Cyber Assessment Framework (CAF) v4.0: A Strategic Leap for UK Cyber Resilience

22 August

On 6 August 2025, the UK’s National Cyber Security Centre (NCSC) unveiled Version 4.0 of its flagship Cyber Assessment Framework (CAF)—an evolution grounded in the urgent need to confront a rapidly intensifying cyber threat landscape. While detailed content is available on the NCSC site, further insight from industry analysis brings clarity to what this update truly represents:

Why CAF v4.0 Matters

CAF remains a cornerstone in cyber resilience, widely adopted across critical national infrastructure (CNI)—including energy, healthcare, transport, digital infrastructure, and government services—as well as a compliance benchmark tied to the UK’s NIS Regulations and GovAssure schemes. In releasing Version 4.0, the NCSC aimed to close the growing gap between rapidly evolving cyber threats and the defensive capabilities of essential organisations.

Four Game‑Changing Enhancements

CAF v4.0 is anchored around four major enhancements that together signal a shift toward more adaptive, threat‑aware, and future‑focused resilience strategies:

  1. Deeper Understanding of Attackers
    A new section compels organisations to go beyond generic risk models—from merely reacting to threats to proactively understanding attacker motivations, tactics, and behaviors. This intelligence‑informed lens enables more informed cybersecurity decision‑making.

  2. Secure Software Development and Support
    Recognising software vulnerabilities as persistent entry points, Version 4.0 introduces a dedicated outcome emphasizing secure development practices. This includes secure coding, code provenance (such as software bills of materials), static and dynamic code analysis, secure distribution, and ensuring supplier adherence to recognized frameworks like NIST SSDF or Microsoft’s SDL.

  3. Enhanced Threat Detection & Hunting
    Traditional reactive monitoring is no longer enough. CAF v4.0 pushes for proactive, structured threat hunting supported by threat intelligence and behaviour‑based detection. New contributing outcomes (e.g., C1.f Understanding User’s and System’s Behaviour & Threat Intelligence, and C2.b Threat Hunting) elevate detection maturity across SOC and security functions.

  4. Elevated AI‑Related Risk Awareness
    As organisations increasingly leverage AI and automated decision-making systems, CAF v4.0 integrates relevant governance expectations across risk management and secure-by-design principles. While there isn’t a standalone AI control, the framework now expects visibility, testing, and resilience in AI deployments.

Structural Evolution & Practical Guidance

Beyond its thematic enhancements, CAF v4.0 also brings pragmatic improvements:

  • The core structure of four objectives—Managing Security Risk, Protecting Against Cyber Attack, Detecting Cybersecurity Events, and Minimising Incident Impact—remains intact, but with more streamlined language, clearer outcome articulation, and refined maturity thresholds (Basic, Good, Advanced).

  • Indicators of Good Practice (IGPs) underpin each contributing outcome, offering concrete criteria to assess whether an outcome is achieved, partially achieved, or not achieved.

  • CAF v4.0 maintains its sector-agnostic flexibility while enabling CAF profiles—customized target sets of outcomes—defined by regulators or oversight bodies to align with sector‑specific risk expectations.

  • The NCSC continues to support CAF alongside complementary tools like Cyber Essentials, Cyber Resilience Audit, and simulation services.

Take‑Action: What Organisations Should Do Now

  1. Review CAF v4.0 and Supporting Guidance
    Begin by familiarizing yourself with the updated outcomes, IGPs, and structure to understand how they affect your cyber maturity posture.

  2. Perform a Gap Analysis
    Compare your current CAF 3.x alignment—particularly in areas like threat modeling, software security, threat hunting, and AI oversight—against the new expectations.

  3. Engage Regulators Early
    With no fixed transition timeline, it’s essential to coordinate with your relevant Competent Authority to understand sector-specific benchmarks and CAF profile expectations.

  4. Elevate Governance Involvement
    CAF v4.0 increasingly demands leadership accountability. Ensure boards and executive teams are involved in strategy, risk prioritization, and responses aligned to CAF outcomes.

  5. Incorporate into Cyber Programme Planning
    Update your cyber strategy, improvement roadmap, and risk register to reflect CAF v4.0 expectations. This includes building or enhancing secure software practices, threat hunting capacity, and AI risk governance.

  6. Leverage External Expertise as Needed
    For many organisations, support from NCSC-assured consultancies can accelerate readiness, validate posture against CAF v4.0, and help align internal controls to outcome-driven objectives .

Final Thoughts

CAF v4.0 represents not just an update, but a strategic reframe—anchoring cyber resilience in intelligence, agility, and forward-looking governance. It moves the needle from compliance to capability, embedding resilience through understanding, proactively detecting threats, securing software lifecycles, and managing emergent risks like AI.

In the face of growing and evolving threats, CAF v4.0 offers organisations a contemporary, ambitious playbook—to not just survive cyber challenges, but to thrive amidst them.

LET’S TALK ABOUT YOUR DATA SECURITY