National Cybersecurity Assessment Framework (NCAF) Tool The National Capabilities Assessment Framework 2.0 (NCAF 2.0) is a key EU instrument designed by ENISA to support Member States in assessing and strengthening their national cybersecurity capabilities. As a voluntary, flexible, and adaptable tool, it provides a structured methodology to evaluate maturity across 20 strategic objectives, enabling policymakers to identify gaps, set priorities, and drive evidence-based policymaking.  NCAF 2.0 is fully aligned with the NIS2 Directive, serving as a practical support for the development and implementation of National Cybersecurity Strategies and preparation for Article 19 peer reviews. Based on Member States’ best practices and real-world implementation experiences, the NCAF 2.0 provides a structured assessment that enhances the collective cybersecurity posture of the Union, supporting the shared mission to build a resilient and digitally secure Europe Start the assessment What are the benefits Image Conducting the evaluation of their national cybersecurity capabilities Image Enhancing awareness of the country maturity level Image Identifying areas for improvement Image Building cybersecurity capabilities What we evaluate Image Cluster #1 Capacity-Building and Awareness This cluster assesses the capacity of Member States to raise awareness of cybersecurity risks and threats and to strengthen cyber-resilience and hygiene. It also evaluates their ability to continuously develop cybersecurity capabilities and enhance the overall level of knowledge and skills within this domain. Furthermore, it addresses improvements in incident preparedness and response as well as advancements in cybersecurity R&D. Image Cluster #2 Cooperation and Collaboration This cluster evaluates cooperation and information sharing between different stakeholders at both the national and international level (including as part of mutual assistance processes), recognising it as an important tool for better understanding and responding to a constantly changing threat environment. It also assesses the capacity of Member States to address and counter the cybercriminal activities. Image Cluster #3 Cybersecurity Governance This cluster measures the capacity of Member States to establish effective governance and good practices in the cybersecurity domain. It considers various aspects of national cybersecurity governance, risk assessment and management, while supporting the development of crisis management and incident reporting mechanisms, and fostering trust in public services and digital identities. Image Cluster #4 Regulatory and Policy Frameworks This cluster measures the capacity of Member States to establish the necessary regulatory and policy instruments to improve supply chain cybersecurity, promote active cyber protection, and to safeguard critical information infrastructure. It also assesses their capacity to create a policy framework for Coordinated Vulnerability Disclosure or a regulatory framework that balances security with privacy. National Capabilities Assessment Framework This report presents the work performed by ENISA to build a National Capabilities Assessment Framework (NCAF). The framework aims at providing Member States with a self-assessment of their level of maturity by assessing their NCSS objectives, that will help them enhance and build cybersecurity capabilities both at strategic and at operational level. This framework was designed with the support of ENISA subject matter experts and representatives from 19 Member States and EFTA countries . The target audience of this report is policymakers, experts and government officials responsible for or involved in designing, implementing and evaluating an NCSS and, on a broader level, cybersecurity capabilities. Published December 07, 2020 Language English Image Download PDF document, 4.60 MB n00kfq35 Tue, 10/02/2026 - 16:45