Introducing the Cyber Assessment Framework 4.0: An Updated Tool for UK Cyber Resilience

CAF 4.0 is not merely an incremental update to version 3.2. While many of the previous Contributing Outcomes (COs) and Indicators of Good Practice (IGPs) remain familiar, their wording and focus have evolved to reflect the complexity of today's threat environment.

The most notable shift in CAF 4.0 is its enhanced threat model. The framework now places greater emphasis on adversaries with advanced capabilities, persistence, and intent. This means that organisations will need to demonstrate not only that they have protective controls in place but also that those controls are effective against sophisticated threat actors.

This increase in threat level is particularly visible in the treatment of monitoring and detection. New requirements have been introduced around triage processes, threat intelligence, and behavioural analysis. For example, organisations are now expected to understand and utilise user and system behaviour patterns to identify abnormal activity and detect incidents early.

This raises the bar for those working within essential services. Preparing only for common threats is no longer sufficient. CAF 4.0 makes clear that organisations must be capable of defending against adversaries who may possess extensive resources, long-term strategic objectives, and deep technical capability.

A threat-informed, risk-based approach

The new version of the CAF places far greater emphasis on threat intelligence, contextual awareness, and the need for proactive monitoring. Most of the changes introduced in CAF 4.0 have been implemented as refinements to existing IGPs. These include clarified language, more specific examples, and greater emphasis on testing, documentation, and validation.

Some entirely new Contributing Outcomes have also been added. For instance, C1.f introduces a new CO focused on understanding user and system behaviour and integrating threat intelligence into monitoring practices. This goes beyond traditional log analysis and calls for a more analytical, threat-hunting mindset, supported by both skilled personnel and appropriate automated tooling (where possible). Meanwhile, the previous 'System Abnormalities for Attack Detection' has been reshaped into a more structured and repeatable threat-hunting capability under Objective C.

Other additions include new COs dedicated to understanding threats in the essential function (A2.b) and requirements for secure software development and support, focusing on the assurance of software suppliers' and software development environments/lifecycles (A4.b).

AI, machine learning & automation

CAF 4.0 introduces more explicit references to the role of machine learning and automated decision-making within network and information systems. These are not treated as security risks per se, but their inclusion suggests that such technologies must be considered in risk assessments and secured appropriately. Where AI or automated decision-making supports the delivery of essential functions, the framework expects visibility into how these systems behave, make decisions, and could be influenced.

Whilst CAF 4.0 is not designed to be a compliance checklist for artificial intelligence, it does set clear expectations for assurance where automation plays a significant role.

These updates align closely with wider government initiatives, including the UK's Software Security Code of Practice, released on 7 May 2025, which promotes Secure by Design principles and responsible software deployment. CAF 4.0 doesn't map directly to the Code of Practice; however, it does support organisations in meeting many of its underlying goals, especially around transparency, testing, and accountability.

Going beyond checklist compliance

It's worth noting that CAF 4.0 maintains its flexible, sector-agnostic, outcome-driven structure. The framework does not dictate specific technologies or configurations. Instead, it asks organisations to demonstrate that they can achieve a defined set of outcomes appropriate to the risks they face and the essential functions they support within their sector.

This, therefore, ensures the framework remains adaptable to a variety of sectors and system architectures. However, it also requires organisations to understand the risk profile and select controls that are proportionate and effective in their operational context.

Transition timelines

A key consideration for any organisation currently working to CAF 3.2 (or prior) is the question of transition. Whilst CAF 4.0 is now live and recommended for use by the NCSC, timelines for moving from version 3.2 to 4.0 are not mandated centrally. Instead, each Competent Authority will set its own transition period and expectations for adoption.

That means organisations must engage with their regulator to understand specific timelines, reporting requirements, and any sector-specific guidance. Early engagement is advised, especially where investment or capability uplift may be required to meet the new requirements.

It’s also worth noting the forthcoming Cyber Security and Resilience Bill will bring new sectors into scope of UK NIS regulations. As a result, managed service providers, data centre operators, and others will likely have to gear up to adhere to CAF 4.0 in future.