Cyber Assessment Framework Assessments
The Cyber Assessment Framework is the NCSC’s structured approach to evaluating cyber security for operators of essential services and organisations providing functions critical to public activities. For higher education institutions, local authorities, and public sector bodies in scope of the Network and Information Systems Regulations and the incoming Cyber Security & Resilience legislation, CAF is the framework regulators will use to assess how cyber security risk is being managed across the supply chain.
The new legislation is expected to bring a significantly wider range of organisations within the NIS framework. Higher education institutions and local authorities not currently subject to NIS are likely to come within scope in some capacity particularly where they offer Managed Services over a threshold. CAF is the framework they will be assessed against.
A CAF assessment from Clark & Company gives your organisation an independent, structured evaluation of its current position across the four CAF objectives and their fourteen contributing outcomes. It tells you where you stand before your regulator asks.
What the CAF Covers
Objective A: Managing Security Risk. How your organisation identifies, assesses, and manages cyber security risk as part of overall governance. Covers risk management processes, senior leadership engagement, and whether security decisions are proportionate and subject to appropriate assurance.
Objective B: Protecting Against Cyber Attack. The technical and organisational controls protecting your networks, systems, and information. Covers access management, data security, system security, resilient networks, and staff awareness.
Objective C: Detecting Cyber Security Events. Your capability to detect, using appropriate tools and methods, when cyber security events occur across your networks and information systems.
Objective D: Minimising the Impact of Cyber Security Incidents. Your arrangements for responding to and recovering from incidents, including planning, lessons learned, and regulatory reporting obligations.
What is Included
Structured assessment. A formal assessment across all four objectives and fourteen contributing outcomes, drawing on document review, structured interviews with key stakeholders, and analysis of your current control framework.
Evidence review. Assessment based on evidence, not self-declaration. We review policies, procedures, governance records, training logs, incident records, and technical documentation that evidences your position.
Independent evaluation. Each contributing outcome evaluated against the CAF Indicators of Good Practice, with a clear position — Achieved, Partially Achieved, or Not Achieved — recorded with supporting rationale.
Improvement roadmap. Where outcomes are Partially Achieved or Not Achieved, a prioritised set of improvement actions aligned with your governance cycle and the timeline of the Cyber Security and Resilience Bill.
Written assessment report. A structured report recording your position against all objectives and outcomes, the evidence reviewed, the assessment conclusions, and the improvement roadmap. This is the document you present to your governing body, regulator, or audit committee.
Governing body support. Where the assessment is being presented to a governing body or senior committee, we can prepare the executive summary and attend the meeting where required.
Frequently Asked Questions
Are we required to carry out a CAF assessment?
If you are currently within scope of the NIS Regulations, CAF assessment is part of the regulatory framework. If you are not currently in scope, the Cyber Security and Resilience Bill is expected expand the scope of the legislation. A CAF assessment now gives you a baseline and an improvement record ahead of that change.
How long does an assessment take?
Most assessments are completed within four to six weeks, depending on the size of the organisation and stakeholder availability. We confirm the timeline at scoping.
What is the difference between a CAF assessment and a penetration test?
A penetration test attempts to exploit specific vulnerabilities in systems and networks. A CAF assessment evaluates your overall cyber security posture across risk management, protection, detection, and response. They address different questions and are not substitutes for each other.
Will the assessment be shared with the regulator?
The report is yours. Clark & Company does not share findings with any third party. How you use the report in a regulatory context is your decision.
What if our current position is poor?
That is the point of the assessment. A candid evaluation of a weak position is more useful than a favourable one that will not withstand scrutiny. The improvement roadmap is designed to be acted on.