CAF Incident Response Master Document Register

What is the CAF-IR Master Document Register? 

The CAF-IR Master Document Register is the single, Excel-ready control sheet behind a complete UK Cyber Assessment Framework (CAF) incident response documentation set. Instead of tracking policies, procedures, playbooks, registers and evidence logs separately across shared drives and inboxes, you manage all 91 documents through one structured spreadsheet — supplied as a free, adaptable CSV template you take as your baseline, populate with your own owners and dates, and run as the live single source of truth for your incident response documentation.

Every row maps a document directly to the specific CAF outcome (or outcomes) it evidences — from Board Direction under A1 through to Lessons Learned under D2 — so when an assessor or internal auditor asks "where's your evidence for this outcome," the answer is a filter, not a search.

What's Inside?

The 13 Categories

The 91 documents are grouped into 13 categories, each aligned to a stage of the incident response lifecycle and mapped back to the CAF objective it evidences:

1. Governance and accountability (8 documents) — policy, escalation procedure, and the roles/RACI matrices that evidence CAF's Governance principle (A1).
2. Risk and threat understanding (8 documents) — the risk assessment and threat intelligence artefacts behind Risk Management (A2).
3. Essential functions, assets and dependencies (5 documents) — the asset and dependency mapping behind Asset Management (A3).
4. Supply chain incident support (7 documents) — third-party and supplier incident coordination evidencing Supply Chain (A4).
5. Security monitoring and logging (8 documents) — the logging and monitoring standards feeding Security Monitoring (C1).
6. Alerting, triage and threat hunting (8 documents) — alert handling and proactive discovery evidencing Proactive Security Event Discovery (C2).
7. Incident response planning (8 documents) — the core response plans behind Response and Recovery Planning (D1).
8. Response and recovery capability (8 documents) — the operational playbooks that execute the plan.
9. Resilience, backups and restoration (6 documents) — recovery and restoration evidence supporting Resilient Networks and Systems (B5).
10. Testing and exercising (6 documents) — exercise programmes and reports evidencing tested response capability.
11. Post-incident analysis and lessons learned (7 documents) — root cause analysis and plan-update records behind Lessons Learned (D2).
12. Staff awareness and training (5 documents) — training records and programmes evidencing Staff Awareness and Training (B6).
13. Evidence, registers and CAF outcome mapping (7 documents) — the master incident register and cross-referencing artefacts an assessor reviews directly.

Core Evidence vs. Supporting Evidence

Every document in the register carries an evidence weight: of the 91 documents, 54 are Core evidence — the artefacts an assessor or internal reviewer expects to see directly against a named CAF outcome — and 37 are Supporting evidence, which strengthen the response capability and provide context without being the primary evidence for any single outcome. This split lets you prioritise build-out: get the 54 core documents in place and reviewed first, then layer in supporting evidence as capacity allows.

Document Types at a Glance

The 91 documents span 15 distinct types, led by registers (17), plans (10), templates (8), checklists (7), matrices (6), records (6), logs (6), playbooks (6) and assessments (6), with policies, procedures, maps, guides, standards and reports filling out the remainder. This mix reflects what incident response documentation actually needs to be — not just policy statements, but the live registers, logs and playbooks a response team uses in the moment.

Numbering Convention

Every document is identified as CAF-IR-[TYPE]-[NNN], where the type code reflects its function (POL for policies, PRO for procedures, MTX for matrices, REG for registers, PLN for plans, PLY for playbooks, and more) and the number is unique within that type. IDs are fixed for the life of the document — they never change and are never reused — so cross-references, audit trails and version history stay coherent as the register evolves.

Mapped to CAF Outcomes Across All Four Objectives

The register's CAF outcome references span all four CAF objectives relevant to incident response:

• Objective A — Managing security risk: A1 (Governance), A2 (Risk Management), A3 (Asset Management), A4 (Supply Chain).
• Objective B — Protecting against cyber attack: B5 (Resilient Networks and Systems), B6 (Staff Awareness and Training).
• Objective C — Detecting cyber security events: C1 (Security Monitoring), C2 (Proactive Security Event Discovery).
• Objective D — Minimising the impact of cyber security incidents: D1 (Response and Recovery Planning), D2 (Lessons Learned).

Each document's CAF outcome reference column can carry more than one Indicator of Good Practice — for example, the Cyber Incident Management Policy maps to both A1.a and A1.b — so the register reflects the reality that a single well-built document often evidences several related outcomes at once.

Key Benefits

• One controlled source of truth. All 18 columns — ownership, approval, CAF mapping, review dates and evidence location — live in a single maintained sheet instead of scattered across a shared drive.
• Assessment-ready by design. The Core/Supporting evidence split tells you in advance which documents a CAF assessment will focus on and which strengthen your position without being the headline evidence.
• Direct CAF outcome traceability. Every document ties back to a named Indicator of Good Practice, so gap analysis against a specific CAF principle is a filter, not a manual cross-check.
• Board-level accountability built in. The Approver column names Board / SIRO sign-off explicitly wherever CAF's governance expectations require it, keeping accountability visible rather than implied.
• You save weeks of setup. Rather than building a documentation inventory from scratch, you adapt a professionally structured register with 91 documents and their relationships already mapped.

** GDPR & Privacy ** We wholeheartedly believe in your and our rights to privacy and in the GDPR. The bottom of the page explains how we use your data.