Eight Regimes. One Control Set.

CAF is outcome-based rather than prescriptive. It asks whether you achieve an outcome, not whether you bought a particular product. Four objectives, A to D, covering managing security risk, protecting against cyber attack, detecting events, and minimising the impact of incidents.

Version 4.0 landed in August 2025 and moved the bar in four places, a deeper expectation around understanding attacker methods and motivations, secure software development and maintenance for software used in essential services, stronger security monitoring and threat detection, and explicit coverage of AI-related risk. Operators who assessed against v3.2 and have not re-baselined are carrying an unquantified gap.

Announced in the July 2024 State Opening, introduced on 12 November 2025, second reading 6 January 2026, committee stage through February, third reading in the Commons 16 June 2026, and now in Lords committee. It is not law yet, but the direction is settled enough to plan against.

The scope widens. Data centres, managed service providers, large load controllers and critical suppliers to regulated entities come into the net, alongside the existing sectors. Reporting duties increase, including compulsory ransomware reporting, and regulators gain stronger enforcement powers. Daily fines in the order of £100,000 for continued failure have been signalled by government.

For an offshore wind operator the practical question is not whether you are in scope, you almost certainly are, but whether your critical suppliers know that they now might be too.

NIS2 (EU 2022/2555) has applied since October 2024, though national transposition has been uneven and several member states arrived late. If you operate assets in Dutch, German, Danish, Belgian or Polish waters, the obligation sits with the local entity under local implementing law, which is rarely a straight copy of the directive.

The reporting clock is the part that catches operators out. An early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within one month. Twenty four hours is not long if nobody has agreed in advance who declares an incident and who talks to the regulator.

A standard, not a framework. Where CAF asks whether you have understood your estate, 62443 tells you how to partition it and how to specify a control so a vendor can build and verify it. The parts that matter most in an operating offshore wind estate are 62443-2-1 for the security management system, 62443-3-2 for zone and conduit risk assessment and target security levels, and 62443-3-3 for the system requirements that follow from an SL target.

62443-3-2 is increasingly written into FEED and O&M contracts, which means the zone and conduit model stops being a consultancy artefact and becomes a contractual deliverable that has to be maintained. M3 holds it as living data for exactly that reason.

CSF 2.0 added Govern to the original five functions, so the set is now Govern, Identify, Protect, Detect, Respond and Recover. It is not a UK regulatory requirement, but it is the framework most international owners, insurers and lenders are fluent in, and it is frequently the language a board paper has to be written in.

Modus treats CSF as an output view rather than a separate programme. The controls are the same controls, presented against CSF categories for the audience that wants them that way.

A knowledge base of the tactics and techniques observed against ICS environments, not a compliance checklist. Its value in Modus is specificity. Rather than a generic threat statement, techniques are mapped against the assets, conduits and access routes in your register that would actually carry them.

That turns the threat model into a prioritised work list, and it gives detection engineering something concrete to aim at. CAF v4.0's stronger expectation around understanding attacker methods is most readily evidenced this way.

Thousands of CVEs are published every month and almost none of them are relevant to your estate. The KEV catalogue narrows the field to what is confirmed as actively exploited, which is a far more useful prioritisation signal than a CVSS score on its own.

Modus matches advisories against the asset register by vendor, product and firmware version, then flags KEV entries separately. A KEV on a device sitting behind a well-controlled conduit is a different conversation from the same KEV on an asset reachable through an OEM remote access route, and Modus can tell the difference because it knows the architecture.

Ofgem applies CAF as the competent authority for the GB energy sector, with sector-specific expectations and its own assessment cycle. Generators, transmission owners and OFTOs are all in scope, with the boundary between them a recurring source of argument about who owns which control.

OFTO transfer is where an undocumented OT estate becomes expensive. Due diligence increasingly includes OT cyber evidence, and a transmission asset handed over without a credible asset register or zone model creates a liability that gets priced in. Building the register during construction is considerably cheaper than reconstructing it at transfer.