The Cyber Assessment Framework Explained: What It Means for NHS Suppliers and Small Providers

If you've been reading about the DSPT, you've probably seen the phrase "CAF-aligned". It refers to the Cyber Assessment Framework, a piece of national cyber security infrastructure most small NHS providers have never heard of. It sits behind the DSPT, but if you run a care home, pharmacy, dental practice, optician or GP practice, it is not what you fill in.

This guide explains what the CAF is, who it's for, why NHS England adopted it, and what it actually means for the day-to-day work of completing the DSPT. It is written for people running care homes, pharmacies, GP practices, and other Category 3 / Category 4 organisations — not for NHS Digital security architects.

What is the Cyber Assessment Framework?

The Cyber Assessment Framework (CAF) is a set of cyber security principles maintained by the National Cyber Security Centre (NCSC) — the UK's technical authority on cyber security and a part of GCHQ.

The NCSC says it "developed the CAF in its role as national technical authority for cyber security, with an expectation that it would be used, amongst other things, as a tool to support effective cyber regulation" — including regulation under the Network and Information Systems Regulations 2018 (the NIS Regulations), whose Schedule 2 covers essential services in the electricity, oil, gas, transport, healthcare, drinking water and digital infrastructure subsectors. The NCSC now says it is "primarily designed for organisations operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government". NHS England adopted it for the DSPT in September 2024.

The CAF is not a checklist. It is an outcome-based framework: rather than telling you "install a firewall" or "use 12-character passwords," it asks you to demonstrate that you achieve specific outcomes. Outcome A2.a, for example, reads: "Your organisation has effective internal processes for managing risks to the security and resilience of network and information systems related to the operation of your essential function(s) and communicating associated activities." How you achieve those outcomes is up to your organisation.

The full framework is documented at the Cyber Assessment Framework collection on ncsc.gov.uk, which currently presents CAF version 4.0. NHS England's announcement for the current toolkit, version 9 (2026-27), says "DSPT Version 9 is aligned to CAF version 4.0". The previous version, v8 (2025/26), was aligned to CAF version 3.4.

How the CAF is structured

The CAF is organised around four high-level objectives, each containing a set of principles, and each principle expressed as a set of contributing outcomes. The four objectives are:

Objective	Theme	Example principle
A	Managing security risk	Governance, risk management, asset management, supply chain
B	Protecting against cyber attack	Service protection policies, processes and procedures; identity and access control; data security; system security; resilient networks and systems; staff awareness and training
C	Detecting cyber security events	Security monitoring, threat hunting
D	Minimising the impact of cyber security incidents	Response and recovery planning, lessons learned

Each principle has a letter–number identifier (A1 Governance, A2 Risk Management, B1 Service protection policies, processes and procedures, and so on, in CAF version 4.0). Within each principle there are contributing outcomes, and within each outcome there are indicators of good practice.

NHS England uses its own health and care version of the CAF, which adds a fifth objective. Its CAF FAQ explains that "objective E was added to ensure appropriate outcomes were included to cover ‘Using and sharing information appropriately’." Only the large organisations work through that framework directly. If you are a Category 3 or Category 4 organisation, you answer evidence items under the ten National Data Guardian standards instead.

Why NHS England adopted the CAF

The change came before version 8. NHS England's page on it says: "In September 2024 the DSPT changed to adopt the National Cyber Security Centre’s Cyber Assessment Framework (CAF) as its basis for cyber security and IG assurance." That was version 7 (2024-25), whose announcement said "NHS Trusts, ALBs, CSUs and ICBs will view a new interface aligned to the NCSC Cyber Assessment Framework." NHS England's announcements give the CAF version each year: version 8 (2025/26) "is aligned to CAF version 3.4" (News/161), and version 9 (2026-27) "is aligned to CAF version 4.0" (News/169).

NHS England's own explanation is that "In 2023 the health and care cyber security strategy committed to adopt the CAF as the principal cyber standard." It says it expects the CAF to:

"Emphasise good decision-making over compliance, with better understanding and ownership of information risks at the local organisation level, where those risks can most effectively be managed."
"Support a culture of evaluation and improvement, as organisations will need to understand the effectiveness of their practices at meeting the desired outcomes – and expend effort on what works, not what ticks a compliance box."

The same page is clear about who sees the new format. NHS Trusts, OES, CSUs, ALBs, ICBs and Genomics organisations see "a different interface when they log in, which sets out CAF-aligned requirements in terms of Objectives, Principles and Outcomes." Everyone else "will retain the current interface and will continue to respond to a list of prescriptive controls, which will be mapped nationally ‘in the background’ against a CAF profile."

What "CAF-aligned" actually means for Category 3 and 4

If you are a care home, community pharmacy, dental practice, optician, or GP practice, you are most likely Category 3 (or Category 4 for GP practices). Here is what the CAF alignment means in practice. (For the narrower question of what CAF alignment means for Category 3 filings specifically, and who has actually moved onto the CAF-aligned view, we have a companion guide.)

1. The toolkit you see is still organised by the ten standards

NHS England's guidance says: "The DSPT is organised under the 10 data security standards. Under each standard there are a number of 'Assertions' which you will need to work through." Its version 8 workbook marks all 36 assertions as unchanged from version 7, and version 9 keeps the same 36. The Category 3 and 4 workbook has no column linking evidence items to CAF principles. NHS England's 2026-27 organisation-type guidance says "Category 1 organisations will view a Cyber Assessment Framework (CAF) aligned view of the DSPT requirements", while for Category 3 "DSP Toolkit view is based on the Category 3 evidence items."

2. The number of mandatory items is broadly similar

For Category 3 organisations, the mandatory set is 45 evidence items in both NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks, up from 43 in version 7; for Category 4 it is 29 in all three. (NHS England states that "the number of mandatory questions are determined by your organisation type", so confirm your own count in the toolkit.)

3. Some items ask for proof, not just a document

This is item by item rather than a change across the toolkit. Item 3.2.1, for example, asks "Have at least 95% of staff, directors, trustees and volunteers in your organisation completed training on data security and protection, and cyber security, in the last twelve months?" A policy will not answer that; a training completion record will.

4. A few evidence items have been added

Version 8 added three optional Category 3 items (7.1.5 and 7.1.6 on the asset register, and 8.3.8 on the NCSC Early Warning service) and made two items mandatory: 4.3.1, the agreement your IT administrators sign, and 7.1.1, the digital asset register. It also removed the Category 3 item asking whether your suppliers have completed a DSPT or equivalent (10.2.5). Version 9 added four more items, none of them mandatory: 1.3.15, 7.1.7, 10.2.6 and 10.2.7.

For a more detailed walk-through of the v8 changes specifically, see our DSPT v8 changes guide.

CAF principles in plain English

Category 3 and 4 organisations will not see CAF labels in the toolkit, but most of the topics will be familiar from the evidence items. The right-hand column is our own pairing, for orientation only; it is not an NHS England mapping.

CAF principle	Plain English	Similar topic in the DSPT evidence items
A1 Governance	Someone is in charge of security and decisions are documented	Senior responsibility, board / partner sign-off on data security
A2 Risk Management	You know what could go wrong and decide what to do about it	Risk register, annual risk review
A3 Asset Management	You know what data and systems you have	Data flow mapping, system inventory
A4 Supply Chain	You know who your suppliers are and what they do for you	IT supplier list, data processing agreements, supplier security assurance
B1 Service protection policies, processes and procedures	You have written policies for your security controls	Data security policy, acceptable use policy, incident response policy
B2 Identity and Access Control	The right people have access to the right things, and only those things	User access reviews, leaver process, role-based access
B3 Data security	Data is protected from unauthorised access — at rest and in transit	Encryption on devices, secure email (NHSmail or equivalent)
B4 System security	Your systems are configured securely and patched	Patching schedule, supported software inventory
B6 Staff awareness and training	Staff know what they need to do and have been trained	Annual data security awareness training, phishing exposure training
D1 Response and recovery planning	You know what to do if something goes wrong	Business continuity plan, incident response plan

The full list of principles is in the NCSC CAF documentation. NHS England's Category 3 and 4 workbook does not show a CAF principle against each item; its CAF-aligned outcome spreadsheet is published for the large organisations only.

How the CAF differs from Cyber Essentials

Many small providers ask whether having Cyber Essentials means they're "done" — or whether the CAF replaces it. The short answer: they are different things, and both still matter.

	Cyber Essentials	Cyber Assessment Framework
Type	Certification scheme	Outcome-based framework
Scope	5 technical control areas	14 principles across 4 objectives
Audience	Any UK organisation, especially SMEs	Public sector + critical national infrastructure
Verification	Annual self-assessment + third-party verified version (CE+)	Self-assessment via DSPT (for NHS organisations) or formal CAF assessment (CNI)
Cost	~£300-£500/year (CE), more for CE+	Free to read; cost is staff time
Use in DSPT	Optional supporting evidence for some evidence items	Basis of NHS England's cyber assurance; presented directly only to Category 1 organisations

Cyber Essentials covers the technical baseline (firewalls, secure configuration, access control, malware protection, patch management). It is genuinely useful and provides clean evidence for several DSPT evidence items. The CAF goes broader — including governance, supply chain, training, and incident response.

If your organisation already has Cyber Essentials, that's a strong starting point. NHS England's version 9 workbook marks six Category 3 evidence items as exempt for organisations with Cyber Essentials PLUS. Read more on Cyber Essentials at ncsc.gov.uk/cyberessentials/overview.

What you actually need to do

If you are completing the DSPT for the first time (or for the first time under version 9), you do not need to study the CAF directly. The relevant work is:

Read the version 9 announcement — dsptoolkit.nhs.uk/News/169. It gives the 30 June 2027 deadline and links to the workbook for your category.
Download the workbook for your category. The Category 3 and Category 4 evidence items are in the version 9 workbook linked from that page. It lists every evidence item and whether it is mandatory for your category.
Use the DSPT structure, not raw CAF documents. Reading the CAF directly will give you a deeper understanding, but it is not required for completion.
Collect evidence by assertion, not by CAF principle. The toolkit shows assertions; collect what each assertion asks for.
Use the standard evidence patterns outlined in our DSPT evidence requirements guide.

For a structured starting point, our evidence checklist generator outputs a categorised list you can work through. The readiness quiz takes ~5 minutes and shows where the biggest gaps are likely to be.

Common misconceptions about the CAF

"CAF-aligned means harder." Not for small providers. Category 3 and 4 organisations still answer evidence items, and the Category 3 mandatory count is 45 in both the version 8 and version 9 workbooks.

"I need to do a full CAF assessment." No. Only Category 1 organisations, such as NHS Trusts and ICBs, see the CAF-aligned view. Category 3 and 4 organisations complete the DSPT evidence items, which NHS England maps to the CAF in the background.

"CAF replaces Cyber Essentials." It doesn't. They serve different purposes. Cyber Essentials remains useful, particularly as supporting evidence for certain DSPT assertions.

"NCSC inspects me." NCSC publishes the CAF and provides technical guidance, but it does not inspect small NHS providers. DSPT submissions are reviewed by NHS England and, for CQC-registered care providers, the CQC may reference your DSPT status during inspections.

FAQ

What is the Cyber Assessment Framework? The Cyber Assessment Framework (CAF) is a set of cyber security principles published by the National Cyber Security Centre (NCSC). It is used across UK critical national infrastructure and the public sector — including by NHS England, which made it the basis for cyber security and IG assurance in the DSPT in September 2024.

Do small NHS providers need to use the CAF directly? No. Only Category 1 organisations, such as NHS Trusts and ICBs, see a CAF-aligned view of the DSPT. Category 3 and Category 4 providers (care homes, pharmacies, dental practices, opticians, GP practices) answer evidence items under the ten National Data Guardian standards, which NHS England maps to a CAF profile in the background.

How is the CAF different from Cyber Essentials? Cyber Essentials is a baseline certification scheme covering five technical controls — useful but narrow. The CAF is a broader, outcome-based framework covering governance, risk management, supply chain, incident response, and more. NHS England uses the CAF as the basis of its cyber assurance, while Cyber Essentials remains useful evidence for some DSPT evidence items.

Where can I read the CAF itself? The CAF is published on ncsc.gov.uk under Collections → Cyber Assessment Framework. The full guidance is freely available, but most small providers do not need to read it directly.

Is the CAF mandatory for the DSPT? The DSPT is mandatory for organisations accessing NHS patient data or systems. For Category 3 and 4 organisations the CAF is not something you complete separately: you answer the DSPT evidence items, and NHS England maps them nationally "in the background" against a CAF profile.

Next steps

Confirm your category — log in to dsptoolkit.nhs.uk. Most small providers will be Category 3 (or Category 4 for GP practices).
Download the version 9 workbook for your category from the version 9 announcement page.
Read our DSPT v8 changes guide for what's actually different from v7 and what to do about it.
Use the evidence checklist generator to get a structured list of what to gather.
Plan your timeline with the deadline calculator.

This guide is based on the NCSC Cyber Assessment Framework and on NHS England's DSPT guidance and workbooks for version 8 (2025/26) and version 9 (2026-27). The CAF is updated periodically — always verify against the official NCSC CAF collection. This is not legal or compliance advice.