CyFun

The CyberFundamentals Framework (CyFun) is the Centre for Cybersecurity Belgium's (CCB) national cybersecurity framework, designed so that Belgian organizations of any size can structure and demonstrate their security, and since NIS2 transposition it is the recognized route for Belgian NIS2 entities to show compliance.

It has a Small starter level plus three assurance levels: Basic, Important, and Essential, which correspond to rising threat exposure and, under Belgian NIS2 law, to whether an entity is important or essential. The controls are drawn from NIST CSF, ISO/IEC 27001 and 27002, IEC 62443, and the CIS Controls, and each level has a self-assessment tool that produces a maturity score.

CyFun 2025 is the current edition, aligned with NIST CSF 2.0 (verify the edition in force on the CCB site).

CyFun has a formal conformity assessment scheme validated by BELAC, the Belgian accreditation body: a Conformity Assessment Body accredited by BELAC and authorized by the CCB verifies the organization's self-assessment and issues a verification (Basic) or certification (Important and Essential).

Essential entities under Belgian NIS2 law must obtain either a CyFun Essential certificate or an ISO/IEC 27001 certificate or accept a CCB inspection.

In writing, an organization needs an information security policy, an asset inventory, a risk assessment, the completed CyFun self-assessment with evidence for each control at the target level, incident response and business continuity plans, supplier management records, and the management approval of the self-assessment.