Belgium CyFun — Cybersecurity Framework

Overview

Belgium CyFun (Cyber Fundamentals Framework) is a national cybersecurity framework developed by the Centre for Cybersecurity Belgium (CCB) to help Belgian organizations implement essential cybersecurity practices. The framework provides a structured approach to cybersecurity improvement based on internationally recognized standards, adapted for the Belgian regulatory context.

Published by the Centre for Cybersecurity Belgium, CyFun applies to Belgian organizations across sectors seeking to improve cybersecurity maturity and comply with NIS2 Directive requirements. It offers four implementation levels allowing organizations to select the tier appropriate to their risk profile and maturity ambitions.

Organizations implement CyFun by assessing current practices against the framework’s subcategories, selecting their target implementation level, developing improvement plans, and progressively enhancing cybersecurity capabilities aligned with Belgian regulatory expectations.

Why it Matters

Belgium CyFun provides a clear, structured path for Belgian organizations to improve cybersecurity practices in alignment with NIS2 Directive requirements and CCB guidance.

Key benefits include:

• Align with NIS2 requirements

Implement security measures meeting NIS2 Directive obligations through CCB-endorsed guidance.

• Improve cybersecurity maturity

Progress systematically through four implementation levels building comprehensive security capabilities.

• Leverage recognized standards

Build on internationally recognized frameworks including NIST CSF and ISO 27001 with Belgian-specific guidance.

• Demonstrate security posture

Show CCB and regulators organized cybersecurity improvement aligned with national guidance.

• Right-size security investments

Select appropriate implementation levels matching organizational risk profile and resources.

How it Works

CyFun is based on the NIST Cybersecurity Framework structure, organized across Identify, Protect, Detect, Respond, and Recover functions. Four implementation levels (Small, Important, Essential, Critical) provide guidance at increasing rigor, allowing organizations to select the level matching their NIS2 classification and risk appetite.

Organizations implement CyFun by conducting maturity assessments, selecting target implementation level, developing prioritized improvement roadmaps, and progressively implementing required security measures. CCB provides guidance materials and assessment tools supporting implementation.

Within SmartSuite, Belgian organizations track CyFun subcategory implementation, manage improvement roadmaps, coordinate evidence collection, and maintain compliance documentation supporting NIS2 regulatory requirements.

Key Elements

• Four Implementation Levels

Small, Important, Essential, and Critical levels matching different risk profiles and NIS2 classifications.

• NIST CSF-Based Structure

Organized across Identify, Protect, Detect, Respond, and Recover functions with Belgian-specific guidance.

• NIS2 Alignment

Designed to satisfy NIS2 Directive security measure requirements for Belgian entities.

• Maturity Assessment Tools

CCB-provided tools for assessing current implementation level and identifying improvement priorities.

Framework Scope

Belgium CyFun applies to Belgian organizations, particularly those subject to NIS2 Directive requirements. Applicable across sectors with guidance appropriate for varying organizational sizes and risk profiles.

Framework Objectives

Belgium CyFun provides a structured path for improving cybersecurity aligned with NIS2 Directive requirements and CCB guidance.

• Implement security measures satisfying NIS2 Directive requirements for Belgian entities
• Progress systematically through maturity levels building comprehensive security capabilities
• Align Belgian organizational security practices with internationally recognized standards
• Demonstrate cybersecurity improvement to CCB and sectoral regulators
• Right-size security investments based on organizational risk profile

Common Framework Mappings

Mapped frameworks include:

EU NIS2 Directive

ISO/IEC 27001

NIST Cybersecurity Framework

SOC 2