Have you heard of the Cyber Assessment Framework?
The Cyber Assessment Framework (CAF) helps organisations strengthen their defences across the UK’s critical national infrastructure (CNI). Version 4.0 supports updates to the NIS Regulations through the Cyber Security and Resilience Bill and complements initiatives such as Cyber Essentials and adversary simulation services. CAF v4.0 represents a shift from static compliance to a dynamic, threat-informed approach that helps enterprises, government, and institutions protect essential services and maintain national resilience.
“At the NCSC, we have released v4.0 of the Cyber Assessment Framework primarily designed for CNI organisations operating essential services across energy, healthcare, transport, digital infrastructure and government sectors.”
-Ollie Whitehouse, CTO
NCSC
What has changed in the Cyber Assessment Framework (CAF) v4.0?
CAF v4.0 introduces updates that reflect today’s evolving threat landscape and the growing role of AI.
Attacker perspective: Encourages organisations to understand attacker motivations, capabilities, and techniques to build tailored defences.
Secure software by design: Requires security to be embedded throughout the development lifecycle, not added at the end.
Enhanced monitoring: Moves from basic log analysis to proactive threat hunting and early anomaly detection.
AI-related risks: Introduces new guidance for managing the security of AI systems and mitigating model exploitation.
How does Trend Micro help you meet Cyber Assessment Framework (CAF) requirements?
Understanding and anticipating attacker behaviour
Trend Micro enables organisations to turn threat intelligence into proactive defence, staying ahead of attackers who increasingly leverage AI.
With Trend Vision One™, organisations gain actionable visibility into attacker tactics, powered by intelligence from over 250 million global sensors and the industry’s largest bug bounty programme. The platform integrates intelligence across the security stack to prioritise relevant threats. To meet UK sovereignty and resilience requirements, Vision One operates with a dedicated UK-based data instance.
Trend’s agentic AI-powered digital twin technology allows organisations to simulate attacks safely, test defences, and validate controls without affecting live systems. This supports CAF’s move from reactive to predictive, threat-informed resilience.
Embedding security by design
Trend embeds security across every stage of the software lifecycle, protecting the digital foundations that keep UK services operational.
With Trend Vision One™ Cloud-Native Application Protection Platform (CNAPP), security shifts left into CI/CD pipelines. Code, dependencies, and IaC templates are scanned early, catching vulnerabilities before runtime while automated build gates and policy-as-code enforce secure practices.
From build to production, Trend provides continuous discovery and real-time risk assessment across workloads, APIs, and cloud assets. Cloud Risk Management unites posture tools, entitlement management, and attack path analysis to prioritise the most critical risks.
Software supply chain security is ensured through image scanning, registry integration, and runtime enforcement. Intelligent segmentation and unified policy management uphold least privilege across environments for both development and security teams.
Post-deployment, automated vulnerability management, compliance monitoring, and integrated XDR for Cloud provide continuous assurance and rapid response - supporting ongoing compliance with CAF’s expectations.
Enhanced security monitoring and threat hunting
Trend Vision One™ XDR correlates data across endpoints, email, cloud workloads, and networks, delivering a unified view of the full attack chain. Instead of chasing isolated alerts, security teams gain clear, attack-centric narratives for faster investigation and response.
Trend’s Agentic SIEM uses next-generation AI to analyse telemetry from over 900 sources, detect anomalies, reduce noise, and automate remediation - ensuring teams can focus on high-priority incidents.
Trend Micro is recognised by the NCSC as a Certified Cyber Incident Response (CIR) provider. Its CREST-assessed experts operate 24/7 to contain, investigate, and recover from critical incidents. With all security data processed within UK borders, Trend safeguards CNI, government, healthcare, and academic institutions with sovereign strength.
Addressing AI-related cyber risks
Trend’s Agentic SIEM and Digital Twin technologies use AI to improve detection accuracy, automate response, and maintain proactive visibility as threats evolve.
Trend Micro’s platform helps secure AI implementations against prompt injection, data leakage, and model abuse.
Ongoing threat research tracks adversarial use of AI, providing intelligence to defend against emerging risks and supporting responsible AI adoption in line with CAF guidance.
What You Need to Know
What is the Cyber Assessment Framework (CAF)?
Developed by the National Cyber Security Centre (NCSC), the Cyber Assessment Framework (CAF) helps organisations assess and improve cyber resilience. Introduced in 2018 and now in its fourth iteration (v4.0, 2025), it supports compliance with the NIS Regulations and promotes a results-driven, outcomes-based approach that moves beyond checklist compliance. CAF applies to Operators of Essential Services (OES), Digital Service Providers (DSPs), and organisations supporting the UK’s Critical National Infrastructure (CNI).
How is Cyber Assessment Framework (CAF) structured?
The CAF is built around four objectives and 14 principles, each describing desired outcomes rather than prescriptive actions. This outcome-based approach helps organisations anticipate evolving threats and focus on proactive detection and minimising impact.
The four objectives are:
Managing Security Risk
Protecting Against Cyber Attacks
Detecting Cyber Security Events
Minimising the Impact of Cyber Security Incidents
Who is the Cyber Assessment Framework (CAF) designed for?
CAF supports organisations across sectors such as healthcare, energy, transport, digital infrastructure, and government in meeting UK-specific regulatory requirements. It reinforces data sovereignty and national resilience while providing a standardised framework for internal assessment and external oversight.
The CAF defines Profiles that represent target levels of cyber resilience depending on attacker sophistication:
Basic Profile – covers common cyber threats affecting all sectors.
Enhanced Profile – tailored for organisations facing advanced, well-resourced or state-backed attackers.
CAF adoption has expanded across UK bodies with cyber-regulatory authority and now underpins GovAssure, the national assurance scheme for assessing government and CNI resilience.
How does the Cyber Assessment Framework (CAF) address sector-specific concerns?
While CAF provides a single national model, it remains flexible to meet sector-specific needs through collaboration between the NCSC and regulatory bodies.
The framework can be adapted through:
Sector-specific profiles – defined by oversight bodies to reflect regulatory expectations and threat levels.
Sector-specific interpretations – clarify how outcomes apply to each environment.
Supplementary guidance – issued when existing indicators don’t fully address sector-specific risks.
How is the Cyber Assessment Framework (CAF) implemented in government and healthcare?
Central government (GovAssure)
GovAssure, launched in April 2023, uses CAF as the foundation for assessing critical government systems and supports the objectives of the Government Cyber Security Strategy. It currently applies to official government systems and government-sector CNI. The Government Cyber Security Policy Handbook guides departments in meeting CAF requirements and achieving consistent assurance.
Local government
In England, the Department for Levelling Up, Housing and Communities (DLUHC) has worked with councils to adapt CAF for assessing local cyber resilience, identifying vulnerabilities, and protecting critical services. CAF complements existing cybersecurity programmes by promoting whole-organisation engagement, leadership involvement, and risk management across departments.
In Wales, the Welsh Local Government Association (WLGA) and the Welsh Government are supporting CAF rollout through initiatives such as breach workshops, tabletop exercises, staff training videos, and CymruSOC, a centralised SOC providing ongoing cyber monitoring for councils.
NHS and Healthcare
In September 2024, the Data Security and Protection Toolkit (DSPT) was aligned with CAF under the Department of Health and Social Care’s Cyber Security Strategy to 2030. This moves the NHS from static compliance toward risk-informed, continuous improvement. The CAF-aligned DSPT equips NHS organisations to respond effectively to incidents across critical systems and promotes a culture of continuous improvement.
It includes 47 outcomes assessed over multiple years - a core set mandated by NHS England, with others chosen by each organisation to strengthen specific assurance areas.
How is the Cyber Assessment Framework (CAF) used more widely?
Originally developed in 2018 to support the NIS Regulations, the CAF was created to assess the resilience of Operators of Essential Services (OES) and Relevant Digital Service Providers (RDSPs). Backed by the NCSC, its credibility has driven widespread adoption across the public and private sectors. CAF is now considered the benchmark for UK cyber assurance, with sector-specific profiles tailored to industry needs.
What does the future hold for the Cyber Assessment Framework (CAF)?
As AI becomes integral to both cyber threats and defences, future versions of the CAF will likely strengthen guidance around responsible AI adoption and system security. The upcoming Cyber Security and Resilience Bill - expected before Parliament by the end of 2025 - will inform the next iteration of the framework, reinforcing CAF’s role as the foundation for national cyber assurance.
Talk to Us
Speak with our team today for guidance on implementing or aligning with CAF v4.0:
Matt Kille
Client Relationship Manager
Ian Cook
Client Relationship Manager
Finbar Dignan
Client Relationship Manager