NCSC

1. 2026-10-15 Low
   NCSC publishes post-quantum cryptography recommendations for TLS configuration

   The NCSC has published updated recommendations for configuring post-quantum cryptography in TLS protocols. Organizations should begin migrating their TLS implementations to incorporate post-quantum-safe cryptographic algorithms. This …

   Guidance

2. 2026-10-15 Low
   NCSC publishes recommended TLS configuration profiles for data protection

   NCSC has published recommended profiles for securely configuring TLS across the most common versions and deployment scenarios. The guidance includes best practices for implementing TLS effectively …

   Guidance

3. 2026-08-17 Low
   NCSC publishes Cyber Adversary Simulation (CyAS) scheme documents

   The UK National Cyber Security Centre (NCSC) has published official scheme documents for the Cyber Adversary Simulation (CyAS) program. These documents establish NCSC's expectations for how …

   New document

That is the last 90 days. Sign in to read further back.

1. 2026-04-27 Cyber Essentials Requirements for IT Infrastructure v3.3 take effect
2. 2025-08-06 NCSC announces CAF v4.0 and encourages all system owners to adopt it
3. 2025-08-04 Cyber Assessment Framework v4.0 released

1. 2025-08-04
   Cyber Assessment Framework v4.0 Major versionCurrent

   Fourth iteration of the CAF, with new sections on understanding attackers and on secure software development, updated monitoring and threat hunting, and wider AI coverage. source

   More

   • A new section on understanding attacker methods and motivations to inform cyber risk decisions.
   • A new section on making sure software used in essential services is developed and maintained securely.
   • Updates to security monitoring and threat hunting to improve detection.
   • Improved coverage of AI-related cyber risks throughout the CAF.
2. 2024-04-15
   Cyber Assessment Framework v3.2 Revision

   CAF v3.2 released; the NCSC publishes a v3.1 to v3.2 change document. source

3. 2022-04-11
   Cyber Assessment Framework v3.1 Revision

   CAF v3.1 released; the NCSC publishes a v3.0 to v3.1 change document. source

4. 2019-09-30
   Cyber Assessment Framework v3.0 Major version

   CAF v3.0 released. source

5. 2018-10-31
   Cyber Assessment Framework v2.0 Major version

   CAF v2.0 released. source

The CAF targets organisations responsible for critical network and information systems; regulators decide whether it is used to meet their requirements.

Primary audience

Organisations operating essential services in sectors such as energy, healthcare, transport, digital infrastructure and government. source

Also for

Organisations subject to the NIS Regulations, UK critical national infrastructure, organisations managing cyber risks to public safety and public sector bodies supporting core government functions. source

Regulators

Organisations subject to cyber regulation should consult their regulator on whether to use the CAF to meet regulatory requirements. source

Government

The CAF is used by nearly all UK cyber regulators and in GovAssure, the assurance scheme for government organisations' critical systems. source

CAF assessments are done by the organisation itself or by an independent external body such as a regulator, against outcomes and a Basic or Enhanced profile.

Who assesses

The responsible organisation (self-assessment) or an independent external entity, such as a regulator or an NCSC assured commercial provider acting for one. source

Outcomes

Four objectives and 14 principles written as outcomes, not a checklist, with Indicators of Good Practice under each. source

Profiles

A Basic Profile sets the target for all sectors; sector-specific Enhanced Profiles target more capable attackers. source

Baseline scheme

Cyber Essentials, a separate NCSC scheme, certifies five baseline technical controls through a verified self-assessment or Cyber Essentials Plus testing. source

The NCSC does not enforce; sector regulators and legislation such as the NIS Regulations carry the legal duties.

NCSC role

The NCSC developed the CAF as national technical authority and has no regulatory responsibilities itself. source

Legal role under NIS

The NIS Regulations 2018 designate GCHQ as the UK CSIRT and single point of contact (regulations 4 and 5). source

1. Standard Cyber Assessment Framework (NCSC collection)
2. Guidance CAF changelog with all versions and change documents
3. Guidance Introduction to the CAF
4. Guidance Cyber Assessment Framework v4.0 released in response to growing threat (NCSC blog)

1. Cyber Essentials

   A certification of five baseline technical controls for any organisation, rather than an outcome-based assessment for essential services.

2. UK NIS Regulations

   The regulations that impose legal security and reporting duties; the CAF is a tool many NIS regulators use to assess them.

3. NIST CSF

   The US NIST framework of outcome-based cyber security functions, voluntary and not tied to a UK regulator.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 10 September 2026. Subscribe to NCSC (RSS)