What is CAF

The Cyber Assessment Framework (CAF) was developed by the UK’s National Cyber Security Centre (NCSC) to help organisations understand whether their cyber security arrangements are appropriate, effective, and resilient against modern threats. At its core, CAF is not a compliance checklist. It is a risk-based framework designed to answer a simple but critical question:

” If we were attacked tomorrow, would our organisation cope? “

CAF focuses on four core objectives:

1. Managing security risk
2. Protecting against cyber attack
3. Detecting cyber security events
4. Minimising the impact of incidents

Rather than asking “do you have a policy?”, CAF asks:

• Are controls implemented properly?
• Are they maintained and tested?
• Would they actually work under pressure?

Cyber risk is no longer theoretical. Over the past few years, the UK has seen:

• Ransomware attacks disrupting retail, manufacturing, healthcare, and critical suppliers
• Credential-based attacks bypassing perimeter controls
• Incidents escalating due to poor detection and delayed response

Many of these incidents shared a common theme:

Controls existed but they weren’t validated, tested, or joined up.

CAF exists because traditional “tick-box compliance” has failed to keep pace with:

• Sophisticated threat actors
• Supply chain risk
• Cloud and hybrid complexity
• Reduced internal teams and stretched resources

CAF forces organisations to step back and look at how security actually operates day-to-day not how it looks on paper.

CAF isn’t just for critical national infrastructure

While CAF is mandatory for parts of the public sector and regulated industries, it is increasingly relevant for all organisations, particularly those that:

• Supply into government or regulated environments
• Handle sensitive data
• Rely on third parties or complex supply chains
• Are accountable to boards, regulators, or insurers

What “good” looks like under CAF

CAF-aligned organisations tend to:

• Understand their crown jewels and prioritise protection accordingly
• Regularly test detection and incident response capabilities
• Know where responsibilities sit  especially out of hours
• Treat cyber resilience as an ongoing process, not a one-off project

Importantly, CAF helps organisations identify where to invest next, rather than spreading effort thinly across everything.

How Maple helps

Whether you’re preparing for an audit, responding to board pressure, or simply want confidence in your security posture, CAF provides the structure and Maple helps you make it real.