In the UK National Cyber Security Centre’s Cyber Assessment Framework (CAF), “security level” means a target level of cyber security and resilience expressed through a CAF profile. It is not a universal numbered ranking or an NCSC certification grade. The relevant cyber oversight body decides what target is appropriate for its sector and the organisations it oversees.
What does “NCSC security levels” mean?
The phrase can refer to different security schemes. In the context of the NCSC’s Cyber Assessment Framework (CAF), it describes a target for how well an organisation protects and sustains its essential functions against cyber risk. CAF is UK guidance, particularly relevant to organisations responsible for essential functions and the bodies that oversee them.
As an Amazon Associate I earn from qualifying purchases.
CAF does not assign every organisation a universal Level 1, Level 2 or Level 3. Instead, it provides a structure for setting and assessing targets that reflect sector requirements, essential functions and relevant risks.
Free tools Windows power users keep installed
One-click scans. No signup required.
How does CAF assess cyber security?
CAF sets out four high-level objectives and 14 principles describing the outcomes an organisation needs to achieve. Those principles are broken into contributing outcomes, with Indicators of Good Practice (IGPs) to help assess them. An assessment determines whether an outcome is achieved, not achieved or, where applicable, partially achieved.
#1 Best Overall
IGPs support informed assessment; they are not a rigid tick-box test. NCSC says assessments require cyber security expertise and sector knowledge, with conclusions shaped by relevant circumstances. In the IGP tables, GREEN generally describes typical characteristics of full achievement, RED of non-achievement, and AMBER, where provided, of partial achievement that delivers specific worthwhile benefits.
What is a CAF profile?
A CAF profile is a selected subset of contributing outcomes used to express a target. Depending on the target, outcomes may be designated for achievement, partial achievement or not applicable when a capability is not appropriate at that profile level. Profiles can be tailored to a sector.
The relevant cyber oversight body decides how to interpret CAF results and which target is appropriate and proportionate. NCSC provides the framework but does not mandate one target for all organisations. If your organisation is subject to regulation, ask your regulator whether and how CAF applies to its requirements.
How should you interpret the level of a CAF target?
NCSC’s CAF introduction, reviewed on 6 August 2025, offers context rather than a universal ladder. It says that achieving all 41 contributing outcomes would indicate cyber security “some way beyond the bare minimum ‘basic cyber hygiene’ level.” It also notes that an oversight body may set targets in relation to categories of attack, giving “basic capability attacks” and “moderate capability attacks” as examples.
Rank #3
These examples do not define standard levels that apply across sectors. They illustrate how a body might describe the ambition or threat assumptions behind a target. The target’s meaning depends on the profile and the sector context in which it is used.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to compare two CAF profiles
If you need to compare profiles, examine the targets themselves rather than treating them as interchangeable rankings. Compare:
- Which contributing outcomes each profile includes.
- Which outcomes must be achieved, may be partially achieved, or are not applicable.
- Which essential functions and sector risks the profiles address.
- What attack capability or risk assumptions underpin each target.
CAF assessments may be carried out by the responsible organisation or by an independent external entity, including a suitably qualified organisation acting for a regulator. Whether external assessment is required depends on the applicable oversight or regulatory arrangements.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
