Prepare your CAP 1850 CAF for Aviation self-assessment with confidence

CAP 1850 is the UK Civil Aviation Authority's guidance on completing the Cyber Assessment Framework (CAF) for Aviation and the Statement of Assurance. The CAF for Aviation was developed with the Department for Transport and the NCSC and adapted from the NCSC CAF v3.0. It assesses an aviation organisation's cyber security against 14 principles and 39 contributing outcomes, using Indicators of Good Practice rather than a fixed checklist.

Aviation organisations that the CAA notifies into its cyber security oversight process under CAP 1753 must complete the CAF for Aviation. This covers Tier 1 operators of essential services under the NIS Regulations 2018 and directed UK aerodromes and air carriers in Tiers 2 and 3. The CAA notifies organisations formally and assigns each one a profile setting the outcomes it is expected to achieve.

The four objectives are A, managing security risk; B, protecting against cyber attack; C, detecting cyber security events; and D, minimising the impact of cyber security incidents. They contain 14 principles, from A1 Governance to D2 Lessons learned, which break down into 39 contributing outcomes. Each outcome is judged Achieved, Partially Achieved or Not Achieved against Indicators of Good Practice.

An ASSURE cyber audit is the independent, evidence-based review of an aviation organisation's completed CAF for Aviation, carried out by a CAA-approved ASSURE cyber supplier. The auditor gives their own assessment for each contributing outcome and records whether the evidence supplied is acceptable. Gaps between the audit result and the CAA-assigned profile feed into a corrective action plan.

No. The CAA states that it does not expect every aviation organisation to score Achieved for each contributing outcome. Instead, it assigns each organisation an expected profile based on its tier and complexity. Where the audit falls short of that profile, the organisation develops a corrective action plan with risk assessments, owners, resourcing and target completion dates.

CAP 1850 and ISO 27001 overlap but are not the same. The CAF for Aviation is an outcome-based assessment used for CAA oversight, while ISO 27001 is a certifiable management system standard. CAP 1850 lists ISO/IEC 27001 and 27002 among its informative references, so an existing ISO 27001 programme can supply much of the evidence for the CAF, but it does not replace the CAA process.

There is no single fixed duration. Timelines depend on the number of critical systems in scope, the profile the CAA assigns and the milestones set out in your engagement letter under CAP 1753. Organisations scope critical systems first, complete the self-assessment, procure the ASSURE cyber audit and then agree a corrective action plan, so starting evidence collection early helps.

Yes, on request. CAP 1850 is mapped in OneClickComply's control library and is available on request rather than as a standard framework today. Once enabled, you can track the 14 CAF for Aviation principles against your controls, collect evidence automatically and get guidance from our in-house auditors. OneClickComply does not perform ASSURE cyber audits or replace CAA oversight.