Framework-native reporting
Recognisable CAF structure, traceable assessment direction
Aegis101 uses the CAF hierarchy to organise screening signals and follow-up without translating the framework into generic Core risk labels. Users can see what contributed to the view and what still requires evidence, applicability review or competent judgement.
- Framework
- NCSC CAF v4.0
- Objectives
- 4
- Principles
- 14
- Contributing outcomes
- 41
On this tour
Framework hierarchy
The report retains the CAF outcome structure
Framework confidence starts with recognisable organisation. Aegis101 groups the 41 contributing outcomes beneath the correct principles and objectives rather than flattening them into a generic control list.
Managing security risk
A1 Governance · A2 Risk Management · A3 Asset Management · A4 Supply Chain
Protecting against cyber attacks
B1 Service protection policies, processes and procedures · B2 Identity and Access Control · B3 Data security · B4 System security · B5 Resilient networks and systems · B6 Staff awareness and training
Detecting cyber security events
C1 Security Monitoring · C2 Threat Hunting
Minimising the impact of cyber security incidents
D1 Response and recovery planning · D2 Lessons Learned
Outcome overview
Coverage and outstanding status are shown without being mistaken for achievement
The overview separates outcomes with a usable mapped answer basis from gaps, partial indications and insufficient information. Unresolved mapped controls remain Not Assessed in an interim view and provide a direct completion route; they do not become a favourable CAF position.
Mapped answer basis
Trace each indication back to what shaped it
A framework view earns confidence when users can understand the route from recorded answers to the outcome requiring review.
The submitted basis remains visible and uncertainty is retained.
The response contributes only where a reviewed mapping exists.
The result identifies a concern, partial signal or insufficient basis.
The report identifies what should be reviewed next.
A1.a Board Direction
Objective A · Principle A1 Governance
- Screening indication
- Gap indicated from the mapped answer basis.
- Mapped concern
- Senior ownership, accountability and reporting for the essential function are not sufficiently evidenced.
- Evidence direction
- Review board-level direction, accountable ownership, governance reporting, decision records and escalation routes.
- Judgement boundary
- Confirm scope, applicability, IGP interpretation and evidence before assigning any CAF outcome judgement.
Indicators of Good Practice
Use CAF reference language without claiming the outcome
Relevant IGP direction helps users understand the characteristics to examine. A mapped direction highlights the reference column requiring attention; it is not an Aegis101 declaration that the contributing outcome has been achieved, partially achieved or not achieved.
In this illustrative A1.a example, the mapped answer basis is reviewed against the native Not Achieved and Achieved reference characteristics. Aegis101 does not add a Partially Achieved state where the CAF v4 outcome does not define one.
Reference characteristics indicating that the expected governance outcome is materially absent or ineffective.
Reference characteristics describing the expected outcome operating with clear ownership, direction and review.
CAF-specific follow-up
Turn contributing outcomes into governed next steps
The CAF action plan does not reuse Core severity swim lanes. It groups contributing outcomes by the type of framework work required.
Treatment and control improvement
Address mapped weaknesses, assign ownership and connect remediation to the affected contributing outcomes.
Evidence and judgement review
Gather evidence, assess relevant IGPs and record the competent judgement supporting the outcome position.
Applicability and exception decision
Record why an outcome or indicator is not applicable and how compensating measures or accepted exceptions are governed.
Sustain and reassess
Retain evidence, monitor the operating position and refresh the mapped view after material change or treatment.
Evidence and confidence
Show what is known, what is missing and what requires judgement
The framework view keeps response completeness, mapped coverage, evidence validation, target-profile context and formal outcome judgement separate.
Define the essential function, supporting systems, dependencies and organisational scope before relying on the mapped view.
Identify whether policies, records, tests, monitoring outputs and other artefacts have been reviewed or remain unvalidated.
Show whether a target profile has been supplied; do not infer the appropriate target for an organisation or sector.
Retain CAF version context and assessment history. Authorised users can rerun eligible assessments after change and compare only compatible governed framework bases they can access.
Aegis101 provides an NCSC CAF v4 mapped screening view and direction for further review. It does not provide an NCSC-approved assessment, regulatory decision, audit, certification, evidence validation or assigned CAF achievement judgement.
Discuss CAF within your assessment programme
Register interest to discuss your essential-function context, framework priorities and the report outputs needed by your stakeholders.