What NCSC Cyber Assessment Framework is
The NCSC’s outcome-based framework, used for NIS regulations in the UK and increasingly by the NHS and local government.
Who asks for it: UK essential services, NHS bodies and their suppliers.
What Microsoft 365 can show
20 contributing outcomes evidenced by 178 checks. A check maps to a contributing outcome only where its result is genuine evidence for it, so a contributing outcome is listed only when a tenant setting can show it.
Outside Microsoft 365
Most of governance (objective A) is assessed separately: the tenant shows only its asset, supplier and risk signals. So are staff training, backups and network architecture outside Microsoft 365.
Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.
Every contributing outcome and the checks behind it
The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.
Related frameworks
- Data Security and Protection Toolkit: The NHS self-assessment for organisations that handle patient data.
- NCSC 10 Steps: The NCSC’s guidance for boards and organisations, in ten steps.
- Cyber Essentials: The UK government-backed baseline: five technical controls for every organisation.
- Cyber Essentials Plus: Cyber Essentials, verified by an assessor’s technical tests.