Skip to content

NCSC Cyber Assessment Framework (CAF) — Customer Guide

Last updated: 2026-05-14 (Plan 129 v1)

What is the CAF, and why does it matter to you?

The NCSC Cyber Assessment Framework is the UK's gateway test for cyber assurance across central government, the wider public sector, critical-national-infrastructure (CNI) operators and any supplier that holds a relevant contract. The GovAssure scheme (mandatory since 2023) walks every in-scope organisation through the four CAF Objectives, the fourteen Principles and the thirty- one Indicators of Good Practice — and the assessor expects to see documented evidence for each row. Findings that show as "Not Achieved" become formal audit gaps the next time GovAssure runs. Secruna assembles the evidence pack so your assessment day is about walking through rows, not chasing screenshots.

What NCSC-specific features does Secruna ship?

End-to-end (Plan 129, v0.11.60) — every item below is wired in the deployed system:

  • Rule book v1 — 31 IGP YAMLs at rule_book/ncsc_caf/v1/ covering all 14 Principles across the 4 CAF Objectives. Loader picks it up via KNOWN_FRAMEWORKS["ncsc_caf"] in packages/rekognise-core/src/rekognise/agent/rule_book/registry.py.
  • Evidence pack export — PDF / CSV / HTML at /exports/ncsc-caf-evidence-pack. Backend renderer in packages/rekognise-core/src/rekognise/cp/export/ncsc_caf_evidence_pack.py; API at GET /export/ncsc-caf-evidence-pack?format={pdf,csv,html} mounted by apps/cp-api/src/cp_api/main.py.
  • Tenant subscription — platform admins enable ncsc_caf per tenant via enabled_frameworks (the same Plan 103 path used for every other framework). The evidence-pack endpoint gates on require_framework_subscription(db, tenant.id, "ncsc_caf").
  • Sidebar entry — /exports/ncsc-caf-evidence-pack is registered in the framework feature manifest (packages/rekognise-core/src/rekognise/cp/framework_features/manifest.py) as the ncsc_caf_evidence_pack feature. The Plan 109 dynamic sidebar surfaces the entry automatically when a tenant has ncsc_caf enabled.
  • Counsel review (Plan 97) — every rule YAML in rule_book/ncsc_caf/v1/ carries pending_counsel_review: true so verdicts route through the same counsel pipeline as DS 05-138 / Secure by Design rules.
  • Cross-framework signal share — CAF Objective B rules reuse the Plan 100 DS 05-138 cyber-posture markers via synthesize_tenant_cyber_posture_artifact (ncsc_caf_in_scope marker added). No new connector signals required for v1.
  • Verdict taxonomy — Not Achieved / Partially Achieved / Achieved / Not Applicable, mirroring the canonical CAF outcome labels. See FRAMEWORK_CATEGORY_TAXONOMY["ncsc_caf"] in packages/rekognise-core/src/rekognise/agent/rule_book/loader.py.
  • Operator surface — /admin/regulations lists NCSC CAF under shipped frameworks; /admin/tenants/{id}/framework-subscriptions accepts ncsc_caf as a subscription target.
  • Audit event — successful exports emit evidence_pack.ncsc_caf.exported for the audit log.

Limitations (v1)

  • SIEM-detection IGPs (Objective C) require tenant self-attestation — no live SIEM ingest in v1.
  • No live GovAssure submission integration — Secruna produces the evidence pack; the supplier presents it via gov.uk channels.
  • No CHECK assessor partner integration.

What CAF is

The NCSC Cyber Assessment Framework (CAF) is the UK National Cyber Security Centre's outcome-focused framework for cyber assurance. Published at https://www.ncsc.gov.uk/collection/cyber-assessment-framework, currently at version 3.2 (2024).

CAF is the gateway cyber framework for:

  • UK government departments — mandated through the GovAssure scheme (https://www.gov.uk/government/publications/govassure-cyber-security-assurance-scheme), operational since 2023 and rolling out across central government and arm's-length bodies.
  • Critical National Infrastructure (CNI) — sector regulators (Ofgem, Ofwat, Ofcom, FCA, NHS England) align their cyber assurance regimes to CAF.
  • UK government suppliers — increasingly required to demonstrate CAF alignment as part of procurement.

CAF is structured as:

  • 4 Objectives (A, B, C, D)
  • 14 Principles (A1–A4, B1–B6, C1–C2, D1–D2)
  • 30+ Indicators of Good Practice (IGPs) — the per-row evidence outcomes an assessor inspects.

What Secruna covers

Secruna ships the NCSC CAF v3.2 (2024) as a live rule book — rule_book/ncsc_caf/v1/. Each IGP becomes a Secruna rule with a CAF citation, a connector signal match, and a customer_description body explaining what the IGP means and what evidence the assessor expects.

The v1 rule book covers:

  • Objective A — Managing security risk — IGPs under A1 Governance, A2 Risk management, A3 Asset management, A4 Supply chain.
  • Objective B — Protecting against cyber attack — IGPs under B1 Service protection, B2 Identity and access, B3 Data security, B4 System security, B5 Resilient networks, B6 Staff awareness.
  • Objective C — Detecting cyber security events — IGPs under C1 Security monitoring, C2 Proactive event discovery.
  • Objective D — Minimising the impact of cyber security incidents — IGPs under D1 Response and recovery planning, D2 Lessons learned.

How verdicts map to IGPs

CAF assessment outcomes are framed as IGP status. Secruna's verdict taxonomy maps directly:

Secruna verdict NCSC CAF outcome What it means
not_achieved Not Achieved The IGP cannot be evidenced — a finding in the GovAssure assessment report.
partially_achieved Partially Achieved The IGP is partially in place — a weakness with a tracked remediation plan due before re-assessment.
achieved Achieved The IGP is fully evidenced — informational, no remediation required.
not_applicable Not Applicable The IGP is scoped out for this tenant. Residual fallback.

Severity ordering (highest first): not_achieved > partially_achieved > achieved > not_applicable.

Using the evidence pack at GovAssure assessment time

The NCSC CAF Evidence Pack is generated from the dashboard under Exports → NCSC CAF Evidence Pack (org_admin role required). The file is a tenant-level PDF / CSV bundle:

  • Cover — tenant name, framework metadata, generation timestamp, document ID.
  • §1. Assessment summary — counts of IGPs at each verdict.
  • §2. Per-IGP evidence by Objective — one section per Objective, grouped by Principle, one row per IGP with the verdict and a short evidence summary.
  • §3. Gaps surfaced for GovAssure assessment — Not-Achieved + Partially-Achieved IGPs surfaced separately so the assessor sees the remediation list at a glance.
  • §4. Audit trail — last 90 days of platform activity material to the evidence pack.

Filename: secruna-ncsc-caf-evidence-{tenant_slug}-{date}.pdf (or .csv).

Submitting to GovAssure

The GovAssure scheme uses an assessment workbook plus supplier-provided evidence. Hand the evidence pack to your assessor alongside the workbook. The file is structured Objective → Principle → IGP so the assessor walks the framework in their natural order.

Re-running after remediation

Verdicts re-evaluate on every discovery run. To refresh the evidence pack after closing a gap:

  1. Trigger a discovery run (Connections → Run discovery now) or wait for the scheduled run.
  2. Confirm the verdict has flipped to achieved under the IGP detail page.
  3. Generate a fresh evidence pack — the new gap count appears on the cover.

What Secruna does NOT cover

  • Live GovAssure submission integration. CAF evidence flows from the supplier to the assessor through gov.uk channels; Secruna ships the evidence pack, not the assessment portal.
  • SIEM data ingest. Objective C IGPs that require SIEM-grade visibility are evidenced via tenant self-attestation in v1. A future plan can wire SIEM connectors if customer demand justifies.
  • CHECK assessor partner integration. Secruna produces evidence; the supplier presents it to the assessor.

Frequently asked

Q. Do we have to pick between CAF and Defence Standard 05-138? No. CAF and DS 05-138 are complementary — DS 05-138 is a defence-vertical subset of CAF Objective B. A tenant subscribed to both gets two evidence packs from one cyber-posture artifact; the underlying signals are reused.

Q. What about Secure by Design? Secure by Design (Plan 101) is the UK Government delivery-team checklist with Confidence Profile output. It overlaps with CAF Objective A (governance) and parts of Objective B (service protection). Subscribe to both for the full UK Public Sector Pack.

Q. Does Secruna re-assess on a schedule? Yes — the discovery worker re-emits the tenant cyber-posture artifact on every scheduled run (and on-demand). Verdicts re-evaluate automatically; the evidence pack is freshly generated whenever you click Generate.