on the NCSC's Cyber Resilience Audit scheme, while other organisations can use peer review.
The CAF for local government in England
MHCLG has adapted the NCSC framework "into a tool for councils in England to address the risks they face". A council identifies its critical systems, completes two self-assessments, takes part in an independent assurance review and creates a plan to address vulnerable areas. The two self-assessments split the objectives, with A and D covering the organisation and B and C covering critical systems.
A local government CAF profile "provides councils with a baseline to work towards" and is classed Official-Sensitive. The guidance on other standards says councils "will still need to comply with existing standards and requirements, such as PSN".
On 13 October 2026 the Local Digital team said the digital service, LG WebCAF, was moving into private beta, and that "councils should continue with their current CAF assessments using the guidance and workbooks available".
Where your website and hosting supplier comes in
Supply chain is principle A4 of the framework, covering the security risks "that arise as a result of dependencies on suppliers". Its first contributing outcome, A4.a, reads "You understand and effectively manage the risks associated with suppliers".
The not achieved indicators for A4.a describe a buyer who does not know "what data belonging to you is held by suppliers, or how it is managed", a service "subcontracted" with "little or no visibility of the sub-contractors", and contracts that "do not specify appropriate security obligations". Any one of those would normally be enough for not achieved. At achieved, "Customer / supplier ownership of responsibilities is defined in contracts", and the buyer's incident process and the supplier's "provide mutual support in the resolution of incidents".
A4.b, the secure software outcome, reads "You actively maximise the use of secure and supported software, whether developed internally or sourced externally". One not achieved indicator is that "your software supplier(s) is unaware of the composition and provenance of software provided to you". For a Drupal site, we read that as the supplier knowing which core and module versions run your site and where custom code came from.
Beyond A4, our reading of the framework, not an NCSC mapping, is that a hosted website puts the evidence for several other outcomes on the supplier's systems. The questions to put to a host are set out in our guide to Drupal hosting for the public sector.
| Outcome | Evidence held by the host |
|---|---|
| B2.c Privileged user management | Server, database and CMS administrator accounts held by supplier staff |
| B3.b Data in transit | TLS settings, and transfers between systems, since B3.b "includes the transfer of data to third parties" |
| B4.b, B4.c and B4.d | Server hardening, administrator access routes and patch timelines |
| B5.b and B5.c | Segregation, backup location and restore tests |
| C1.a and C1.b | Web server and CMS logs, and how long they are kept |
| D1 Response and recovery | The supplier's incident process and joint exercises |
On the same reading, principles A1 to A3 and D2 Lessons learned stay with the buyer whatever the supplier does.
How does the CAF relate to Cyber Essentials and ISO 27001?
The CAF is built to sit alongside Cyber Essentials and ISO 27001, since one of its design requirements is to "be compatible with the use of appropriate existing cyber security guidance and standards".
Version 3.2 improved CAF alignment with Cyber Essentials and "mirrored some of the CE requirements". The CAF's full set of 41 outcomes reaches beyond basic hygiene, and our guide to Cyber Essentials requirements covers what that scheme asks for. GovAssure's stage 3 page lists ISO/IEC 27001: 2013 among the frameworks with which "the CAF is consistent". A supplier's ISO 27001 certificate helps with A4.a where its scope covers the service you buy, which our guide to checking a supplier's ISO 27001 certificate explains.
Where does an IT Health Check fit?
An IT Health Check is a Public Services Network test, separate from the CAF, which aims "to provide assurance that your organisation's external systems are protected" and are not "an unauthorised entry point into systems that consume PSN services". Its external scope includes "email servers, web servers".
Central government customers use CHECK, run by the NCSC. For other customers, which includes councils, the guidance names "Tiger Scheme, CREST-approved ITHC services or the Cyber Scheme". In our reading, an ITHC report is evidence a council or body can place against B4.d vulnerability management and A2.c assurance in a CAF self-assessment.
What to ask a website or hosting supplier
GovAssure asks for evidence "not created solely to support your self-assessment", so ask early.
| Question | A strong answer | A weak answer |
|---|---|---|
| Which contributing outcomes are yours, which ours, which shared? | A written responsibility matrix by code, such as A4.a, B4.d, B5.c and C1.b | "We are ISO 27001 certified, so we cover the CAF" |
| Who are your sub-contractors for our service, and where is our data held? | Named data centre, cloud, CDN and monitoring providers, with locations | "Our partners" |
| How fast do you patch the CMS and server stack? | A timeline by severity and the date core and modules were last updated | "We patch regularly" |
| What logs do you keep for our site, and for how long? | Named log sources, a retention period and an access route during an incident | No retention figure |
| When did you last test a backup restore? | Frequency, a separate location and a dated restore test | "Backups are daily" |
| When was the platform last given an IT Health Check, and by which scheme? | A dated test, the scheme named and remediation tracked | "We are tested annually", with nothing to show |
Axistwelve runs its own secure hosting in UK data centres. We have held ISO 27001 through BSI since 2013, recertified to ISO 27001:2022 in 2023, and hold Cyber Essentials Plus. Both are listed on our certifications page.
Before you start your next cyber assessment framework self-assessment
Confirm the profile you are assessing against: Basic or Enhanced for each central government system, or the local government profile for a council.
List every supplier behind your public website, including the providers beneath your host, and record what data each holds. That list is the starting point for A4.a.
Send the questions above to your host before the self-assessment starts, and check the contract defines security obligations and incident roles.
Frequently asked questions
Are the NCSC cloud security principles the same as the CAF principles?
No. The NCSC cloud security principles are a separate set of 14, at version 2.1, "designed to help you choose a cloud provider that meets your security needs". The CAF's 14 principles assess the organisation running the service.
How much does a GovAssure self-assessment ask for each outcome?
GovAssure asks for "a summary of up to 1,500 words for every contributing outcome", supported by evidence. Its examples include recent cyber security assessment or assurance activity and architecture diagrams. Agree with your supplier which of those summaries need its input before stage 3 begins.
Which version of the cyber assessment framework does the local government programme use?
The local government CAF pages we read for this article do not state which version of the cyber assessment framework the profile is built on. Some principle names on those pages, such as "Service protection policies and processes" for B1, differ from the CAF 4.0 names.
