Belgium CyFun — Cybersecurity Framework

Why does it matter?

CyFun gives Belgian organizations one framework that supports the NIS2 routes to conformity, scales by assurance level, and lets them self-assess before an independent body verifies or certifies the result.

Key benefits include:

• Right-sized assurance levels

Basic holds the standard measures for all enterprises, Important is designed to minimize the risk of targeted attacks by actors with common skills and resources, and Essential addresses advanced attacks by actors with extensive skills and resources.

• A route to NIS2 presumption

In Belgium, CyFun verification at Basic or Important, or certification at Essential, gives a presumption of conformity to NIS2.

• International alignment

CyFun 2025 was created to match NIST CSF 2.0 and legislation such as NIS2, and the CCB publishes a mapping to the NIS2 Directive, the Belgian NIS2 law, and other frameworks.

• A scored self-assessment

Each control is scored from 1 to 5 for policy maturity and for implementation maturity, and results are compared against the Conformity Assessment Scheme thresholds.

• Board-level and supply chain focus

CyFun 2025 introduces Governance Measures for board-level oversight and expands its focus on supply chain security and operational technology.

How does it work?

CyFun 2025 follows a NIST CSF-style structure of categories, sub-categories such as ID.AM-01, and controls, and adds a specific goal to each control. Each assurance level has key measures that must be met, and an overview document compares the key measures of the three levels and of CyFun 2023 and 2025.

The Excel self-assessment tool, one per assurance level, scores every control from 1 to 5 for policy maturity (written rules and procedures) and implementation maturity (day-to-day practice). It averages scores by sub-category and category, shows a total maturity level and a radar chart, and flags in red or green whether the Conformity Assessment Scheme thresholds are met. The tool must not be modified during a verification or certification.

In SmartSuite, Compliance Management holds the controls of the chosen assurance level with maturity scores, testing, and evidence, Cyber & IT Risk supports the risk assessment, and Enterprise Reporting shows progress against the thresholds.

Key Elements

• Assurance levels

Basic, Important, and Essential. The CyFun Selection Tool uses a risk assessment to determine the right level for an organization, and organizations can start with the Basic controls and add Important and Essential controls.

• Key measures

Measures that must be met at each assurance level, listed in an overview document that also compares CyFun 2023 and CyFun 2025.

• Controls and guidance

Controls reformulated in CyFun 2025 for clarity and auditability, each with a specific goal, complemented by guidance from NIST CSF, ISO/IEC 27001 and 27002, IEC 62443, and CIS Controls.

• Governance Measures

Added in CyFun 2025 to align with global best practice for board-level cyber security oversight.

• Self-assessment and maturity scoring

Policy maturity and implementation maturity scores from 1 to 5 per control, rolled up by sub-category and category and compared with Conformity Assessment Scheme thresholds.

• Conformity assessment and label

An authorized CAB verifies (Basic and Important) or certifies (Essential) the self-assessment and the implementation of mitigating measures, and the organization can then request its CyFun label.

• Versions and transition

CyFun 2023 was the first edition and CyFun 2025 is the current one. Until 18 April 2027 either may be used for self-assessment, after which only the new version is accepted.

What does it cover?

CyFun is open to organizations of any size. A risk assessment with the Selection Tool determines whether Basic, Important, or Essential applies. In Belgium it is tied to NIS2 through the conformity routes above. The CCB also publishes guidance for entities that are part of a larger organization, and CyFun 2025 gives more attention to supply chain security and operational technology.

What are its objectives?

The CCB positions CyFun as a clear, step-by-step approach to growing digital resilience.

Help organizations protect their data and reduce the risk of the most common cyber-attacks.

Let organizations grow resilience through three assurance levels, from Basic to Essential.

Provide a self-assessment that an independent CAB can verify or certify.

Align with NIST CSF 2.0 and with national and European legislation such as NIS2.

Support supply chain security, operational technology, and board-level oversight.

Framework in Context

The CCB's CyFun 2025 mapping links the framework's requirements to the NIS2 Directive, the Belgian NIS2 law, and other frameworks. CyFun draws on the NIST Cybersecurity Framework, ISO/IEC 27001 and 27002, IEC 62443, and the CIS Critical Security Controls, so organizations commonly reuse evidence across those standards.

Common Framework Mappings

Organizations that use CyFun map it to the standards below, which the CCB lists as sources of its requirements and guidance or as related regulation.

Mapped frameworks include:

NIS2 (EU 2022/2555)

NIST CSF 2.0

ISO 27001:2022

ISO 27002:2022

IEC 62443

CIS Controls v8.1