15/10/2026
LG WebCAF is moving into private beta. The technology may make assessment easier, but keeping CAF useful will still depend on evidence, ownership and action between formal reviews.
The Ministry of Housing, Communities and Local Government has announced the next stage in developing LG WebCAF, a digital service intended to help councils complete, manage and repeat their Cyber Assessment Framework work more consistently.
The service is moving into private beta, where it will be tested with a small group of councils, independent assurers and MHCLG colleagues. That phase is expected to run for around a year and will cover more of the full journey: onboarding, deciding what is in scope, self-assessment, assurance, implementation and improvement planning.
This is a development announcement, not a new compliance requirement or a general launch. Councils should continue with their current CAF work using the existing guidance and workbooks while LG WebCAF is tested.
That distinction matters, but so does the direction of travel.
The assessment is not the outcome
It is easy for any assurance exercise to become organised around the submission date. Evidence is gathered, questions are answered, gaps are discussed and the finished assessment receives the attention it deserves. Then everyday work resumes.
The difficulty is that the organisation does not stand still once the assessment is complete. A council may change a supplier, introduce a new digital service, restructure a team or alter how an essential service is delivered. An experienced member of staff may leave. A critical system may reach the end of support. The threat picture may change faster than the improvement plan.
A CAF assessment can therefore be accurate on the day it is approved and gradually become less accurate afterwards. That is not a criticism of the framework. It is the reason the work needs to be managed as a continuing process.
MHCLG describes CAF for local government as a long-term, repeatable approach. The proposed digital service reflects that by bringing the assessment, assurance and improvement journey together rather than treating them as separate pieces of work.
Evidence needs a named owner
A digital platform can make evidence easier to organise and revisit. It cannot decide who is responsible for keeping that evidence current.
The strongest evidence usually sits outside the cyber team. Business continuity colleagues understand how services would operate during disruption. Procurement and contract managers hold information about suppliers. Service owners understand the operational consequences of failure. HR, information governance, facilities and finance may all hold part of the picture.
For each important piece of evidence, councils need to know who owns it, what it demonstrates, when it was last checked and what change should trigger a review. Without that ownership, an assessment can contain documents that still exist but no longer prove what the organisation thinks they prove.
Improvement plans need the same discipline. An action without a responsible owner, an agreed priority and a realistic route to funding is not yet a plan. It is a well-presented concern.
Independent assurance should be useful, not theatrical
Independent assurance is most valuable when it tests the council’s understanding rather than simply confirming that documents are present. The useful questions are practical ones. Does the stated control operate as described? Does it cover the systems supporting the essential service? Are supplier responsibilities understood? Would the evidence withstand a real incident rather than only an assessment?
This is where a repeatable process can help. Findings from assurance should flow into improvement work, and completed actions should feed back into the council’s view of its resilience. That creates a cycle of evidence, challenge and improvement instead of a sequence of isolated assessments.
What councils can do now
Councils do not need to wait for LG WebCAF to be widely available before strengthening that cycle. They can:
Assign named owners to evidence and improvement actions, including material held outside IT and cyber teams.
Record review dates and change triggers, rather than assuming evidence remains valid until the next formal assessment.
Link CAF actions to corporate risk, service planning, procurement, business continuity and budget decisions.
Keep an audit trail showing what changed, why it changed and how the council confirmed that an action was effective.
Use independent assurance to test reality, including service dependencies and supplier arrangements, rather than only reviewing written policies.
The announced service should make CAF easier to navigate and manage. That is welcome, particularly for councils coordinating evidence across several teams and essential services. But no platform can provide ownership, judgement or follow-through on its own.
The better question
By January 2026, MHCLG reported that 90 councils had completed a CAF assessment, with many more working through the process. As adoption grows, the question will naturally shift from whether an assessment has been completed to whether it is still helping leaders make better decisions.
CAF should give a council an honest, usable view of the risks to its essential services and the work needed to improve resilience. If it becomes a snapshot that nobody revisits, much of that value is lost.
LG WebCAF may provide a better place to manage the process. The real measure of success will be whether councils can keep the evidence alive, close the gaps that matter and show that resilience is improving over time.
Approval is a moment. Assurance is a continuing responsibility.
