Evidence that your defences work when ransomware hits.
CAF 4.0, the latest version of the NCSC’s Cyber Assessment Framework, asks essential services and government bodies to show that their cyber defences work against real attacks, not just that they exist. Ransomware is the test it is built for. Helm detects encryption in under a second, contains it on rules your team sets, verifies recovery and records every step, giving you evidence for the CAF outcomes on detection and minimising impact.
The pressure on UK services is rising. The NCSC handled 429 cyber incidents in the 12 months to August 2025, and 204 of them were nationally significant, up from 89 the year before.
CAF 4.0, released on 6 August 2025, responds with a sharper view of the attacker. It expects defences that hold up against capable, persistent adversaries, with stronger monitoring, threat hunting and analysis of user and system behaviour. The question an assessor asks is no longer whether a control exists, but whether it works.
More is coming. The Cyber Security and Resilience Bill, now in the House of Lords, would require an initial report within 24 hours of a significant incident and a full report within 72. Organisations that can show their ransomware response working, with the evidence to match, will be ready for both.
The Cyber Assessment Framework is an outcome-based framework from the National Cyber Security Centre. It sets four objectives, A for managing security risk, B for protecting against attack, C for detecting cyber security events and D for minimising the impact of incidents, across 14 principles. Each principle breaks down into contributing outcomes, judged against indicators of good practice rather than a checklist.
Sector regulators use CAF to assess operators of essential services under the UK NIS Regulations 2018, from energy to drinking water and transport. Government departments are assessed against it through GovAssure, and the NHS Data Security and Protection Toolkit is now CAF-aligned. The UK is outside the EU’s NIS2, so CAF is the UK’s reference point.
A ransomware attack tests Objectives C and D hardest. Security monitoring (C1) and threat hunting (C2) determine how quickly you see it. Response and recovery planning (D1) and lessons learned (D2) shape how much of the essential service you keep, and what you can show afterwards. Both depend on speed and on a reliable record, and that is where Helm comes in.
Helm works at the moment CAF 4.0 cares about most, when encryption starts, and turns what happens next into evidence your assessor can follow.
Security monitoring (C1). Helm watches file activity and detects active encryption in under a second, by behaviour rather than signature, in line with CAF 4.0’s focus on understanding user and system behaviour. Alerts reach your SIEM and security team straight away.
Response and recovery (D1). Helm isolates the compromised accounts and devices on fixed, readable rules your team sets, with no AI in containment, so the essential service keeps running. It verifies systems are clean before they return.
Lessons learned (D2). Every detection, containment and recovery step is timestamped, showing which accounts, devices and files were involved. That record feeds your post-incident review, your regulator or GovAssure assessment, and the fast reporting the new Bill would bring.
For assessors, Helm’s mapping also covers contributing outcomes in Objectives A and B, including A2.b on understanding threats and B5.a on resilience preparation. [TBC]
CAF 4.0 asks whether your defences work when it matters. With Helm, a ransomware attack is detected and contained in seconds, the essential service carries on, and the evidence for Objectives C and D is ready for your assessor, your board and your regulator.
See how Helm supports councils and public bodies, or talk to us about your CAF assessment.
