Yes, the CAF is an outcome-based assessment that can be scaled to the size of your organisation to evaluate and improve your cyber resilience.