NCSC Cyber Assessment Framework

Who this service is for

For organisations operating essential functions, regulated services or critical dependencies that need a CAF-based assessment or readiness review.

Common challenges companies face

• Essential functions are not clearly linked to the systems, people and suppliers that sustain them.
• Assessment teams use different interpretations of outcomes and indicators.
• Security monitoring exists, but coverage, escalation and investigation records are difficult to demonstrate.
• Recovery plans do not reflect realistic dependencies or tested service restoration.

Technical scope

• Confirm essential functions, assessment boundary and the applicable CAF version and sector profile.
• Review governance, risk management, assets, supply-chain dependencies and protective controls.
• Examine identity controls, system configuration, segmentation, monitoring and response arrangements.
• Test whether documented conclusions are supported by evidence of operation, not just written policies.

How Poleis supports you

• Agree the applicable profile with the organisation and relevant oversight expectations.
• Hold structured workshops and evidence walkthroughs with business and technical owners.
• Record outcome-level findings, confidence and evidence gaps, then agree remediation priorities.

What you receive

• CAF assessment or readiness report with rationale and supporting evidence references.
• Essential-function dependency map and prioritised remediation register.
• Management briefing with ownership, residual concerns and reassessment milestones.

Engagement scope

The applicable profile and assessment expectations are agreed for each engagement. Readiness support does not confer regulator approval.

Official guidance