Cyber Defence Capability Assessment Tool (CDCAT®)

of organizations don’t know they’ve been breached

of organizations don’t have a formal plan

of UK businesses have been attacked

of CEOs say cybersecurity is critical for growth

CDCAT® Overview

In today’s threat landscape, assumptions are dangerous. CDCAT® (Cyber Defence Capability Assessment Tool) empowers senior cybersecurity leaders to make data-driven decisions by objectively assessing cyber defence maturity across people, processes, and technology. Developed in collaboration with Ministry of Defence's (MOD) Defence Science and Technology Laboratory DSTL and made commercially available through APMG, CDCAT® aligns with global standards and provides actionable insights to reduce risk, improve resilience, and justify investment. Whether you're defending critical infrastructure or leading enterprise security, CDCAT® gives you the clarity and confidence to stay ahead of evolving threats.

Know your cyber security strategy. Own your defence.

Invest in CDCAT® and take control of your cyber defence strategy. Starting at £1,250, the assessment includes pre-consultancy, evaluation, and strategic follow-up — scalable to any organisation size or complexity.

Organisations using CDCAT® have reported audit preparation time reduced by up to 70%, thanks to its automated control mapping and actionable reporting.

For every £1 spent on CDCAT®, an organisation could save £18 in audit costs — plus significantly reduce the time to assess and act on cyber risks.

What are the Estimated Cost Savings with CDCAT?

Traditional cybersecurity audits can cost £10,000 to £50,000+ and take weeks or even months to complete, especially when multiple standards (e.g. ISO 27001, NIST, PCI-DSS) are involved.

CDCAT® Classic Assessment starts at £1,250, offering a consultant-led, standards-mapped evaluation that drastically reduces both time and cost. You’ll receive a report you can share with your organisation and create an action plan from.

Organisations using CDCAT® have reported audit preparation time reduced by up to 70%, thanks to its automated control mapping and actionable reporting.

For enterprises with complex compliance needs, CDCAT® can save tens of thousands of pounds annually by consolidating multiple frameworks into a single, efficient assessment.

What will my Cyber Risk Assessment Report contain?

Each report is yours to keep and comes with a breakdown of the following areas:

Summary: A high-level overview of your company, its weaknesses, and areas for improvement.
High Level Action Plan: Effectiveness of your current controls according to target and areas of improvement.
Performance Indicators: Bespoke KPIs tailored to your company to meet your desired goals and timeframes (especially relevant for your technical team).
Additional Standard: A separate report assessment against an additional security standard.
Assessment Data: Your data specifically mapped against the selected security controls (especially relevant for your technical team).
An Action Plan: Providing an overview of your blockers and weaknesses based on the TEPIMOIL mnemonic: Training, Equipment, Personnel, Information, Management, Organisation, Infrastructure and Logistics.

Three professionals working together at a computer, smiling and reviewing lines of code displayed on a large screen.

Who is CDCAT® for?

The Cyber Defence Capability Assessment Tool (CDCAT) is suitable for individuals and organisations preparing for an audit or need an enterprise-grade assessment at manageable cost. Typical clients of CDCAT are:

CFOs and Finance Directors – seeking cost-efficiency in compliance processes.
IT Audit Managers – responsible for managing lengthy audit cycles.
Compliance Officers – ensuring alignment with ISO 27001, NIST, PCI-DSS.
Heads of Risk and Governance – managing multi-framework environments.
Cybersecurity Consultants – delivering assessments across diverse client needs.
CISOs in Critical National Infrastructure – requiring trusted, validated tools.
Government Security Advisors – looking for MOD-endorsed methodologies.
Defence Contractors – needing assurance tools with military-grade credibility.

Benefits of CDCAT®

For Individuals

Strengthen Analytical Thinking in Cyber Defence.
Learn to interpret assessment data and performance indicators to make informed decisions about cyber risk and resilience.
Build confidence in applying cyber frameworks.
Gain hands-on experience in applying mapped controls from multiple standards, helping you confidently contribute to audit preparation and strategic planning.
Understand how specific controls, processes and practices can be adopted by an organisation and how they interconnect to create a cyber security strategy.
Understand how standards, framework, guidance or report has been mapped to a variety of control groups.
Develop skills which help you develop a best practice cyber defence strategy.
Explore up to date security standards.

For Organizations

Clear visibility of cyber maturity which allows you to gain a detailed understanding of your organisation’s current cyber defence posture across people, processes, and technology.
Identification of Vulnerabilities - Pinpoint specific weaknesses before they are exploited — enabling proactive remediation and risk reduction.
Actionable Insights and KPIs- Receive tailored reports with performance indicators and prioritised recommendations to guide strategic decisions.
Compliance Readiness - Ensure alignment with key standards like ISO 27001, NIST, PCI-DSS, and Cyber Essentials — supporting audit preparation and regulatory compliance.
Cost and Time Efficiency - Save thousands in audit costs and reduce assessment time from weeks to days with automated, consultant-led evaluations.
Strategic Planning Support - Use assessment outcomes to inform cybersecurity investment, workforce planning, and board-level reporting.
Repeatable and Scalable - Apply the same framework across departments, regions, or business units — ensuring consistency and comparability.

Documentation

Case Study - Lead Government Departments

pdf - 264 KB - 17 June 2025

Case Study - HM Land Registry

pdf - 256.32 KB - 17 June 2025

Videos

Understand and manage your cyber security with CDCAT

28/08/2025 | 3 minutes 9 seconds

Cyber Security

FAQs

To appeal your result, email a written request with supporting evidence to customerservice@apmgroup.co.uk. We will review your appeal and respond. See APMG’s policies for details on the full appeals process.

Your results will be processed 6 to 12 hours after your exam. You will receive an email confirming your achievement and inviting you to the Candidate Portal where you can see your official result. From there, you can create your account in Credly.com and access your digital badge and certificate.

Your training organization specified that they wish to view candidate results before releasing. If you would like your results sooner, you may contact your ATO directly and request your results that way. After they have released them, you will be able to create/view your Digital Badge and download your Digital Certificate in your Credly account in the Certificates section of your portal.

Since 2018, we are no longer registered for AXELOS qualifications and are unable to provide the certificates.

If you received your AXELOS qualification before this time, you can contact customer service and upon providing your candidate number, ask if a copy of your certificate still exists in our system.

Alternatively, you can reach out to IT PeopleCert directly with this request quoting your candidate number.

If you do not have your candidate number, we can provide it to you. Additionally, we are happy to provide a letter of verification for any exams sat with us.

When you pass an exam – you will instantly have the option to claim a digital badge as representation of your new certificate. Your badge can be embedded on an email signature, website, digital CV, or shared via LinkedIn.

Access the downloadable guide for more information on how to claim your digital badge.

You can always access all your records, electronic certificates and badges via the APMG Candidate Portal.

Once you have logged on to the Candidate Portal, click on the ‘Badges and Certificates’ option from the menu bar at the top of screen. From here you should click on the ‘Create Badge/Certificate’ button. This will take you to the Credly platform to create an account and download your badge and certificate.

Step-by-step guidance is available to download from the ‘Badges and Certificates’ area in your Candidate Portal.

Electronic certificates are environmentally friendly, but you can print the certificate yourself at home or work, if required.

If you have any problems you are welcome to contact our customer service team.

If you previously sat an exam with us and were issued a paper certificate but would like to upgrade to a digital badge and e-certificate, please contact us. There is a £25 administration fee for providing a digital badge and a form for which you will need to complete to consent to your personal information being used in order to manually create the badge in Credly.com.

If your exam is booked through a Training Organization, and they are proctoring your exam over a platform of their choosing, you will need reach out to them directly to discuss options to reschedule.

If your exam is with ProctorU, you can reschedule without additional charges as many times as you wish up to 24 hours prior to your booked slot. If you reschedule within this 24-hour period, you will need to pay the £38 reschedule fee, as we will still be charged by ProctorU for your slot.

You can merge your account by logging into your candidate portal with your initial email address and click on your name at the top. Then click merge and send a merge request to your secondary email address. Once you have agreed to the email request, everything will appear in one account. Please contact us if you have any problems with this process and we will be happy to help.

You may contact our Accreditation Team directly, and they will be happy to answer your questions regarding the Accreditation process.