What the Cyber Assessment Framework and Cyber Essentials Are on the NCSC Website

Updated

The NCSC website lists two distinct frameworks for organisations: the Cyber Assessment Framework (CAF) and Cyber Essentials. The CAF is a collection of cyber security guidance aimed at organisations that play a vital role in the day-to-day life of the UK, with a focus on essential functions. Cyber Essentials is a certification-style scheme that helps businesses protect against the most common cyber threats. In short: CAF is for organisations whose disruption would affect essential services; Cyber Essentials is a baseline for businesses that want to reduce everyday risk.

Cyber Assessment Framework (CAF)

The NCSC describes the CAF as "a collection of cyber security guidance for organisations that play a vital role in the day-to-day life of the UK, with a focus on essential functions." It appears on the site under popular guidance for organisations.

Who it is for

  • Organisations that deliver essential functions the UK depends on
  • Teams responsible for assessing and improving cyber resilience in those settings

What it is not

The CAF is guidance, not a product or a one-off certificate. The site presents it as a framework to work through, so expect an ongoing assessment and improvement process rather than a single pass/fail test.

Cyber Essentials

Cyber Essentials is presented as a way to "protect your business against the most common cyber threats." It sits alongside the CAF as popular guidance for organisations, but it serves a different purpose: it is a defined set of baseline protections that a business can adopt and be assessed against.

Who it is for

  • Small and medium-sized organisations that want a clear baseline
  • Businesses that need to show customers and partners they have basic controls in place

What it is not

Cyber Essentials is not a substitute for the CAF. It addresses common threats, not the deeper assurance needs of organisations with essential functions.

How They Compare

Dimension Cyber Assessment Framework (CAF) Cyber Essentials
Primary purpose Guidance for organisations with essential functions in UK daily life Protect a business against the most common cyber threats
Scope Broader assessment of cyber security and resilience Baseline set of protections
Typical user Organisations delivering vital services Small and medium-sized organisations, and businesses generally
Output Ongoing assessment and improvement A defined baseline you can adopt and be assessed against
Where it sits on the site Popular guidance for organisations Popular guidance for organisations

How to Choose

  • If your organisation delivers an essential function the UK relies on, start with the CAF and treat Cyber Essentials as a possible baseline component.
  • If you run a small or medium-sized business and want a clear, bounded starting point against common threats, start with Cyber Essentials.
  • If you are unsure which applies, the NCSC site organises guidance by audience — including "Small & medium sized organisations," "Large organisations," "Public sector," and "Cyber security professionals" — so you can match the guidance to your organisation type.

Where to Find Them

Both are listed on the NCSC homepage under "Popular content for organisations." The CAF is under "Guidance," and Cyber Essentials is under "Information." The site also offers a "Subscribe" option at ncsc.gov.uk/register/subscribe if you want updates, though the guidance pages themselves are the place to start reading.