CAF Skills
CAF Skills Framework
What is CAF Skills
The CAF Skills Framework defines the professional skills and competence people need to deliver the outcomes of the NCSC Cyber Assessment Framework (CAF). It provides a structured, level-based model that helps organisations describe, assess, and develop the cyber capability behind their CAF self-assessments with clarity and consistency.
CAF Skills links each CAF objective (managing security risk, protecting against cyber attack, detecting cyber security events, and minimising the impact of incidents) to the roles, behaviours and capabilities needed to achieve it. This makes it especially relevant to operators of essential services, critical national infrastructure and public sector bodies that report against the CAF.
What CAF Skills does
CAF Skills provides organisations with a clear, structured language for the cyber competence behind their CAF outcomes.
CAF Skills can be mapped to other professional skills frameworks, including SFIA and the CIISec Skills Framework, where roles intersect with security architecture, operations, risk, and assurance disciplines.
Defines competence
Defines competence across all four CAF objectives, from governance and risk management through protection, detection, and incident response.
Professional levels
Provides clear professional levels, from practitioner through to senior leadership.
Role profiles
Supports role profiles, assessment, and capability development.
Assurance of CAF capability
Enables evidence-based, audit-ready assurance that your people can meet your CAF outcomes.