Bridewell Supports WLGA With Wales-Wide CAF Assessment Programme to Strengthen Cyber Security Maturity

The work Bridewell has done to support this has been invaluable, their breadth of knowledge and experience has allowed us to give effective support and assured feedback to our local government partners to help their CAF assessments mature.

Tom Jones – Senior Programme Delivery Officer (Cyber) - WLGA

Bridewell partnered with the Welsh Local Government Association (WLGA) to deliver the first Wales-wide Cyber Assessment Framework (CAF) programme, supporting 22 local authorities and three fire and rescue services to assess cyber security maturity, establish a national baseline, and create sustainable foundations for continuous improvement.

The Welsh Local Government Association (WLGA) is a politically balanced, cross-party and member-led organisation. Their role is to champion local government, influence national policy and support councils to deliver for their communities.

The Challenge

In 2025, the WLGA were tasked with co-ordinating the implementation the NCSC’s Cyber Assessment Framework (CAF) across Welsh local government, contributing to a Wales-wide approach to assessing cyber security under the “Defend as one” ethos. While they understood that the CAF provides a structured approach to enable this, it would require significant coordination, training, and subject-matter expertise.

Implementing the CAF at a Wales-wide level presented both technical and organisational challenges. While the framework provides a structured method for assessing cyber resilience, many organisations were engaging with CAF for the first time and required support to interpret requirements, gather evidence, identify critical systems, and develop a consistent approach to assessment across Wales.

“We knew that to deliver a project of this scale we would need specialised cyber support, not only to give us the technical knowledge but to also help drive the cultural change in local government that the CAF seeks to provide. After going to market and reviewing our options, Bridewell’s experience with working with local government in England and their large catalogue of specialised services made them the clear choice”

The WLGA recognised that individual organisations, including local authorities and fire and rescue services, would find it challenging to complete CAF assessments independently. To address this, it sought a cyber security partner to help coordinate a Wales-wide rollout of expert guidance, quality assurance, and shared infrastructure for CAF assessment and reporting. In doing so, the WLGA, as well as the local authorities they support, could better understand and align with the CAF, thereby improving their overall cyber security maturity.

The WLGA’s specific requirements were for a cyber security partner who could support the in:

Designing and delivering CAF training workshops for local government organisations
Delivering documentation and training materials to support WLGA and local government organisations in completing CAF self-assessments
Providing an independent review of the CAF self-assessments provided by local government organisations, including reviewing the evidence provided against Indicators of Good Practice (IGPs)

It was also important to the WLGA that their partner shared social values, specifically in addressing economic inequality.

The Solution

Following a tender process, the WLGA chose Bridewell to support them, based on our experience with the CAF and strong alignment with the WLGA’s social values. Starting in April 2025, Bridewell supported the WLGA, 22 Welsh local authorities, and three fire and rescue services by:

Delivering a Wales-wide landscape snapshot of cyber security maturity, establishing a baseline for ongoing improvement.
Providing subject-matter expert support through training, quality review, and feedback
- Our team held multiple training sessions for local authorities covering: the purpose and structure of the CAF, CAF objectives, expected submission content, standard responses, tailored examples, and evidence requirements.
- Bridewell also delivered ‘CAF Surgeries’. These were in-person sessions where our team travelled across Wales to meet with local authorities and fire and rescue services to provide tailored support for their CAF assessments, help identify critical systems and review system architecture diagrams.
Creating sustainable infrastructure (training materials, workbook templates, dashboard, knowledge repository) for ongoing CAF cycles
- This included a library of short videos explaining each of the contributing outcomes within the CAF and what evidence is required for each.
- All assets were made available in a centralised repository for easy access by local authorities.
Establishing a programme that builds trust and encourages genuine engagement rather than a purely compliance-led approach.

Given the scale of the project, the requirements of the WLGA and participating organisations evolved quickly, requiring the Bridewell team to remain agile throughout delivery. The programme also required extensive planning and coordination, including regular planning sessions, monthly check-ins, and weekly interactions with individual teams to escalate issues and risks where needed

The Results 

Through this programme of work, the WLGA has established a clearer view of cyber security maturity across participating organisations, including common gaps, areas for improvement, and opportunities to better support councils in aligning with the CAF. This was reflected in measurable improvements across the programme, with the 25 participating Welsh public sector organisations showing notable improvements to quality and completeness in CAF objectives as the programme progressed

At a local government level, the work has also enabled more informed internal discussions by positioning cyber security not just as an IT issue, but as an organisational priority.

Other key outcomes include:

CAF Self-Assessment Workbook Template – A WLGA-adapted version of the NCSC CAF workbook for Welsh local government, with updated formatting for clarity, grouping of IGPs where applicable, and worked examples.
Critical System Mapping Workbook – Architecture mapping workbook template for councils to document critical system components, dependencies, boundaries, and architecture maps. This includes a breakdown of dedicated and shared components.
CAF Training Materials and Workshop Packs – A comprehensive training package including virtual session materials, in-person CAF Surgery workshop content, and FAQs.
Bridewell Quality Review and Feedback Packs – Independent quality assessments of each submission scored across five dimensions (Completeness, Accuracy, Clarity, Evidence, Relevance) with confidential feedback provided to each organisation.
Wales CAF Landscape Baseline Snapshot – First Wales-wide snapshot of CAF positions across all 25 participating organisations, establishing the baseline for ongoing maturity tracking.

“The programme is starting to show tangible benefits for the collective cyber resilience of Welsh local government. As cyber threats continue to evolve, the CAF programme has provided Welsh local government with a common framework, shared language and evidence-based approach to strengthening cyber resilience. The foundations established through this work will support future CAF cycles and help organisations continue improving their cyber security maturity over time.

The work Bridewell has done to support this has been invaluable, their breadth of knowledge and experience has allowed us to give effective support and assured feedback to our local government partners to help their CAF assessments mature. Their pragmatic and considered approach to planning and programme management has also meant that close working relationships have been developed, allowing for open and honest conversation about the work have to do, and the best way to do it.”

All Customer Stories

The Welsh Local Government Association (WLGA)

A politically balanced, cross-party and member-led organisation