The Cyber Assessment Framework (CAF) has emerged as a prime resource for building cyber resilience in the public sector.