NCSC CAF v4.0 Readiness
177 questions across all 14 CAF v4.0 principles, scored on the framework's own three-verdict scale.
177 controls · 14 pillars · 41 categories · evidence can be collected automatically
177 questions across all 14 CAF v4.0 principles, scored on the framework's own three-verdict scale.
177 controls · 14 pillars · 41 categories · evidence can be collected automatically
If your organisation runs an essential service, a regulator will eventually ask where you sit against the CAF, and the answer has to come outcome by outcome rather than as one number. The framework asks whether a security outcome is achieved, which is a harder question than whether a control exists: one statement that is not true makes the outcome something less than achieved. This review gives you that position before a regulator or a GovAssure cycle asks for it.
177 questions covering all 14 principles from A1 to D2, grouped into 41 outcomes: governance (13), risk management (13), asset management (6), supply chain (10) and on through security monitoring, which is the largest single principle at 24 questions. Each outcome is scored on the framework's own scale - Achieved, Partially Achieved or Not Achieved - so the result is directly comparable with what a lead assessor would record. Read-only collector scripts answer the technical outcomes, which leaves the 46 questions tagged governance across all four objectives as interview work with the people who actually own them.
Most of the technical detail sits in objective B and C: B2 asks how identities are verified and how privileged users are managed, B3 covers understanding your data and then protecting it in transit, at rest, on mobile devices and on media being disposed of, B4 covers secure design, secure configuration, secure management and vulnerability handling, and C1 asks whether logs exist, are protected, raise alerts, and get triaged by somebody with the skills to do it. Evidence comes from read-only collector scripts run in your own tenancy against cloud control planes and repository settings, alongside the artefacts that actually prove an outcome - log retention settings, tested backup restores, joiner-mover-leaver records. The questions are written to catch the usual CAF failure, which is a documented process with no evidence that it ever produced a decision.
177 controls across 14 pillars and 41 categories. Every one is scored, and a control nobody can answer is recorded as unanswered rather than counted as a pass.
Read-only collector scripts run by your team in your own tenancy answer the technical outcomes, and the assessor works the governance, training and response outcomes from records: tested restores, alert triage logs, post-incident reviews.
It cannot tell you how your own regulator will weigh a Partially Achieved outcome, because that judgement is theirs and differs by sector.
The CAF is the yardstick applied to operators of essential services, so a critical infrastructure operator is measured against it whether or not it chose to be.
GovAssure runs departmental assurance against the CAF, and this review produces the same outcome-by-outcome position before the formal cycle begins.
Health and education bodies carrying essential services are judged on outcomes, and the review separates the outcomes genuinely achieved from those with a policy and no evidence.
A fixed fee for the engagement, not an annual licence. The band follows the size of the bank: this one is standard at 177 controls.
£3,500
Per engagement, excluding VAT.
£9,000
Per engagement, excluding VAT.
Hold three or more and the Combined Security View is produced at no extra charge: it is derived from the banks you already hold rather than assessed again. See the full assessment rate card, or build a quote with this assessment in it.
There are 16 of them, and the honest answer is that most organisations need two or three rather than all of them. Tell us what you run and what you are being asked to prove.