What evidence does an NCSC CAF assessment need?
An NCSC CAF assessment is judged on evidence, not intent. Here is the difference between proving a control exists and proving it operates - and what a GovAssure reviewer actually wants to see.
The NCSC Cyber Assessment Framework is written as outcomes to achieve, not boxes to tick. Each contributing outcome is judged as achieved, partially achieved or not achieved, and every judgement has to rest on evidence. So the question we hear most often from teams facing a CAF assessment, whether through GovAssure or a sector regulator, is a simple one: what evidence is actually enough?
The honest answer is that it depends on the outcome and the profile you are assessed against. But there is one distinction that does more work than any other, and getting it right removes most of the guesswork.
Evidence that a control exists, and evidence that it operates
A policy, a procedure and an architecture diagram tell a reviewer that a control has been designed. They do not, on their own, show that it runs. An access control policy is not a privileged access review. A joiners, movers and leavers procedure is not the record of the last time someone actually removed an account.
The evidence a CAF reviewer values most is the evidence that a control operated: the completed review with its date, the person who signed it off, and the result it produced, including the ticket references behind it. A review can legitimately find nothing to change and still be strong evidence, because it shows the control ran and left a record.
A quick test for any piece of evidence: does it show the control was designed, or that it operated? Both matter, but a CAF assessment is won on the second. If every artefact behind an outcome is a policy or a diagram, the outcome is not yet evidenced.
Indicators of good practice are not a checklist
The NCSC is explicit that assessing a contributing outcome is primarily a matter of expert judgement, and that the indicators of good practice are not a checklist to be totted up. Normally every achieved indicator needs to be present to claim an achieved status, and a single not-achieved indicator would normally pull it down - but an indicator can be not applicable where compensating measures meet the objective another way.
That is why the written rationale matters as much as the evidence it points to. The rationale is the artefact that carries the assessment through independent review: it states which indicators are met, which are not, and why, against the profile that applies to you. An organisation is not expected to reach achieved on every outcome, and under GovAssure that would usually be disproportionate for an OFFICIAL system. The profile sets the target.
What a reviewer reads: a worked example
A working record, access-related outcome, status pending. Evidence reviewed: a privileged access review for the in-scope service, completed last month and signed by the service owner, covering twelve of fourteen privileged accounts and removing none, which is a legitimate result. The limit: two contractor accounts are absent from the record, so their access was not checked this cycle. Next action: review those two accounts and record the result, owner named, deadline set. The outcome is judged once the full indicator set has been assessed, not from this single record. (Illustrative - it describes no client.)
Two things make that record defensible. It does not grade the whole outcome from one document, and it does not quietly park a known gap until next quarter. One review is a single line in a register that will hold many, and the skill is in building the register so the whole position holds together under challenge.
Keeping the evidence manageable
Most of the effort in a CAF assessment is coordination, not technology. The teams that find it manageable are the ones that work from the evidence they already produce - change records, ticket histories, review minutes, monitoring reports - and only collect what is genuinely missing. A supported assessment keeps that evidence in order through a clear sequence.
- Confirm the version, profile and outcome set your oversight body sets, then scope the essential functions and the critical systems behind them.
- Give every contributing outcome a named owner across cyber security, information governance and IT operations.
- Turn each outcome into a short, answerable evidence request, checked for what operated, when, who owns it and what record it left.
- Write a rationale for every outcome, and record gaps rather than implying them.
- Order the gap register by consequence to the essential function, and give every action an owner and a date.
- Rehearse the independent review before it happens, so weak evidence becomes a task on a plan rather than a finding on the record.
Where E2E Security Consulting fits
We work alongside your team through the full cycle: agreeing scope and profile, mapping owners, assembling and testing the evidence you already hold, writing judgements that hold up, and preparing your people for the independent review. The decisions stay with you, because you know your services and your risk appetite better than any outsider - our job is to make the position well evidenced, clearly argued and easy to defend.
See how our consultants support the full GovAssure and NCSC CAF assessment cycle: GovAssure & NCSC CAF support services
Common questions
What is the NCSC Cyber Assessment Framework (CAF)?
The CAF is the NCSC’s framework for assessing cyber resilience. It is organised as four objectives across fourteen principles, written as outcomes to achieve rather than a checklist. Each principle breaks into contributing outcomes, judged as achieved, partially achieved or not achieved, with evidence.
What evidence does a CAF assessment need?
Evidence that a control operates, not just that it exists. A policy or an architecture diagram shows a control was designed; a completed review with its date, the person who signed it off and the result it produced shows the control actually ran. A CAF assessment is judged on the second.
What is GovAssure?
GovAssure is the UK government’s cyber assurance scheme. It applies the NCSC CAF to central government organisations with a defined scope of critical systems, a required profile (Basic or Enhanced), and an independent assurance review.
Are the CAF indicators of good practice a checklist?
No. The NCSC states that assessing a contributing outcome is primarily a matter of expert judgement. Normally all achieved indicators must be present for an achieved status, but an indicator can be not applicable where compensating measures meet the objective another way.
Is a CAF assessment a certification?
No. A CAF assessment records an evidenced position against outcomes, measured against the profile that applies to you. It is not a pass or fail certificate, and an organisation is not expected to reach achieved on every outcome.
Sources
Written by the E2E Security Consulting team. This article is general guidance, not formal advice on your specific circumstances - for that, the useful first step is a short conversation.
More insights
- Preparing for GovAssure: a practical guide to the NCSC CAF — GovAssure applies the NCSC Cyber Assessment Framework to central government. Here is how to scope it, assess honestly and survive independent review.
- Does NIS2 apply to UK organisations? — NIS2 is an EU directive, but plenty of UK organisations still fall within its reach. Here is who is affected, and how it sits alongside the UK’s own regime.
- Secure by Design in practice, not on paper — The UK government’s Secure by Design is meant to shape decisions, not be a form completed near go-live. Here is what doing it properly looks like.