The NCSC Cyber Assessment Framework (CAF) is the yardstick UK regulators use to judge whether a critical infrastructure operator manages cyber risk well enough to keep essential services running. This guide breaks down what CAF for critical infrastructure actually demands, which approaches hold up under regulator scrutiny in 2026, and where operators waste months chasing the wrong evidence.
Why this matters
Operators of essential services (OES) under the NIS Regulations - energy, transport, health, drinking water, and digital infrastructure - get assessed against CAF by a competent authority, not by a certification body. There's no pass/fail certificate at the end. Instead, each of the 14 principles across CAF's four objectives (A: Managing security risk, B: Protecting against cyber attack, C: Detecting cyber security events, D: Minimising the impact of incidents) gets scored against indicators of good practice as achieved, partially achieved, or not achieved.
That scoring model is why so many operators struggle in 2026: CAF rewards demonstrated, evidenced practice over policy documents sitting in a drive. A NIST CSF adoption approach for critical infrastructure suppliers gives you a head start because the two frameworks share structural DNA - CAF's four objectives map cleanly onto NIST CSF's core functions.
Get the mapping wrong and you spend 2026 re-collecting the same evidence for three different frameworks. Get it right and CAF becomes a byproduct of work you're already doing for ISO 27001 or SOC 2.
Who this is for
This is for security and compliance leads at operators of essential services - water companies, energy suppliers, NHS trusts and their major suppliers, transport operators, and digital infrastructure providers - who've been told a CAF assessment is coming and need to know what "good" looks like before the competent authority calls. It's also relevant to critical infrastructure suppliers who inherit CAF-adjacent obligations through contracts, even if they're not the OES themselves.
What to look for in a CAF approach for critical infrastructure
Coverage of all four CAF objectives
An approach that only covers Objective A (governance) or Objective B (technical controls) leaves gaps regulators will find immediately. CAF assessments in 2026 expect evidence spanning risk management, protective controls, detection capability, and incident response - all four objectives, not the easy ones.
Evidence mapped to indicators of good practice
Regulators score against specific indicators, not general statements of intent. A policy that says "we manage supplier risk" scores nothing without evidence tied to the actual indicator wording - contracts reviewed, risk assessments dated, remediation tracked.
Regulator-ready reporting format
Competent authorities - ICO, Ofgem, ORR, ONR, depending on sector - expect submissions in a format they can score quickly. An approach that produces a narrative report instead of an indicator-by-indicator breakdown adds weeks to the review cycle.
Supply chain and third-party risk visibility
Critical infrastructure operators run on supplier networks, and CAF Objective A explicitly covers supply chain risk. If you can't show which suppliers touch essential service delivery and how their risk is assessed, that's an automatic gap.
Continuous evidence over annual snapshot
CAF assessments increasingly penalise point-in-time evidence. A firewall rule change three months after your last review, with no record of who approved it, reads as a control gap even if the change itself was sound.
Top picks for CAF alignment in 2026
The crosswalk pick. Mapping CAF's 14 principles onto an existing NIST CSF adoption programme for critical infrastructure suppliers means one evidence base serves two frameworks. The concrete win: CAF's four objectives (A-D) align almost one-to-one with NIST CSF's five functions, so duplicate evidence collection drops close to zero once the mapping is built. Verdict: Buy.
The procurement-side pick. For operators whose CAF exposure comes through public sector contracts rather than direct OES status, vendor risk management software built for public sector procurement closes the supply chain visibility gap fast. It won't cover Objectives B-D on its own, but it fixes the weakest spot in most 2026 CAF submissions. Verdict: Consider.
The framework-first pick. If CAF is your first serious compliance push and you're not sure whether to start with ISO 27001, SOC 2, or CAF itself, a framework selection process prevents you building evidence structures you'll rebuild in six months. Useful, but it's a planning step, not an evidence engine. Verdict: Consider.
The continuous-monitoring pick. Running continuous monitoring without adding headcount solves Objective C almost entirely - detection evidence needs to be live, not annual. This is the single highest-leverage move for operators already stretched thin on security staff. Verdict: Buy.
The sector-specific pick. NHS suppliers pursuing Cyber Essentials Plus alongside CAF-adjacent obligations often try to make one certificate cover both. It helps with Objective B controls but says nothing about Objectives A, C, or D on its own. Verdict: Consider - treat it as one input, not the whole submission.
What to avoid
- Treating CAF as a one-off audit. CAF assessments recur, and competent authorities expect year-on-year improvement in indicator scores, not a static submission copied forward.
- Using an ISO 27001 certificate as substitute evidence. ISO 27001 certification demonstrates a management system exists; CAF wants proof specific indicators are met, which is a narrower and more detailed ask.
- Answering with generic security questionnaires. Standard vendor questionnaires don't map to CAF's indicator language, so reviewers have to translate your answers themselves - and that's where scores drop.
Automate your CAF evidence base
OneClickComply handles cross-framework evidence collection end-to-end.
Verdict comparison
| Approach | Objective coverage | Evidence format | Supply chain visibility | Verdict |
|---|---|---|---|---|
| NIST CSF crosswalk | A-D | Indicator-mapped | Moderate | Buy |
| Vendor risk software (public sector) | A only | Structured | Strong | Consider |
| Framework-first planning | Planning stage | N/A | N/A | Consider |
| Continuous monitoring | C, partial D | Live/continuous | Weak alone | Buy |
| Cyber Essentials Plus (sector) | B only | Certificate | Weak | Consider |
Frequently asked questions
One last thing
Most CAF submissions that score poorly in 2026 don't fail on technical controls - they fail on Objective A's supply chain indicators, because operators can name their suppliers but can't show when each one was last risk-assessed. Fix the dated evidence trail on vendors before touching anything else.