The CAF and NIS2: one architecture, two regulatory regimes

The UK and the EU started from the same place. Both regimes trace back to the EU's original NIS Directive of 2016; the UK implemented it as the NIS Regulations 2018, and the EU has since replaced it with NIS2. Today they're related but separate — and plenty of organisations, especially those providing services in both markets, have to satisfy both.

The UK: the NCSC Cyber Assessment Framework

The CAF is the NCSC's tool "to help organisations assess and improve their cyber security and resilience", aimed at organisations subject to the NIS Regulations, the wider critical national infrastructure, and public sector bodies supporting core government functions. Version 4.0 was released in August 2025.

It's built from four objectives and fourteen principles:

• A — Managing security risk: A1 Governance, A2 Risk management, A3 Asset management, A4 Supply chain.
• B — Protecting against cyber attacks: B1 Service protection policies, processes and procedures, B2 Identity and access control, B3 Data security, B4 System security, B5 Resilient networks and systems, B6 Staff awareness and training.
• C — Detecting cyber security events: C1 Security monitoring, C2 Threat hunting.
• D — Minimising the impact of cyber security incidents: D1 Response and recovery planning, D2 Lessons learned.

Each principle breaks into contributing outcomes, judged Achieved, Partially achieved or Not achieved using indicators of good practice. The NCSC is explicit that the CAF is meant to stay outcome-focused and to "discourage assessments being carried out as tick-box exercises".

The UK regime is also changing: the Cyber Security and Resilience Bill, introduced to Parliament on 12 November 2025, will "reform and add to" the NIS Regulations 2018. It was still going through Parliament when this was written, so check its status before relying on the detail.

The EU: NIS2

NIS2 — Directive (EU) 2022/2555, which repealed the original NIS Directive — had to be transposed into national law by 17 October 2024. It covers essential and important entities across 18 sectors, generally medium-sized and larger organisations that "provide their services or carry out their activities within the Union". That last phrase is why UK organisations serving EU customers can find themselves in scope.

Four articles do most of the work:

• Article 20 — governance. Management bodies must approve the cybersecurity risk-management measures, oversee their implementation, can be held liable for infringements, and are required to follow training.
• Article 21 — risk management. "Appropriate and proportionate technical, operational and organisational measures", based on an all-hazards approach, including at least ten areas from risk-analysis policies and incident handling to supply chain security, cryptography and multi-factor authentication.
• Article 23 — reporting. For significant incidents: an early warning within 24 hours, an incident notification within 72 hours, and a final report no later than one month after that notification.
• Article 34 — fines. Member States must allow maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher.

How they line up

Both regimes are outcome- and risk-based rather than prescriptive, which makes them easier to reconcile than they look. This is my working mapping of NIS2's Article 21(2) measures to CAF principles — a practical starting point, not an official crosswalk:

Two things stand out. First, NIS2's reporting deadlines have no single CAF equivalent — they depend on C1 monitoring, D1 response planning and A1 decision rights all working together inside 24 hours. Second, both regimes put the board on the hook: CAF A1 and NIS2 Article 20 are asking the same question about who is accountable.

Building once with SABSA

The mistake I see is running the CAF and NIS2 as two compliance projects with two evidence sets. SABSA gives you a better shape:

1. Contextual layer: record both regimes as business drivers, alongside the essential services they protect. The CAF's focus on essential functions is already a contextual-layer idea.
2. Attributes: turn the obligations into attributes with measures — "governed at board level", "supply-chain assured", "recoverable within the agreed time", and one I usually call "reportable": able to issue an early warning within 24 hours.
3. Risk: assess threats to those attributes once, in one register.
4. Controls: choose them once, from whichever catalogue suits — NIST SP 800-53, the CIS Controls, a cloud well-architected framework.
5. Evidence: tag each piece of evidence to both a CAF contributing outcome and a NIS2 measure. The CAF self-assessment and the NIS2 compliance pack then become two views of the same data.

If you're also delivering UK government services, the same spine absorbs UK Secure by Design, which the government says covers most CAF outcomes — all except B1, B6, D1 and D2.

---

Regulations will keep changing — NIS2 is new, the UK's own reform is on its way. Architectures anchored in business attributes absorb those changes; compliance projects restart from scratch each time. Build the spine once, and each new regime is another view of evidence you already have. The foundation is covered in SABSA as the foundation.

Sources

• Cyber Assessment Framework and Introduction to the CAF — National Cyber Security Centre
• CAF v4.0 released in response to growing threat — NCSC, August 2025
• Cyber Security and Resilience Bill — GOV.UK
• Directive (EU) 2022/2555 (NIS2) — EUR-Lex, Articles 2, 20, 21, 23 and 34
• NIS2 Directive — European Commission
• Secure by Design policy, section 9 — UK Government Security