UK NCSC CAF

UK NCSC Cyber Assessment Framework - 4 objectives, 14 principles for essential services security.


Short name	NCSC CAF
Region	Europe
Country or scope	United Kingdom
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers NCSC CAF

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for NCSC CAF.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for NCSC CAF and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`UK-CAF-A3` Asset Management	Organisations must maintain a current understanding of all systems and software assets required for the operation of essential functions, so every deployed component must appear in the inventory (CAF Objective A, Principle A3 Asset Management)	Scan
`UK-CAF-A3-ID` Asset Identifiability	Knowledge of assets must be detailed enough to support security decision-making, which requires components to carry unambiguous machine-resolvable identifiers (CAF Principle A3 Asset Management)	Scan
`UK-CAF-A4` Supply Chain Understanding	Organisations must understand and manage the security risks arising from dependencies on external suppliers, which requires knowing who supplies each software component (CAF Objective A, Principle A4 Supply Chain)	Scan
`UK-CAF-B4` System Security and Build Integrity	Network and information systems must be securely built and maintained to resist exploitation, including assurance that deployed software has not been tampered with, evidenced by integrity hashes (CAF Objective B, Principle B4 System Security)	Scan
`UK-CAF-C1` Security Monitoring Readiness	Effective security monitoring depends on knowing exactly which software versions are running so that exploitation of known vulnerabilities can be detected and correlated (CAF Objective C, Principle C1 Security Monitoring)	Scan
`UK-CAF-D1` Response and Recovery Readiness	Incident response and recovery planning requires complete, well-defined records of what software the essential function runs, so components must be fully described with both name and version (CAF Objective D, Principle D1 Response and Recovery Planning)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CAF-A1`	Governance: Organisational Policy
`CAF-A2`	Risk Management
`CAF-A3`	Asset Management
`CAF-A4`	Supply Chain Security
`CAF-B1`	Service Protection: Network Security
`CAF-B2`	Service Protection: Identity and Access Management
`CAF-B3`	Service Protection: Data Security
`CAF-B4`	Service Protection: System Security
`CAF-B5`	Service Protection: Resilient Networks and Systems
`CAF-B6`	Service Protection: Staff Awareness and Training
`CAF-C1`	Detection: Security Monitoring
`CAF-C2`	Detection: Anomaly Detection
`CAF-D1`	Response and Recovery: Response Planning
`CAF-D2`	Response and Recovery: Improvements from Incidents

Policy templates

Written for NCSC CAF:

NCSC CAF Cybersecurity Programme Charter

And 22 from the standard set, adapted to NCSC CAF.