CAF 4.0

The NCSC Cyber Assessment Framework (CAF) 4.0 is an outcome-based model developed by the UK's National Cyber Security Centre (NCSC) to help organizations, particularly those providing essential services and critical national infrastructure, assess and improve their cyber resilience. It offers a systematic approach to evaluating how effectively cyber risks to essential functions are managed based on predefined Indicators of Good Practice (IGPs). The CAF is designed to help organizations define and achieve security objectives appropriate to their risks and operational context. CAF 4.0 includes updates such as a section focused on understanding attacker methods, ensuring secure software development, enhancing threat detection, and strengthening coverage of AI-related cyber risks.