Cyber Security
NCSC CAF Assessments

GovAssure Support
Services

Achieve and maintain GovAssure compliance with expert NCSC Cyber Assessment Framework (CAF) assessments, gap analysis, and continuous improvement—helping you make informed, defensible decisions about security governance, not just produce compliance documentation.

14 CAF PrinciplesFull Assessment
GovAssureRegistration Support
ContinuousCompliance

What Is GovAssure & CAF?

GovAssure is the UK government's cyber assurance framework, using the NCSC Cyber Assessment Framework (CAF) to evaluate security posture. CAF assesses 14 principles covering governance, risk management, asset protection, detection, response, and recovery—helping organisations demonstrate accountable cyber risk management at appropriate levels.

The CAF provides a systematic approach to assessing cybersecurity risk management with evidence-based decisions that can withstand scrutiny. Achieving CAF compliance demonstrates your organisation maintains appropriate security controls and can protect sensitive government data—enabling senior leaders to understand which risks matter, which can be tolerated, and which require intervention with defensible decision-making.

For organisations bidding on government contracts through G-Cloud or direct procurement, demonstrating security controls aligned with CAF principles can be critical. GovAssure alignment shows security maturity and risk management capability. Our approach recognises effective security governance is a decision-making challenge requiring senior ownership, clear accountability, and defensible decisions—not just a documentation exercise.

14CAF principles form the foundation of NCSC's Cyber Assessment Framework
3Assessment outcomes: achieved, partially achieved, or not achieved
100%of in-scope critical systems must be assessed against appropriate CAF profile

Four Objectives, Fourteen Principles

The NCSC Cyber Assessment Framework groups its fourteen principles under four objectives - managing security risk, protecting against cyber attack, detecting cyber security events, and minimising the impact of incidents. GovAssure assesses each contributing outcome against a Baseline or Enhanced profile.

A1Governance
A2Risk management
A3Asset management
A4Supply chain
B1Service protection policies, processes and procedures
B2Identity and access control
B3Data security
B4System security
B5Resilient networks and systems
B6Staff awareness and training
C1Security monitoring
C2Proactive security event discovery
D1Response and recovery planning
D2Lessons learned

Why GovAssure & CAF Compliance Is Essential

Government Contract Requirement

GovAssure and CAF shape government supplier expectations. Many contracts require suppliers to demonstrate alignment with CAF controls or provide supporting evidence. Our approach ensures security decisions are accountable, evidence-based, and more than just compliance documentation.

Supply Chain Security Mandates

Government departments manage supplier cybersecurity expectations. Suppliers may need to demonstrate CAF-aligned controls, continuous monitoring, and security improvements to meet contractual requirements. Our governance services ensure decisions are deliberate, reviewed, and supported by evidence that will withstand scrutiny after incidents, audits, and inquiries.

Cyber Threat Landscape

Nation-state and sophisticated actors target government suppliers to access critical infrastructure and sensitive data. CAF-aligned controls help demonstrate appropriate defensive capabilities. We support deliberate, evidence-based trade-offs between operational need, cost, resilience, and regulatory expectations.

Why Choose E2E Security Consulting for GovAssure & CAF?

Accredited CAF Assessors

Our team includes experienced assessors conducting CAF assessments for government suppliers across all sectors. We understand each CAF principle's requirements, government assurance team evidence expectations, and practical implementation challenges. Our approach treats security risk management as a decision-support discipline—risk assessments enable informed choices about which risks to treat, accept, transfer, or avoid.

Government Sector Expertise

We specialise in government security requirements, having guided numerous suppliers through GovAssure registration, annual reassessments, and continuous compliance. Our team includes consultants with direct experience working within central government, understanding Cabinet Office Security Policy Framework, NCSC guidance, and departmental requirements. We design governance structures for sustainability—clear enough to be understood, practical enough to be followed.

Outcome-Focused Methodology

Rather than checkbox compliance, we focus on genuine security improvement whilst satisfying GovAssure requirements. Our approach identifies practical controls enhancing defensive capabilities whilst demonstrating achievement against CAF outcome statements. We assess whether controls actually reduce risk rather than simply whether documentation exists—testing controls in operation and examining evidence of effectiveness.

Continuous Improvement Support

GovAssure compliance is ongoing commitment to maintaining cybersecurity capabilities. We provide continuous support including quarterly reviews, control effectiveness testing, and proactive guidance on evolving requirements—ensuring compliance throughout annual reassessment. Our governance designs ensure security considerations become part of how you make decisions rather than separate compliance activity conducted in parallel.

What Sets Our GovAssure Services Apart

Decision-Grade Governance

We prioritise practical security improvements over theoretical compliance. Our recommendations consider your size, resources, and risk environment, ensuring controls deliver genuine security value whilst satisfying government requirements. We specialise in decision-grade security advisory—helping senior leaders make informed, defensible decisions about risk where there are no perfect options, with explicit, evidence-based, accountable trade-offs.

Governance Under Scrutiny

We maintain complete transparency throughout assessment, clearly explaining evaluation criteria, evidence requirements, and achievement determinations. You'll understand assessment status throughout with opportunities to address concerns before final submission. We understand how decisions are examined after incidents, audits, and inquiries—helping you make decisions that will withstand that scrutiny with structured evidence.

Public Sector Accountability Experience

Beyond CAF technical requirements, we understand government procurement, departmental security requirements, and public sector accountability environments. Our team includes consultants with direct experience within central government, local authorities, NHS organisations, and arm's length bodies. We regularly advise clients where decisions have real consequences—helping you make decisions you can defend to your board, regulator, and auditors.

Capability Building Focus

We help organisations leverage investments across multiple frameworks including ISO 27001, Cyber Essentials Plus, and NIST CSF. Rather than treating CAF as isolated compliance, we integrate it within your broader security programme, reducing overall costs whilst enhancing capabilities. We design engagements to build your capability rather than create permanent consultancy dependence—including training, documentation, and coaching.

Our CAF Assessment Approach

01

Pre-Assessment Readiness Review

We conduct comprehensive readiness assessments evaluating your cybersecurity posture against all 14 CAF principles, identifying existing controls, documentation gaps, and implementation deficiencies. This establishes baseline maturity, determines achievable outcome levels (Bronze/Silver/Gold), and creates prioritised remediation roadmap. Our approach emphasises practical effectiveness over theoretical compliance—assessing whether controls reduce risk, not just whether documentation exists.

02

Gap Remediation & Evidence Development

We guide implementation of missing controls, policy development, and creation of evidence packages demonstrating control effectiveness. Our approach focuses on controls delivering genuine security value whilst satisfying assessor expectations, avoiding unnecessary bureaucracy beyond your risk appetite. We help define board-level oversight responsibilities, role definitions with clear accountability, and governance documentation satisfying regulatory expectations whilst remaining practical.

03

Formal CAF Assessment Execution

We conduct rigorous independent assessment of cybersecurity capabilities against all CAF principles and outcome statements. This includes documentation review, technical control testing, personnel interviews, and validation of operational practices. Our assessment methodology aligns with NCSC guidance and government assurance team expectations—providing independent assurance that security controls operate effectively and compliance obligations are met.

04

GovAssure Registration & Continuous Compliance

Following successful assessment, we support GovAssure registration, handle government assurance team queries, and establish continuous compliance programmes maintaining achieved outcome levels. This includes quarterly control testing, policy updates reflecting emerging threats, and annual reassessment preparation. We design governance structures that work after we leave—embedded deeply enough to survive staff turnover and organisational change.

Aligning CAF with Broader Compliance Requirements

NCSC CAF v3.1

We assess security against the NCSC Cyber Assessment Framework, covering all 14 principles and 72 indicators of good practice across Bronze, Silver, and Gold outcomes. Our approach reflects current NCSC guidance and government assurance expectations, providing evidence-led conclusions on whether security posture is acceptable, defensible, or requires remediation.

ISO 27001 Alignment

The CAF framework aligns closely with ISO 27001 information security management requirements. Organisations with existing ISO 27001 certification can leverage their ISMS documentation, risk assessment processes, and implemented controls as evidence supporting multiple CAF principles, reducing duplication whilst demonstrating systematic security management capability.

Cyber Essentials Plus

Cyber Essentials Plus certification provides foundational technical controls supporting several CAF principles. We help organisations leverage their CE+ certification as evidence for asset management, configuration management, and user access control principles, whilst identifying additional requirements necessary for comprehensive CAF compliance beyond CE+ scope.

Begin Your GovAssure Journey Today

Request Readiness Assessment

Book a complimentary CAF readiness review to evaluate your current cybersecurity maturity against GovAssure requirements. We'll identify your baseline position, determine achievable outcome levels, and provide a clear roadmap to successful assessment including estimated timelines and resource requirements.

Explore Our Approach

Discover how our pragmatic, outcome-focused CAF assessment methodology helps organisations achieve genuine security improvement whilst satisfying government compliance requirements. Learn about our transparent process, evidence expectations, and continuous support approach that ensures sustained GovAssure compliance.

Explore Services

Join Our Clients

Become part of the growing community of government suppliers trusting E2E Security Consulting for GovAssure compliance, CAF assessments, and continuous security improvement. Leverage our expertise to achieve and maintain the cybersecurity capabilities essential for success in the UK public sector market.

GovAssure & the NCSC CAF, answered

What is GovAssure?
GovAssure is the UK government's cyber assurance scheme for central government. Introduced under the Government Cyber Security Strategy 2022-2030 and run by the Government Security Group in the Cabinet Office, it requires departments to assess their most important systems against the NCSC Cyber Assessment Framework (CAF) and to have that assessment independently reviewed - replacing older, self-certified departmental health checks with a consistent, evidence-based approach.
What is the NCSC Cyber Assessment Framework (CAF)?
The Cyber Assessment Framework (CAF) is the NCSC's outcome-based framework for assessing how well an organisation is managing cyber risk to its essential functions. It is organised into four objectives, fourteen principles and thirty-nine contributing outcomes, each assessed against Indicators of Good Practice. Rather than a tick-box checklist, the CAF describes the security outcomes an organisation should achieve, leaving how they are achieved to the organisation.
Who has to complete GovAssure?
GovAssure applies to central government departments and their arm's-length bodies, focused on their most critical systems. Beyond central government, the CAF is also used by operators of essential services under the NIS Regulations and by other regulated sectors, so the same framework increasingly shapes cyber assurance expectations across critical national infrastructure and the wider public sector supply chain.
What are the CAF objectives and principles?
The CAF has four objectives: A - Managing security risk; B - Protecting against cyber attack; C - Detecting cyber security events; and D - Minimising the impact of cyber security incidents. Beneath these sit fourteen principles, from Governance and Risk management through to Response and recovery planning and Lessons learned, each broken down into contributing outcomes that are individually assessed.
What are the CAF profiles - Baseline and Enhanced?
Under GovAssure, each system is assessed against a target CAF profile that reflects its importance and threat exposure. Lower-criticality systems are assessed against a Baseline profile, while systems whose compromise would have the greatest impact are held to an Enhanced profile with more stringent expected outcomes. The profile sets the bar each contributing outcome must reach.
What is the difference between GovAssure and Cyber Essentials?
Cyber Essentials is a certification of five basic technical controls, suitable as a minimum baseline for any organisation. GovAssure is far broader and deeper: an outcome-based assessment of a specific system against the CAF, covering governance, risk management, supply chain, detection and incident response, and subject to independent review. Cyber Essentials shows you have the basics in place; GovAssure demonstrates mature, risk-driven assurance of a critical service.
What are the CAF assessment outcomes?
Each contributing outcome in the CAF is assessed as Achieved, Partially Achieved, or Not Achieved, judged against the Indicators of Good Practice. This gives a granular picture of where a system meets its target profile and where gaps remain, which becomes the basis for a prioritised improvement plan rather than a single pass or fail grade.
How can E2E Security Consulting help with GovAssure and the CAF?
Our security-cleared consultants support the full GovAssure life cycle: scoping the systems in scope, tailoring the CAF profile, running the self-assessment against all fourteen principles, gathering defensible evidence, and preparing for the independent assurance review - then turning the results into a prioritised improvement roadmap. We operationalise CAF assessment and continuous evidence through the E2ERisk platform, so assurance is maintained between reviews rather than rebuilt each year.

Achieve GovAssure Compliance with Confidence

GovAssure compliance is not merely a procurement checkbox but a strategic capability requiring clear accountability and defensible decision-making. Partner with E2E Security Consulting to achieve successful CAF assessment, maintain continuous compliance, and make security governance decisions you can defend to your board, regulator, and auditors.

If you need a consultancy to produce documentation, many firms can help. If you need a consultancy to help you make decisions you can defend—that is what E2E Security Consulting is for.

Your GovAssure success is our mission—let's achieve defensible compliance together.