Cyber Assessment Framework v4.0: What UK Security Leaders Need to Know 

Cyber resilience isn’t just a best practice anymore, it’s become a regulatory expectation. With cyberattacks growing more targeted and complex, the UK’s National Cyber Security Centre (NCSC) has updated its Cyber Assessment Framework (CAF) to reflect this evolving threat landscape.  

Cyber Assessment Framework v4.0, released in July 2025, introduces significant updates that every security leader in the UK should be aware of, especially if you operate in critical national infrastructure (CNI), essential services or regulated sectors. 

CAF v4.0 builds on previous versions by placing greater emphasis on attacker understanding, secure software development, proactive threat detection and the emerging risks posed by artificial intelligence (AI). It’s a shift away from static compliance that moves towards dynamic cyber resilience. If you’re leading cyber security, risk or compliance, it’s vital you know how these changes affect your organisation. 

In this guide, we’ll walk you through what’s changed in CAF v4.0, why it matters now, and how to start aligning your cyber security strategy. You’ll gain a clear view of how to implement the framework in practice, the benefits of doing so, and how DigitalXRAID can support you.  

Key Takeaways 

• CAF v4.0 introduces four major updates to help you stay ahead of real-world cyber threats. 
• The framework supports regulatory alignment with NIS and the upcoming Cyber Security and Resilience Bill. 
• There’s a new emphasis on understanding attackers, secure software development, threat hunting and AI risk. 
• CAF v4.0 strengthens cyber resilience across critical infrastructure and the wider supply chain. 
• DigitalXRAID provides CAF Consultancy services to help you assess, implement and stay compliant. 

What is the Cyber Assessment Framework (CAF)? 

The Cyber Assessment Framework (CAF) was developed by the UK’s National Cyber Security Centre (NCSC) to help organisations assess and improve their cyber resilience. It’s particularly relevant if you’re responsible for protecting essential services, critical national infrastructure (CNI), or working in a regulated sector. 

CAF provides a structured way to evaluate how well your organisation can defend against cyber threats and respond to incidents. Rather than being a checklist of controls, it’s an outcomes based framework focused on delivering security that actually works. 

Who Should Use CAF? 

Originally designed for operators of essential services under the UK’s Network and Information Systems (NIS) regulations, the scope of CAF is widening. Today, it’s used across public sector organisations, energy and utilities, telecoms, transport, and increasingly by private sector businesses with high cyber risk exposure or supply chain obligations. 

If you’re leading cyber security or compliance within your organisation, understanding CAF is key to demonstrating maturity and resilience. 

Why CAF v4.0 Matters Now 

Cyber threats continue to evolve rapidly. The rise of AI-powered attacks, the increasing sophistication of nation-state actors, and supply chain compromise are all changing the risk landscape. At the same time, UK regulators are tightening their expectations. 

CAF v4.0, released by the NCSC in July 2025, reflects these pressures. It’s been updated to remain relevant in a threat driven environment, not just a compliance led one. If you’re trying to protect a complex environment with limited resources, CAF v4.0 provides clear guidance on what ‘good’ should look like. 

CAF v4.0 and UK Regulations 

CAF v4.0 supports compliance with several key UK frameworks: 

• NIS and NIS2 regulations for operators of essential services 
• The upcoming UK Cyber Security and Resilience Bill 
• Wider expectations around secure-by-design software and supply chain risk management 

Aligning to CAF v4.0 helps you stay ahead of these requirements while also demonstrating commitment to cyber resilience. 

What’s New in CAF v4.0? Key Updates Explained 

CAF v4.0 introduces four key changes that reflect the latest thinking in cyber security strategy. 

1. Understanding the Attacker

For the first time, CAF explicitly recognises the need to understand attacker’s techniques, tactics and intent. You’re now expected to consider the types of adversaries likely to target your organisation and align your defences accordingly. 

This update marks a shift from generic risk management to threat intelligence led defence. It supports better decision making when allocating budgets and prioritising security controls. 

2. Secure Software Development

CAF v4.0 places new emphasis on integrating security throughout the software development lifecycle. If you’re building internal systems or managing third-party development, you’ll need to show how you’re embedding secure-by-design principles. 

This reflects increased regulatory scrutiny around software supply chain risk, particularly after high-profile vulnerabilities like Log4j and MOVEit. 

3. Threat Detection and Hunting

Threat detection isn’t just about logging anymore. CAF v4.0 encourages you to adopt more proactive threat hunting techniques, using telemetry and analytics to detect suspicious behaviours before they escalate. 

This change supports a move toward modern Security Operations Centre (SOC) capabilities and aligns with threat led frameworks like MITRE ATT&CK. 

4. AI-Related Cyber Risks

Artificial intelligence is changing how attacks are launched and detected. CAF v4.0 introduces a new expectation for organisations to understand and mitigate AI-related cyber risks. 

Whether you’re deploying AI internally or just concerned about adversarial AI, this update highlights the importance of governance, testing and resilience against AI manipulation. 

CAF v4.0 vs CAF v3.2: What’s Different? 

If you’re already familiar with CAF v3.2, you’ll notice that version 4.0 retains the same high level structure. There are still four core objectives, 14 principles, and a strong emphasis on evidence-based assessment. 

However, CAF v4.0 introduces: 

• Clearer links to attacker models and threat intelligence 
• Expanded guidance on software and development lifecycle risks 
• A stronger push toward real-time detection and response 
• New references to AI, automation and digital resilience 

These changes reflect the need for more dynamic, flexible cyber defences in high risk environments. 

Implementing CAF v4.0: Guidance for IT and Security Leaders 

You don’t need to start from scratch, but you do need a clear plan. 

Assess Where You Are 

Start by reviewing your current alignment to CAF v3.2. What principles are already covered? Where are the gaps? A structured gap analysis will help you prioritise effort where it matters most. 

Set Improvement Goals 

CAF v4.0 isn’t a pass/fail framework. It’s designed to help you continuously improve. Work with internal stakeholders to define realistic improvement targets across each principle. 

Self-Assessment vs Independent Review 

Self-assessment can be a useful first step, but many organisations benefit from an external perspective. A third-party review can validate your current maturity level, identify blind spots and provide credible evidence for regulators or internal audit. 

DigitalXRAID’s CAF Consultancy services are built to do just that, helping you turn the framework into an actionable plan. 

Align with ISO 27001 and NIS2 

If you’re already working toward ISO 27001 Certification or NIS2, then CAF v4.0 aligns closely with both so your journey has already started. You can streamline your efforts by mapping controls across these frameworks and building an integrated compliance roadmap. 

CAF v4.0 for Essential Services and CNI 

For operators of essential services and critical national infrastructure, CAF v4.0 is more than guidance, it’s a regulatory expectation. 

Sector Specific Application 

Each regulator may interpret CAF slightly differently. For example: 

• In energy and utilities, there’s increasing focus on AI resilience and physical systems 
• In healthcare, secure software and third-party risk are under the microscope 
• In local government, resilience planning and threat detection are key drivers 

Tailoring your approach to your sector’s expectations is critical. DigitalXRAID works across regulated industries and understands what good looks like in each one. 

How DigitalXRAID Can Support Your CAF v4.0 Journey 

Whether you’re just getting started or refining an existing strategy, DigitalXRAID can help you take the next step. 

Our Cyber Assessment Framework Consultancy service includes: 

• Independent cyber maturity assessments aligned to CAF v4.0 
• Gap analysis and practical action plans 
• Mapping to ISO 27001, NIS2 and sector specific obligations 
• Support from NCSC and CREST accredited consultants with UK regulatory expertise 

Final Thoughts: Building Cyber Resilience with CAF v4.0 

CAF v4.0 isn’t just a regulatory update, it’s a signpost for the future of cyber resilience in the UK. 

By focusing on real world threats, secure development, proactive monitoring and emerging risks like AI, it offers you a clear path to improving security across your organisation. 

Don’t wait until you’re forced to act. If you’re unsure where to begin or want to validate your current strategy, get in touch with DigitalXRAID today and take the first step toward a more resilient future. 

FAQs About CAF v4.0 

What’s new in CAF version 4.0? 

CAF v4.0 adds new expectations around understanding attackers, secure development, AI risk and proactive detection. It updates existing principles while keeping the overall structure the same. 

Is CAF v4.0 mandatory? 

While not a statutory requirement on its own, regulators often use CAF as the benchmark for good cyber governance. If you’re subject to NIS or other UK frameworks, you’re expected to align to CAF. 

How does CAF v4.0 compare to ISO 27001? 

CAF focuses on outcomes and resilience, while ISO 27001 is more control-based. They complement each other well, and many organisations use both as part of a wider risk and compliance strategy. 

Can CAF v4.0 be used in the private sector? 

Yes. While designed for essential services, CAF is increasingly adopted by private sector firms looking to strengthen their cyber maturity and demonstrate good practice to clients or regulators. 

How does CAF v4.0 address AI? 

It introduces new guidance to identify, assess and manage risks associated with AI use or abuse, both internally and in the threat landscape.