Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In the UK National Cyber Security Centre’s Cyber Assessment Framework (CAF), a “security level” means a target for an organisation’s cyber security and resilience—not a universal NCSC grade or numbered tier. The relevant cyber oversight body sets the target for its sector by selecting CAF outcomes in a profile. The CAF helps assess whether those outcomes are achieved, partially achieved, or not applicable.
What “NCSC security levels” means in the CAF
The term can refer to different security schemes. In the CAF context, it describes a target level of cyber security and resilience for an organisation or sector, expressed through a CAF profile. The framework is intended to assess how an organisation manages cyber risks to its essential functions. It is UK guidance focused on organisations responsible for essential functions and the bodies that oversee them.
The NCSC’s CAF introduction describes four high-level objectives and 14 principles. These set out outcomes to achieve, rather than prescribing a single checklist of actions. The principles are broken down into contributing outcomes, which are assessed using Indicators of Good Practice (IGPs).
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →How a CAF assessment determines whether outcomes are achieved
An assessment considers each relevant contributing outcome as achieved, not achieved, or, where the outcome allows it, partially achieved. IGPs describe characteristics that can help assessors make that judgement; they are not intended as an inflexible tick-box test. The NCSC says assessments require cyber security expertise and sector knowledge, with conclusions taking the organisation’s circumstances into account.
#1 Best Overall
- Achieved: The outcome is met. In the IGP tables, green characteristics typically indicate full achievement.
- Partially achieved: The outcome is met in part, where partial achievement is applicable. Amber characteristics should reflect specific, worthwhile benefits.
- Not achieved: The outcome is not met. Red characteristics typically indicate non-achievement.
These descriptions inform professional judgement; an assessor should consider the evidence and context rather than treating a colour or indicator as a score by itself.
What a CAF profile contains
A CAF profile selects a subset of contributing outcomes to express a target. Depending on the profile, selected outcomes may need to be achieved, may be set for partial achievement, or may be marked not applicable when a capability is not appropriate at that profile level. Profiles can be tailored to a sector.
Because profiles may select different outcomes and set different target states, two profiles are not automatically comparable as if they were steps on one universal ladder. When comparing actual profiles, examine:
- Which contributing outcomes each profile includes.
- Which outcomes must be achieved, partially achieved, or are not applicable.
- Which essential functions and sector risks the profile addresses.
- The attack-capability or risk assumptions behind each target.
Who sets the target security level?
The relevant cyber oversight body decides how CAF results are interpreted and what target is appropriate and proportionate for the organisations in its sector. The NCSC provides the framework; it does not mandate one target for every organisation. Organisations subject to regulation should ask their regulator whether and how CAF applies to their regulatory requirements.
Rank #3
The NCSC’s CAF introduction, reviewed on 6 August 2025, says that if all 41 contributing outcomes were assessed as achieved, the result would indicate a level “some way beyond the bare minimum ‘basic cyber hygiene’ level.” This is a reference point about the framework’s outcomes, not a universal tier or certification grade. The NCSC also gives basic-capability and moderate-capability attacks as examples of categories an oversight body might use when setting targets; these are examples, not standard levels assigned to every organisation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What a CAF security level does not mean
- It is not a fixed NCSC ranking such as Level 1, Level 2, or Level 3 that applies to all organisations.
- It is not, by itself, a universal certification grade.
- It does not mean every organisation must achieve all 41 contributing outcomes; the relevant target profile determines which outcomes apply and the required state.
- It does not replace sector-specific regulatory interpretation. The oversight body determines the appropriate and proportionate target.
For the current framework wording and context, consult the NCSC CAF introduction. It identifies CAF 4.0, published on 18 April 2024 and reviewed on 6 August 2025.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
