--- title: "CAF 4.0 Explained: What's new and why it matters" description: Explore the latest updates to NCSC's Cyber Assessment Framework (CAF) and the key actions needed to align. image: https://csacyber.com/hubfs/large-CAF%20image.jpg --- [Skip to content](https://csacyber.com/blog/caf-4.0-explained#main-content) [![CSA Cyber - Cyber Security Solutions to Protect your People](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=300&height=108&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber - Cyber Security Solutions to Protect your People")](https://csacyber.com/) - Services - [Offensive Security Services](https://csacyber.com/offensive-security-services) - [Penetration Testing](https://csacyber.com/penetration-testing) - [Red Teaming and attack simulations](https://csacyber.com/offensive-security-services#red-teaming) - [Continuous testing](https://csacyber.com/offensive-security-services#continuous-assurance) - [Managed offensive security](https://csacyber.com/offensive-security-services#managed-offensive) - [Consultancy Services](https://csacyber.com/cyber-consultancy-services) - [Frameworks & assessments](https://csacyber.com/cyber-consultancy-services/frameworks-and-assessments) - [Data protection](https://csacyber.com/cyber-consultancy-services#data-protection) - [Virtual leadership](https://csacyber.com/cyber-consultancy-services#virtual-leadership) - [Technical security consulting](https://csacyber.com/cyber-consultancy-services#technical-consultancy) - [Governance, Risk & Compliance (GRC)](https://csacyber.com/cyber-consultancy-services/governance-risk-and-compliance-services) - [Extended Managed Security Services](https://csacyber.com/extended-managed-security-services) - [Microsoft Sentinel SIEM](https://csacyber.com/extended-managed-security-services#microsoft-sentinel) - [SOC services](https://csacyber.com/extended-managed-security-services#soc-services) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/extended-managed-security-services#cyber-helpdesk) - [Incident Response Services](https://csacyber.com/incident-response-services) - [Emergency Incident Response](https://csacyber.com/urgent/emergency-incident-response) - [Incident Response Retainer](https://csacyber.com/incident-response-services) - [Cyber Incident Readiness & Response Planning](https://csacyber.com/incident-response-services) - [Tabletop Exercises & Live-Range Engagements](https://csacyber.com/incident-response-services) - [Specialist Security Services](https://csacyber.com/specialist-services) - [AI Security](https://csacyber.com/cyber-services-for-ai) - [Operational Technology (OT)](https://csacyber.com/specialist-services#operational-technology) - [Cyber security for Private Equity](https://csacyber.com/specialist-services#mergers-and-acquisitions) - [Cyber training and education](https://csacyber.com/specialist-services#training-and-education) - [Virtual leadership](https://csacyber.com/specialist-services#leadership) - [Cyber Technologies](https://csacyber.com/cyber-technologies) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/cyber-technologies#sentinelone) - [AppGuard Endpoint & Server Zero Trust Protection](https://csacyber.com/cyber-technologies#appguard) - [Qualys Vulnerability Management as a Service (VMaaS)](https://csacyber.com/cyber-technologies#qualys-vmaas) - [Lookout Mobile Device Protection](https://csacyber.com/cyber-technologies#lookout) - [ThreatER DNS Protection](https://csacyber.com/cyber-technologies#threater-dns) - [Cyber Security Awareness & Training platform](https://csacyber.com/cyber-technologies#boxphish) - [About](https://csacyber.com/about-us) - [Careers](https://csacyber.com/careers) - [Certifications](https://csacyber.com/certifications-and-awards) - [Blog](https://csacyber.com/blog) - [Support Centre](https://csacyber.com/support) - Resources - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Partners](https://csacyber.com/partners) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) - [Contact](https://csacyber.com/contact-us) - Search Search Search September 2, 2025 4 min read time # CAF 4.0 Explained: What's new and why it matters Explore the key updates in CAF 4.0, from threat hunting to secure software development, and learn the action your organisation must take to align with evolving cyber resilience standards. ![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=48&height=48&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) [Written by: CSA Cyber -](https://csacyber.com/blog/author/csa-cyber) [Consultancy](https://csacyber.com/blog/tag/consultancy) ![](https://csacyber.com/hubfs/large-CAF%20image.jpg) The NCSC have recently released version 4.0 of the Cyber Assessment Framework (CAF), a common framework to enable organisations to conduct cyber resilience assessments using an outcome-focussed approach. This quick reference article provides an update on the key additions in CAF 4.0 versus its predecessor; version 3.2. ### Key updates to CAF 4.0 ##### *Proactive threat hunting* Version 4.0 focusses much more on ensuring **organisations have a deeper understanding and organisational skillset in actively finding cyber threats** ***before* they have the chance of developing into a full-scale event**. We can see this with the contributing outcome ‘Threat hunting’ replacing the previous objective  ‘Proactive attack discovery’, with a greater emphasis on ensuring resources are assigned to proactively identifying and analysing threats to the organisation’s essential functions. > Action: Review threat hunting capabilities, ensuring sufficient resources and skillsets are in place to proactively identify and analyse threats to essential functions.   ##### *Understanding threats* Building on proactive threat hunting is an updated emphasis on principle 'A2.b: Understanding threat'. This reinforces the need for organisations to not simply be aware of cyber threats, but to **demonstrate a clear grasp of how threat actors could impact essential services**. It brings threat intelligence to the forefront, requiring organisations to not just consume intelligence but to operationalise it, **aligning intelligence feeds** to their environment, using it **to inform decisions, prioritise vulnerabilities and feed back into security operations**. By gaining a clearer understanding of how cyber threats could impact your essential functions, you can fine-tune your threat intelligence tools to become far more effective. If this capability isn’t in place yet, now is the time to look at threat management tools, proactive hunting and stronger security culture to help close this gap. > Action: Establish robust processes to identify, analyse and build detection and response capabilities based on the outputs of threat hunting activities.   [![CAF guide cover](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/26027287/interactive-270072089836.png)](https://csacyber.com/hs/cta/wi/redirect?encryptedPayload=AVxigLIasFEeFS7eo%2FumXN3gyHpqjTLYtHhzQvUTrd%2Fl9aJws%2FWFNCKBcpvurnEGCPQP1lvJNdnqwFkJO1PeW2gbZPvGd68P2zgI1KVKgsNYueT%2Baf2rVw1iEdq%2FTUuLoV%2BzZpqbGSUd56LvIIxNKkIl81dzro8gcO67OtxckVNNKTexDIwZe97%2F9wbSH4%2BpBk5EzsHu3Q3CVQYu2Ao2LFXhJ6wo&webInteractiveContentId=270072089836&portalId=26027287) ##### *Supply chain & third-party risk* CAF 4.0 principle 'A4.a: Supply chain' places greater emphasis on how well organisations understand and manage the cyber risks posed by their suppliers. Rather than simply having SLAs in place, organisations must now be able to **evidence how third-party access, platforms and software suppliers are assessed, monitored and incorporated** into security operations. Moving on from CAF 3.2 where supplier due diligence was present but more narrowly scoped., the additions made within various indicators of good practice (IGPs) will mean **improving due diligence processes** and having a structured third-party assurance model in place. > Action: Implement structured third-party risk management and that conduct thorough supplier due diligence.   ##### *Secure software development* Finally, a large-scale change from CAF 3.2 comes the formal recognition of secure software development practices. **CAF 4.0 introduces explicit expectations within principle ‘A4.b: Secure software development and support’ around how software is built and maintained**, not just procured. This means secure coding, regular code review, vulnerability scanning and development pipelines that **prioritise security from the outset**. Where CAF 3.2 largely focused on operational controls, CAF 4.0 calls for security to be embedded in the design and development lifecycle. This may challenge organisations who rely on third parties or legacy development practices, but it also presents an opportunity to align development and security under one strategic roof. > Action: Ensure secure development practices are defined, communicated and embedded.   ### Why this matters CAF 4.0 gives organisations a more targeted approach to security management and shifts to **a truly proactive security culture**. The focus is now squarely on **looking ahead**, **identifying future risks** to your essential functions and **staying one step ahead** of the threats targeting them. Most importantly, for organisations likely to fall under NIS2 as operators of essential services, CAF 4.0 is the ideal foundation. Using it now as a benchmark for best practice will make future compliance with competent authorities far easier.   ### What should organisations do next? With the number of changes across controls, and the updated language in the IGPs, it's essential that internal cyber and information security programmes are brought in line with this new edition. For most, this will mean refreshing internal procedures and policies to demonstrate compliance. The most effective route for gaining a complete understanding? **Conducting a structured CAF Gap Analysis.** This will offer a clear roadmap and remediation plan to close the gaps and embed CAF 4.0. By acting early on, organisations are far less likely to be caught out in a threat environment that is constantly evolving alongside compliance regimes that are looking at moving cyber security to a more proactive, community focused footing. If you could benefit from support with a CAF Gap Analysis, [CSA Cyber is here to help](https://csacyber.com/ncsc-cyber-assessment-framework#enquiry).   ### Conclusion CAF 4.0 marks a significant shift in how organisations must approach cyber resilience, moving from reactive compliance to proactive, intelligence-led security. With new expectations around threat hunting, secure development, and supply chain assurance, aligning with the framework is no longer optional for those operating in regulated sectors. By understanding these changes and acting early, organisations can not only meet the standard but build lasting resilience against evolving threats.     #### CAF 4.0 demands immediate attention These updates that could leave previously compliant organisations exposed, making reassessment essential. If you're unsure where to begin, CSA Cyber’s ASSURE-accredited consultants are here to help. From gap analysis to remediation planning, we’ll guide you through every step of CAF 4.0 alignment. [Book a free discovery consultation](https://csacyber.com/ncsc-cyber-assessment-framework#enquiry) or click here to [learn more about our CAF consultancy services](https://csacyber.com/ncsc-cyber-assessment-framework). Related Posts ## You may also like this [Similar Articles](https://csacyber.com/blog) [![](https://csacyber.com/hs-fs/hubfs/20230510-N1005919-Edit1.jpg?width=624&height=427&name=20230510-N1005919-Edit1.jpg)](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) August 24, 2026 2 min read ### [FluidOne Group appoints Charly Davis as Managing Director of CSA Cyber to advance its security-first strategy](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) Experienced industry leader joins FluidOne to strengthen integrated cyber, IT and secure networking... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![](https://csacyber.com/hs-fs/hubfs/Untitled%20design.jpg?width=624&height=427&name=Untitled%20design.jpg)](https://csacyber.com/blog/csa-cyber-and-fluidone-named-as-suppliers-on-g-cloud-15) August 20, 2026 9 min read ### [CSA Cyber and FluidOne named as suppliers on G-Cloud 15](https://csacyber.com/blog/csa-cyber-and-fluidone-named-as-suppliers-on-g-cloud-15) CSA Cyber (CSA), part of the FluidOne Group, has been named as a supplier on Government Commercial... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![](https://csacyber.com/hs-fs/hubfs/Engineered%20to%20Endure%20Campaign%20Assets%20(2).png?width=624&height=427&name=Engineered%20to%20Endure%20Campaign%20Assets%20(2).png)](https://csacyber.com/blog/why-organisations-lose-security-visibility-without-realising-it) August 20, 2026 6 min read ### [Why organisations lose security visibility without realising it](https://csacyber.com/blog/why-organisations-lose-security-visibility-without-realising-it) Before an organisation can understand risk, maintain control or respond effectively to emerging... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![CSA Cyber Logo FNL\_Full Logo](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=3463&height=1248&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber Logo FNL_Full Logo")](https://csacyber.com/) Established in 2013, Cyber Security Associates Limited trading as CSA Cyber provides cyber consultancy and cyber managed services which help to detect, protect and educate against the ever-changing cyber threat. We have built our team from a foundation of Government (ex-Military) and Commercially experienced specialists all holding current and relevant cyber certifications. Today our core services are based around a 24/7 Security Operations Centre (SOC) based in Gloucester. #### News & Resources - [Blog](https://csacyber.com/blog) - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Careers](https://csacyber.com/careers) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) #### Quick Links - [About Us](https://csacyber.com/about-us) - [Certifications](https://csacyber.com/certifications-and-awards) - [Our Parent Company](https://www.fluidone.com) - [Partners](https://csacyber.com/partners) - [Contact Us](https://csacyber.com/contact-us) - [Anti Bribery Policy](https://csacyber.com/hubfs/CSAAnti-BriberyPolicy.pdf) - [Complaints Policy](https://csacyber.com/hubfs/CSAComplaintsPolicy.pdf) - [Corporate Social Responsibility Policy](https://csacyber.com/hubfs/CSACorporateSocialResponsibilityPolicy.pdf) - [Slavery and Human Trafficking Statement](https://csacyber.com/hubfs/CSASlaveryandHumanTraffickingStatement.pdf) - [NCSC CHECK Status Verification](https://www.ncsc.gov.uk/organisation/csa-cyber/check-penetration-testing) - [CREST Approved Certification Verification](https://www.crest-approved.org/member_companies/csa-cyber/) #### Contact Information **United Kingdom - London** Cyber Security Associates Ltd 5 Hatfields, London, SE1 9PG   **United Kingdom - Gloucester** Cyber Security Associates Ltd Unit 11, Wheatstone Court, Waterwells Business Park, GL2 2AQ   **Phone:** [+44(0) 300 303 4691](tel:03003034691) **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   **United States of America** Cyber Security Associates Inc. 6010 W. Spring Creek Pkwy, Plano, Texas, 75024   **Phone:** [+1 469 750 1695](tel:14697501695)  **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   [![trust-pilot](https://csacyber.com/hs-fs/hubfs/trust-pilot.png?width=178&height=104&name=trust-pilot.png)](https://uk.trustpilot.com/review/csa.limited)   --- - [Website Terms of Use](https://csacyber.com/website-terms-of-use) - [Website Privacy Policy](https://csacyber.com/privacy-notice) - [Website Cookie Policy](https://csacyber.com/cookie-policy) Copyright 2026. Cyber Security Associates Ltd [Follow us on Facebook](https://www.facebook.com/CSALIMITED/) [Follow us on LinkedIn](https://www.linkedin.com/company/csa-cyber/) [Follow us on Twitter](https://twitter.com/cybersecurityis) [Follow us on Facebook](https://www.youtube.com/@cybersecurityassociateslim) [Follow us on Facebook](https://www.instagram.com/cybersecurityassociates) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "CSA Cyber", "url" : "https://csacyber.com/blog/author/csa-cyber" }, "dateModified" : "2025-09-02T08:36:04.247Z", "datePublished" : "2025-09-02T08:36:04.000Z", "headline" : "CAF 4.0 Explained: What's new and why it matters", "image" : [ "https://csacyber.com/hubfs/large-CAF%20image.jpg" ], "mainEntityOfPage" : { "@id" : "https://csacyber.com/blog/caf-4.0-explained", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://csacyber.com/hubfs/csacyber-logo-black-01.svg" }, "name" : "Cyber Security Associates Ltd" } } ```