GovAssure stages are the five sequential steps UK government organisations use to scope, assess, review and improve the cyber resilience of critical systems UK Government Security guidance. Departments and relevant arm’s-length bodies need to understand the GovAssure stages when their systems enter the scheme. For the 2026 to 2027 cycle, assessments use version 4.0 of the National Cyber Security Centre’s Cyber Assessment Framework GovAssure self-assessment guidance. The work starts with defining essential services, not filling in a questionnaire.
- Definition: GovAssure takes a government system from agreed scope through a Cyber Assessment Framework assessment, review and improvement plan.
- Who needs it: Relevant UK government organisations participate; OFFICIAL government-sector critical national infrastructure systems must be assessed through the scheme.
- When to start: Begin scoping early and arrange a reviewer well before the review stage, especially if procurement is required.
- Cost drivers: System boundaries, evidence quality, the number of reviews and supplier procurement affect effort; prices vary by scope.
- Framework: The current cycle uses Cyber Assessment Framework version 4.0 and assigns a Basic or Enhanced Government CAF Profile.
- Common confusion: A standalone framework assessment can inform cyber risk decisions, but it does not replace the GovAssure process.
👥 What are the GovAssure stages and who needs them?
The GovAssure stages take a UK government organisation from defining essential services to committing to improvements for assessed systems. They run in a required sequence, rather than as separate exercises that teams can complete in any order UK Government Security guidance. Scoping determines what gets assessed; the later work tests the organisation’s account of its resilience and records what it will change.
GovAssure assesses critical government systems classified as OFFICIAL, including government-sector critical national infrastructure. OFFICIAL systems in that infrastructure category must use GovAssure, while the scheme is unsuitable for systems processing SECRET information or above GovAssure guidance on eligibility. A private company does not enter GovAssure merely because it operates in a regulated sector or supplies a government department.
Lead Government Departments decide which of their arm’s-length bodies enter the scheme each year and oversee their progress. An arm’s-length body assessing government-sector critical national infrastructure engages directly with the GovAssure team through an allocated cyber adviser Guidance for lead departments. Teams should confirm that route before assigning owners or booking a review.
GovAssure uses the National Cyber Security Centre (NCSC) Cyber Assessment Framework (CAF), but the framework alone is not the scheme. An organisation can use a CAF assessment to examine its own resilience without following GovAssure’s scoping, review and improvement requirements. Our cyber risk assessment explainer helps teams separate an internal risk exercise from a formal assessment route.
Key Takeaway
GovAssure is for eligible UK government systems, not a general certification for every organisation using the CAF.
⚙️ What happens during GovAssure stages one and two?
The opening GovAssure stages define the organisation’s essential services, identify the critical systems supporting them and select systems for assessment. Both stages use a shared scoping document, which the organisation owns and must complete accurately GovAssure scoping guidance. A weak boundary here creates avoidable disputes later about which evidence and controls a reviewer should examine.
Define services before selecting technology
Stage one captures the organisation’s mission, operating context and essential services. Start with the public service that must continue, then trace the systems needed to deliver it. The completed scope needs an evidence-based justification for the included services and systems Stage one guidance. Our risk assessment template offers a useful way to think about recording decisions, although GovAssure requires its own scoping document.
List systems, then choose the assessment set
Stage two separates the full inventory from the systems assessed in the current year. Part A of the scoping document identifies critical systems supporting each essential service. Part B records the selected systems and assigns their Government CAF Profiles Stage two scoping guidance. An unassessed government-sector critical national infrastructure system takes priority for the current assessment year under the same guidance.
Scope the system delivering the service rather than assuming every supporting location or supplier is itself an assessed system. Physical data centres and hosted cloud providers supporting an essential service are not themselves in scope for a GovAssure assessment Stage two guidance on scope. Their dependencies can still matter when the team explains how the in-scope system operates and gathers evidence.
🛠️ How does the GovAssure self-assessment work?
The self-assessment stage of the GovAssure stages tests each in-scope system against its target CAF profile and records the organisation’s evidence in WebCAF. The GovAssure team must sign off the scoping document before this stage begins Stage three self-assessment guidance. That sign-off makes the agreed system boundary the starting point for answers, evidence requests and the subsequent review.
System owners and security leads should work together on each response. Ask what control operates, who owns it, how it works for this system and what record supports the answer. Useful material may include policies, architecture records, test results and operational records, provided they genuinely describe the assessed system. A confident answer without supporting material gives the reviewer little to verify.
WebCAF is the service used to submit the self-assessment; the reviewer later uses it to see responses and carry out the review WebCAF guidance. Assign an owner to resolve conflicting answers before submission. Where evidence sits with a supplier or another department, agree how it can be shared securely rather than waiting for a reviewer to request it.
The current cycle assesses systems against CAF version 4.0, which has four objectives, 14 principles and 41 contributing outcomes CAF version 4.0 assessment guidance. The Government CAF Profiles are Basic and Enhanced; Basic replaces the former Baseline name GovAssure programme updates. Check the assigned profile in the agreed scope rather than assuming that every system has the same target.
🧩 What happens in the GovAssure review stage?
The review stage of the GovAssure stages checks the self-assessment, cyber risk management and security controls against the system’s target profile. For an Independent Assurance Review (IAR), the supplier must be registered as an Assured Service Provider under the NCSC Cyber Resilience Audit scheme Independent Assurance Review guidance. An arm’s-length body may instead have a Peer Review arranged through its Lead Government Department.
Agree the review route early. Lead Government Department guidance allows an arm’s-length body’s Peer Review to be conducted by its department or another arm’s-length body, as an alternative to an IAR Arm’s-length body review guidance. A department should not book an independent supplier without first checking which arrangement applies to its organisation and assessed systems.
Choosing and preparing a reviewer
For an IAR, verify the supplier’s scheme registration, relevant system experience, proposed reviewers, evidence-handling arrangements and reporting approach. Start procurement early, as UK Government Security advises, rather than treating supplier selection as a task to begin after WebCAF submission Independent review procurement guidance. Ask how the reviewer will test disputed claims and distinguish a missing control from missing evidence.
The organisation remains responsible for storing evidence securely and sharing it with the reviewer Review evidence guidance. Set access rules before the review begins, especially where records contain sensitive operational detail. Our cyber audit explainer describes the broader discipline of preparing evidence, but an ordinary audit does not by itself satisfy GovAssure’s review requirements.
📋 What goes into a GovAssure improvement plan?
A Targeted Improvement Plan (TIP) turns review findings into prioritised actions for the assessed system. The Independent Assurance Review Report must be finalised before this stage begins, and each assessed system needs its own TIP Targeted Improvement Plan guidance. A plan covering several systems without clear ownership would make progress difficult to judge.
Start with the gap between the review’s findings and the target Government CAF Profile. For each proposed action, record the affected system, the control or resilience outcome, an accountable owner and a way to demonstrate progress. Sequence work around the risks it reduces and the dependencies between changes. A purchase request alone is not an improvement plan if nobody can explain what better operation will look like.
The TIP records priority actions the organisation commits to take in response to its review GovAssure improvement guidance. Security leads should therefore check that service owners accept the actions and that decision-makers understand any funding or delivery dependencies. Our security strategy and roadmap support can help structure improvement work, but the organisation remains accountable for its GovAssure plan.
A finished review is not the finished job. Good follow-through means owners can show that agreed actions are progressing and can explain whether the system’s resilience has improved. Keep the review finding, planned change and later evidence connected. That gives the next assessment team a clearer account than a list of actions marked done without proof.
Key Takeaway
Judge the plan by whether it assigns credible actions and produces evidence of better resilience for each assessed system.
⚖️ How is GovAssure different from a CAF assessment or cyber audit?
GovAssure is a government assessment process with defined scoping, self-assessment, review and improvement steps. A standalone CAF assessment uses the same framework to examine resilience, while a cyber audit tests controls against an agreed audit scope. Neither automatically completes GovAssure’s required sequence GovAssure process guidance.
| Approach | What it covers | When to use it |
|---|---|---|
| GovAssure | Eligible government systems, assigned profiles, review and improvement planning | When an in-scope government system enters the scheme |
| Standalone CAF assessment | Resilience against selected CAF outcomes | When a team wants a framework-based view outside GovAssure |
| Cyber audit | Controls and evidence against an agreed audit scope | When decision-makers need assurance on particular controls |
The NCSC says the CAF is used across UK cyber regulation and in the public sector through GovAssure NCSC framework overview. Framework reuse is helpful: an existing assessment may reveal evidence gaps before GovAssure starts. Yet teams still need to agree the GovAssure scope, use the assigned profile and complete the scheme’s review and improvement steps.
A cyber audit can answer a narrower question, such as whether a set of controls operates as described. Our cyber assessment explainer outlines how to examine controls and evidence more generally. Use that work to prepare, not as a substitute for the formal GovAssure route. The practical test is simple: can you point to the required outputs for each scheme stage?
💷 How long do GovAssure stages take and what drives cost?
GovAssure stages follow a published programme cycle, but an organisation’s effort depends on its scope, evidence and review route. For the 2026 to 2027 cycle, scoping runs from September to October 2026, self-assessment from November 2026 to January 2027, review from February to March 2027 and improvement planning from April to May 2027 GovAssure programme timetable. These are programme windows, not a promised duration for each system.
Costs vary by provider and scope. The price of an independent review depends on the number and complexity of assessed systems, the work needed to examine evidence and the supplier’s agreed remit. Internal effort also matters: service owners, procurement staff and security teams all contribute. For an arm’s-length body using a Peer Review, the purchasing route differs, but preparation still takes staff time.
| Factor | Why it matters | Effect on scope |
|---|---|---|
| System boundaries | Broad or disputed boundaries take longer to agree and examine | Clarify essential services and dependencies early |
| Evidence readiness | Missing or inconsistent records need follow-up | Assign evidence owners before self-assessment |
| Review route | An independent supplier requires procurement and a defined remit | Confirm eligibility and arrangements early |
| Assessed systems | Each system needs its own assessment and improvement plan | Budget staff time per selected system |
UK Government Security advises organisations to procure an IAR supplier early in the process Review procurement guidance. Before requesting proposals, settle the review route, approved scope, expected evidence access and reporting responsibilities. Our cyber security risk assessment service can help teams clarify risks and evidence gaps before formal review; it does not replace an eligible GovAssure reviewer.
A useful outcome is not simply an accepted submission. Look for a defensible system boundary, answers backed by accessible evidence, review findings that decision-makers understand and improvement actions with owners. Those outputs make the next decision about resilience easier, whether the answer is to change a control, obtain better evidence or accept a documented risk.
❓ Frequently asked questions
What are the five GovAssure stages?
The GovAssure stages are defining the organisation’s context and services, identifying systems and profiles, completing a WebCAF self-assessment, having a review and creating a Targeted Improvement Plan. They must happen in that order GovAssure process guidance. Each stage produces information needed by the next, so disputed scope should be resolved before evidence collection begins.
Who needs to complete GovAssure?
GovAssure applies to eligible UK government organisations assessing critical systems. OFFICIAL systems designated as government-sector critical national infrastructure must be assessed through it GovAssure eligibility guidance. Lead Government Departments decide which arm’s-length bodies enter the process each year. A private supplier does not become a GovAssure participant solely because it serves a government customer.
Do we still need GovAssure if we already have a CAF assessment?
Yes, if your system is required to enter GovAssure. An existing Cyber Assessment Framework assessment may help identify gaps and prepare evidence, but it does not replace GovAssure’s agreed scope, WebCAF submission, review and improvement plan GovAssure process guidance. Check that earlier answers describe the system and target profile selected for the scheme.
How long does the GovAssure process take?
Plan the GovAssure stages around the published cycle rather than assuming a fixed duration for your system. The 2026 to 2027 timetable runs from scoping in September 2026 through improvement planning in May 2027 GovAssure programme timetable. Your hands-on effort depends on system complexity, evidence readiness and the review route. Confirm local milestones with the team coordinating your assessment.
Can we outsource the GovAssure assessment or review?
You can use external support and, where an Independent Assurance Review applies, appoint an eligible supplier for that review. The supplier must be registered under the NCSC Cyber Resilience Audit scheme Independent review guidance. The organisation still owns its scoping document and remains responsible for securely storing and sharing review evidence. Outsourcing does not transfer those responsibilities.
Do we need an Independent Assurance Review or a Peer Review?
Confirm the route with your Lead Government Department or GovAssure contact before procuring a supplier. An arm’s-length body’s review may be independent or conducted by its Lead Government Department or another arm’s-length body Guidance for arm’s-length bodies. The appropriate arrangement depends on how that organisation is entering the scheme, not on which option appears cheaper.
How do we judge whether GovAssure worked?
Look beyond whether the forms were submitted. A useful assessment has a justified scope, supported answers, review findings that owners understand and a Targeted Improvement Plan for each assessed system Improvement planning guidance. Later, check whether owners can demonstrate progress against those actions and explain how the changes affect the system’s resilience.
Does GovAssure cover systems processing SECRET information?
No. GovAssure is designed for government systems classified as OFFICIAL and is unsuitable for systems processing SECRET information or above GovAssure eligibility guidance. If a service depends on systems at different classifications, establish which systems belong in the GovAssure scope before beginning the self-assessment. Do not assume one assessment route covers every classification.
Contact Us
