NCSC CAF Self-Assessment Tool

What this is

A fully static self-assessment tool for the NCSC Cyber Assessment Framework (CAF) 4.0 — all 4 objectives, 14 principles and 41 contributing outcomes, with the full Indicators of Good Practice (IGP) text for each, ticked off individually with checkboxes that suggest an overall status per outcome.

There is no server-side component at all: no PHP, no build step, no database, nothing to install. It's plain HTML/CSS/JS, served as a folder of static files — the app logic is a handful of native ES modules, no bundler required.

It's also an installable Progressive Web App: a service worker caches the app shell after your first visit, so it keeps working offline (or on a flaky connection) after that, and most browsers let you "install" it as a standalone app from the address bar or share menu.

See CHANGELOG.md for release history (this project follows Semantic Versioning).

Unofficial tool — important

This is not the official NCSC Cyber Assessment Framework application process, is not affiliated with NCSC, and does not submit anything anywhere. It's a self-assessment aid to help you prepare your answers, understand the requirements, and spot likely compliance gaps. Always refer to the official guidance and the document for the definitive requirements — this tool's compliance flags are indicative only.

Attribution

The IGP text, guidance, and control requirements reproduced in assets/data.json are taken from the NCSC CAF published by NCSC at https://www.ncsc.gov.uk/collection/cyber-assessment-framework. All credit for that content belongs to NCSC. This project is an independent, unofficial companion tool and claims no ownership over that content.

The plain-English summaries in assets/plain-english.json and the conflicting-IGP pairs in assets/conflicts.json are this project's own unofficial interpretation of that content, not NCSC's, and are not endorsed by NCSC.

Data handling — important

Every assessment you create — organisation name, ticks, overrides, notes, review flags — is saved entirely in your browser's localStorage. Profiles (see Features) are saved the same way, under their own separate localStorage key. This means:

• Assessments and profiles are tied to the browser/device you created them on.
• Clearing browser data for this site/folder will delete them.
• Use "Export assessment (.json)" regularly to back up or move an assessment between browsers/devices, and "Import assessment (.json)" to load it elsewhere. Profiles have their own "Export (.json)" / "Import profile (.json)" controls, separate from the assessment ones, so a profile can be shared on its own.

How to run it

Nothing to install, but the app logic loads as native ES modules, which browsers only allow over http(s):// — opening index.html directly via a file:// URL will not work (module imports are blocked from the local filesystem). Serve the folder instead:

1. Any static file server, e.g.:

   python3 -m http.server 8000
   

   then open http://localhost:8000, or
2. Upload the whole folder to any static host — GitHub Pages, S3, a shared network drive, an internal web server, whatever you've already got. There is no database and no write access required on the server; it never needs to run any server-side code.

This is the beginning of the README. Read the rest at the original. Read the full README ↗