CAS(T) assessment scheme

NCSC Commodity Assured Service (CAS) scheme for Telecoms is the pan-government Public Sector Network (PSN) programme for telecoms providers. All telecoms services procured by public sector bodies are required to be certified to the CAS(T) standard, which is defined in the “Assured Service CAS Service Requirement Telecommunications” document, available from the NCSC website. 

In order to achieve certification, the service provider must demonstrate compliance with the “Security Procedures Telecommunications Systems and Services” standard, which is based on the ISO/IEC 27001 standard.

Our experienced team can assess you to ensure you meet the CAS (T) scheme requirements. The process flow below shows the steps you need to take to get accredited and how we work with you as the service provider and NCSC and during the initial certification. 

CAS T scheme

Our CAS (T) assessments

Once you have been assessed and the initial certification has been completed, you will require at least one surveillance audit annually. We assess one third of the controls during each audit so that all controls have been assessed over the three visits. 

CAS (T) assessment timescales

Timescales to complete the initial assessment will depend on several factors, but for a small to medium size organization we would expect the following:

  • Initial questionnaire: 1-2 days (approval by NCSC: 4-6 weeks)
  • Assessment plan: 1 week (approval by NCSC: 4-6 weeks)
  • Assessment activities: 2-3 weeks
  • Reporting and production of Assurance Maintenance Plan: 1 week (approval by NCSC: 4-6 weeks)
  • Issue certificate: 1-2 weeks after approval of report
  • Certification expiry: 3 years after issue date

We recommend you engage with us around 6 months before your certificate expires to ensure you can maintain your certification.