CAF 4.0 compliance, made measurable.
CAF-Pilot operationalises the NCSC Cyber Assessment Framework for UK Critical National Infrastructure — structured scoring, evidence mapped to controls, and audit trails that turn months of assessment into weeks.
4
Objectives
14
Principles
41
Contributing Outcomes
~300
IGPs
7-day free trial · no credit card required · setup in minutes
87%
Complete
COs
Tracked
Designed for UK Critical National Infrastructure sectors
Six recurring barriers to CAF compliance
Organisations completing CAF assessments face the same structural barriers regardless of sector — they stem from the tools, not the teams.
External CAF Consultancy
£15K–£50K
typical cost per external engagement
Industry range — findings remain inside the consultant's deliverable
Static Spreadsheet Templates
NCSC spreadsheet templates don't scale for multi-system OT environments.
No Contextual IGP Guidance
Teams must interpret ~300 IGPs without plain-English help or OT-specific context.
Manual Status Rollup
Calculating status across IGPs, Contributing Outcomes, Principles, and Objectives is error-prone.
External Consultancy Dependency
External CAF engagements typically cost £15,000–£50,000 each, with findings that stay inside the consultant's deck.
No Workflow Integration
Assessment findings don't flow into remediation tracking or issue management.
Point-in-Time Only
Spreadsheet-based assessments capture a moment in time with no mechanism for continuous reassessment.
Structured CAF assessment, start to finish
A purpose-built platform that guides your team through the full CAF assessment process — structured guidance, multi-system scoring, and outputs structured for submission.
Guide
Contextual Guidance
Navigate all 41 Contributing Outcomes and ~300 IGPs with plain-English explanations, OT-specific considerations, and evidence examples for every indicator.
- Plain-English explanations
- Why it matters context
- Common evidence types
- OT-specific guidance
Assess
Multi-System Support
Manage assessments across multiple OT systems with automatic status rollup from IGP level through to Contributing Outcome, Principle, and Objective.
- Multi-system tracking
- Automatic rollup logic
- PA/NA distinction
- Evidence referencing
Report
Structured Outputs
Generate PDF and Excel exports structured for regulator submission, with progress dashboards and gap analysis built in.
- PDF reports
- Excel exports
- Progress dashboard
- Gap analysis view
Privileged User Management
| IGP | Sys 1 | Sys 2 | Overall |
|---|---|---|---|
| IGP-B2C-NA01 | |||
| IGP-B2C-NA02 | |||
| IGP-B2C-PA03 |
IGP-B2C-NA02 · Plain-English Guidance
This checks whether privileged access uses generic or shared accounts. Document compensating controls or remediation plans.
Built around the NCSC CAF structure
The full CAF 4.0 hierarchy is built directly into the platform — every Objective, Principle, Contributing Outcome, and IGP organised in one navigable structure.
Governance
3 Contributing Outcomes
Risk Management
2 Contributing Outcomes
Asset Management
2 Contributing Outcomes
Supply Chain
2 Contributing Outcomes
4
Objectives
14
Principles
41
Contributing Outcomes
~300
IGPs
Everything the CAF assessment requires
Each capability is built around the specific demands of a CAF 4.0 assessment — from first IGP to final export.
Plain-English Guidance per IGP
Every Indicator of Good Practice includes a plain-English explanation, OT-specific context, and common evidence examples — so your team knows exactly what is being assessed.
Multi-System Assessment
Assess multiple OT systems within a single assessment, each with their own responses and status. Built for complex CNI infrastructure.
Automatic Status Rollup
Status is calculated automatically from IGP level through Contributing Outcome, Principle, and Objective — based on the CAF logic, not manual formula entry.
PDF and Excel Export
Generate structured PDF and Excel outputs on demand. Formatted for regulator submission — produced in seconds, not days.
Evidence Tracking
Reference policies, documents, and audit evidence against each IGP response. Build a traceable compliance record as the assessment progresses.
Progress Dashboard
Visual progress tracking across all four Objectives with quick navigation to incomplete areas, gaps, and outstanding responses.
All 4 Objectives · 41 Contributing Outcomes · ~300 IGPs
Three steps to assessment-ready output
A structured process from organisation setup through to structured outputs — with guided support at every step.
Set Up Your Organisation
Register your organisation, add your OT systems, and invite team members. Define system types and criticality levels.
- Create organisation profile
- Invite assessors and viewers
- Add OT systems inventory
- Define system criticality
Complete Your Assessment
Work through all 41 Contributing Outcomes and ~300 IGPs with contextual guidance. Record responses, justifications, and evidence per system.
- Navigate by Objective and Principle
- Record PA/NA responses with justification
- Attach evidence per IGP
- Track progress in real time
Generate Your Reports
Export structured PDF and Excel outputs formatted for regulator submission. Use dashboards to identify gaps and remaining work.
- One-click PDF export
- Excel export on demand
- Gap analysis dashboard
- Progress summary view
Designed to compress the CAF cycle
CAF-Pilot is built to take assessments that typically run months of consultancy down to a structured 2–4 week workflow — replacing subjective narrative with measurable, repeatable scoring your team owns.
Weeks, not months
Structured workflow designed to compress what typically runs as a multi-month consultancy cycle into a focused 2–4 week assessment.
Fraction of consultancy cost
External CAF engagements typically cost £15,000–£50,000 each. CAF-Pilot is built to reduce that dependency by putting the assessment process in-house.
100% CAF 4.0 coverage
All 41 Contributing Outcomes and ~300 Indicators of Good Practice are structured and linked in the platform — nothing omitted.
Reports in seconds
PDF and Excel exports generated on demand, structured for regulator submission — not assembled manually from a spreadsheet.
The above describes what CAF-Pilot is designed and built to do. Individual outcomes depend on your organisation's starting point and assessment scope.
From annual assessment to
continuous compliance posture.
Structured, measurable, and defensible — CAF-Pilot gives CNI operators a repeatable way to run CAF and own the result.