There are two CAF Profiles

  1. The Baseline (sometimes called Basic) Profile is sector-agnostic and defines a suggested target level for each of the CAF outcomes. This Profile represents a level of cyber resilience matched to basic attacker capability and unsophisticated threats.
  2. The Enhanced CAF Profile is a more tailored, sector-specific target level for the CAF outcomes. It corresponds to a level of cyber resilience matched to a moderate attacker capability moderately sophisticated attack.