CyFun or ISO 27001? It is the first question most Belgian organisations ask once they know they fall under NIS2. Both can give you a presumption of conformity with the Belgian NIS2 law, both are assessed by an independent body, and both cover broadly the same security ground. They are not interchangeable, though: CyFun® is a free, Belgian, control-oriented framework with three assurance levels, while ISO/IEC 27001 is an international management-system standard with a certification cycle. The short answer: CyFun® is usually the fastest route for a Belgian SME that only needs to satisfy the CCB; ISO 27001 pays off when international customers ask for it; and many organisations end up combining both. This guide compares them side by side, with the deadlines exactly as the Centre for Cybersecurity Belgium (CCB) publishes them.
Key takeaways
- CyFun® (CyberFundamentals) is the CCB’s framework with three assurance levels: Basic, Important and Essential. Basic and Important are verified; Essential is certified.
- Under the NIS2 law of 26 April 2024 and the Royal Decree of 9 June 2024, essential entities must undergo a regular conformity assessment: CyFun®, ISO/IEC 27001 or a CCB inspection.
- An ISO 27001 certificate only counts if its scope covers the whole organisation and its Statement of Applicability is equivalent to the applicable CyFun® level.
- Key CCB date: by 18 April 2027, essential entities must show Essential-level conformity, or submit a remediation plan to reach it by 18 April 2028.
- Important entities have no formality to complete, but must implement the measures; voluntary verification gives them a presumption of conformity.
What is CyFun (CyberFundamentals)?
The CyberFundamentals Framework (CyFun®) is a set of concrete cybersecurity measures published by the CCB. It draws on the NIST Cybersecurity Framework, ISO/IEC 27001 and 27002, the CIS Critical Security Controls and IEC 62443, and it uses anonymised data on real cyberattacks to select the measures that matter most. The framework and its self-assessment tools are free of charge.
Two versions coexist: CyFun® 2023 and CyFun® 2025, the latter aligned with NIST CSF 2.0 and NIS2, with more weight on supply chain, operational technology (OT) and board-level governance. According to the CCB, entities can choose which version they apply until 18 April 2027; after the transition period, only the new version will be accepted.
Each control is scored on a 1 to 5 maturity scale for both policy (what is written) and implementation (what is done). To pass, you must reach the overall maturity threshold of your level and meet every key measure, the non-negotiable controls such as backups, multi-factor authentication or patch management.
| CyFun® level | Designed against | Conformity assessment | Typical profile |
|---|---|---|---|
| Basic | Known, common cyber risks, with measures generally already available | Verification by an authorised CAB (verification statement) | Small important entities, suppliers asked for a baseline |
| Important | Targeted attacks by actors with common skills and resources | Verification by an authorised CAB (verification statement) | Most important entities, essential entities on the transitional path |
| Essential | Advanced attacks by actors with extensive skills and resources | Certification by an authorised CAB (certificate) | Essential entities, unless a lower level is justified by risk |
The levels are cumulative: Important contains Basic, and Essential contains both. Once the conformity assessment is finalised, you can request a CyFun® label in the Safeonweb@work portal.
What is ISO 27001?
ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS). It does not prescribe a fixed list of measures: it requires you to run a management system (context, leadership, risk assessment, internal audit, management review, continual improvement) and to select, from the 93 Annex A controls, those your risks require, justified in a Statement of Applicability (SoA). Certification is granted by an accredited certification body for three years, with surveillance audits at least once per calendar year and a recertification audit before expiry. For the audit itself, see our guide to the ISMS and ISO 27001 audit.
Presumption of conformity under the Belgian NIS2 law
The Belgian NIS2 law of 26 April 2024, in force since 18 October 2024, and its Royal Decree of 9 June 2024 organise conformity assessment around CyFun®. A presumption of conformity can be obtained through a CyFun® verification (Basic and Important), a CyFun® certification (Essential) or an ISO/IEC 27001 certification, provided the CCB finds the scope and SoA acceptable. For essential entities a regular conformity assessment is mandatory, through one of three routes: CyFun® certification or verification by an authorised CAB, ISO/IEC 27001 certification by an authorised CAB, or an assessment by the CCB inspection service. Important entities may opt for it voluntarily; they have no administrative formality to complete, but the CCB can ask for evidence that the measures are in place, for example after an incident. Not sure which category you are in? Start with NIS2 sectors: who must comply in Belgium.
The ISO 27001 route: two CCB conditions
- Scope: the conformity assessment covers the organisation as a whole, unless IT/OT environments are physically and/or technically separated so that the excluded part cannot influence the risks of the part in scope. The SoA follows the same scope.
- Equivalence: the SoA must demonstrate measures equivalent to the CyFun® level that applies to you. The CCB compares your SoA with the corresponding CyFun® measures, which in practice means a documented mapping.
In both routes, the assessor must be a conformity assessment body accredited (in Belgium by BELAC) and authorised by the CCB; the CCB publishes the list of authorised CABs.
Deadlines for essential entities, as published by the CCB
| Date | CyFun® route | ISO 27001 route |
|---|---|---|
| 18 April 2026 (passed) | At least a CyFun® Basic or Important verification statement from an authorised CAB | Scope of the future certification, SoA and most recent internal audit sent to the CCB |
| 18 April 2027 | CyFun® Essential certificate (when Essential is the level that applies) | ISO 27001 certificate with an SoA equivalent to CyFun® Essential |
| 18 April 2028 (transitional approach) | Essential reached, if a remediation plan with a CyFun® Important verification was submitted in 2027 | Essential equivalence reached, if a remediation plan with an ISO certificate and an Important-equivalent SoA was submitted in 2027 |
The transitional approach comes from a communication of the CCB inspection service sent to essential entities in August 2026; it does not change the legal deadlines. An entity whose risk assessment justifies a lower CyFun® level (Article 7 of the Royal Decree) must demonstrate conformity with that level by 18 April 2027 and document the justification. Organisations that came into scope later should check their own timeline with the CCB. Source: CCB FAQ on NIS2 and CyberFundamentals.
CyFun vs ISO 27001: side-by-side comparison
| CyFun® | ISO/IEC 27001 | |
|---|---|---|
| Nature | Framework of concrete security measures, by maturity level | Management-system standard (ISMS) plus 93 Annex A controls selected by risk |
| Publisher | Centre for Cybersecurity Belgium (CCB) | ISO and IEC |
| Scope for NIS2 | Whole organisation (IT/OT separation as the only exception) | Whole organisation, same rule, plus an SoA mapped to CyFun® |
| International recognition | Built for Belgium, gaining recognition abroad, little known by foreign customers | Worldwide; the reference customers and tenders ask for |
| Effort | Lower: prescriptive measures, self-assessment tool, step-by-step levels | Higher: risk methodology, documented ISMS, internal audit, management review |
| Cost (order of magnitude) | Framework free; you pay implementation and the CAB. Generally the lighter budget | Standard to purchase, more consulting days, audit days set by headcount. Generally the heavier budget |
| Assessment | Verification (Basic, Important) or certification (Essential) by a CAB authorised by the CCB | Two-stage certification audit by an accredited certification body (authorised by the CCB for NIS2) |
| Renewal | Periodic reassessment under the CyFun® Conformity Assessment Scheme; check the cycle with your CAB | 3-year certificate, surveillance audits at least yearly, then recertification |
| NIS2 presumption of conformity | Direct, at the level verified or certified | Only if the CCB accepts the scope and SoA |
For indicative budgets and durations on the ISO side, read how much ISO 27001 certification costs in Belgium.
CyFun or ISO 27001: which one should you choose?
The right answer depends less on the framework than on who needs to trust your security. Four common profiles:
1. SME, important entity, Belgian customers
Start with CyFun® Basic or Important. You have no formality to complete, but you must implement the measures and be able to prove it. A CyFun® verification gives you a presumption of conformity, a label you can show customers, and a clear, prescriptive to-do list without the overhead of a full ISMS. You can always add ISO 27001 later on the same foundations.
2. Essential entity
Choose the route your evidence already supports. If you hold, or are close to, an ISO 27001 certificate with a full-organisation scope, extend the SoA with a CyFun® Essential mapping. If not, the CyFun® path (Important verification now, Essential certification next) is usually the most direct way to meet the 18 April 2027 milestone or the 2028 transitional target. Either way, document the risk assessment that justifies your level.
3. Multinational or group with Belgian entities
ISO 27001 as the common language, CyFun® as the Belgian overlay. A group-wide ISMS is easier to run across countries and is recognised by every regulator and customer. For the Belgian NIS2 entities, check that the certificate scope really covers them as a whole and add the CyFun® mapping to the SoA. The CCB has published guidance for entities that are part of a larger organisation on the CyFun® website.
4. Supplier asked by its customers
NIS2 makes your customers responsible for their supply chain security, so questionnaires and contract clauses are reaching suppliers that are not NIS2 entities themselves. If your customers are Belgian, a CyFun® Basic or Important label is a proportionate answer. If they are international or ask for “ISO 27001” by name, certify. Ask before you invest: many procurement teams accept either.
How to combine CyFun and ISO 27001
The two are complementary: ISO 27001 tells you how to manage security, CyFun® tells you whichmeasures the Belgian regulator expects. A combined approach avoids running two programmes in parallel.
- One scope: define the ISMS scope as the whole organisation (or document the IT/OT separation), so that it is valid for both NIS2 and ISO.
- One risk assessment: use it to determine your CyFun® level with the CCB selection tool and to drive your ISO risk treatment.
- One SoA, mapped: use the CCB’s CyFun® mapping to link each CyFun® requirement of your level to Annex A controls, and add the CyFun® key measures that Annex A does not cover explicitly.
- One evidence base: run the CyFun® self-assessment as part of your internal audit, so the maturity scores and the ISO evidence come from the same records.
- One certificate, two uses: certify the ISMS, share scope and SoA with the CCB and, if useful, request a CyFun® label based on your ISO/IEC 27001:2022 certificate, with evidence for each key measure.
For the full clause-by-clause view of NIS2 and ISO 27001, read NIS2 and ISO 27001 in Belgium; to measure where you stand, start with an ISO 27001 gap analysis.
How ICTLAB helps you choose and deliver
ICTLAB’s compliance practice is led by Caner Korkut, ISO 27001 Lead Implementer. We start from the regulatory question (essential or important entity, which CyFun® level, which customers), recommend the lightest route that holds, then build it: risk assessment, CyFun® self-assessment, ISMS and SoA mapping, technical measures and preparation for the CAB. Explore our NIS2 compliance support and ISO 27001 certification support, or book a 30-minute scoping call.
CyFun vs ISO 27001: frequently asked questions
Is CyFun or ISO 27001 mandatory for NIS2 in Belgium?
For essential entities, a regular conformity assessment is mandatory, and the CCB accepts three routes: CyFun® certification or verification by an authorised conformity assessment body (CAB), ISO/IEC 27001 certification by an authorised CAB, or an assessment by the CCB inspection service. Important entities have no administrative formality to complete, but must still implement the NIS2 security measures; a voluntary CyFun® verification or ISO 27001 certification gives them a presumption of conformity.
Which CyFun level do I need: Basic, Important or Essential?
The level follows from your risk assessment, supported by the CCB’s CyFun® selection tool. For essential entities, the CCB expects measures equivalent to CyFun® Essential unless a documented risk assessment justifies a lower level, a choice the entity makes on its own responsibility (Article 7 of the Royal Decree of 9 June 2024) and that the inspection service can challenge. Important entities generally target Basic or Important, depending on their risk profile.
Does an ISO 27001 certificate automatically give a presumption of conformity with NIS2?
No. The certificate must be issued by an accredited CAB authorised by the CCB, its scope must cover the whole organisation (exclusions only for physically or technically separated IT/OT environments), and the Statement of Applicability must demonstrate measures equivalent to the CyFun® assurance level that applies to you. A narrow certificate covering one product or site will usually not be enough.
What must an essential entity have in place by 18 April 2027?
According to the CCB, either a CyFun® Essential certificate, or an ISO 27001 certificate with a Statement of Applicability equivalent to CyFun® Essential. Entities that are not there yet can follow the CCB’s transitional approach: submit a remediation plan with evidence at CyFun® Important level and a plan to reach Essential by 18 April 2028. Entities that justified a lower level must demonstrate conformity with that level by 18 April 2027.
What is the difference between a CyFun verification and a CyFun certification?
Verification applies to the Basic and Important levels: the CAB checks your self-assessment and the key measures and issues a verification statement. Certification applies to the Essential level: a more extensive audit, with evidence of implementation for each key measure, leading to a certificate. In both cases the CAB must be accredited by BELAC (or an equivalent accreditation body) and authorised by the CCB.
Can CyFun and ISO 27001 be combined?
Yes, and for many organisations it is the most efficient option. ISO 27001 provides the management system (risk process, internal audit, management review, continual improvement) and CyFun® provides a control baseline the CCB recognises. Mapping the CyFun® requirements into your Statement of Applicability lets one certificate serve international customers and the Belgian NIS2 regulator, and the CCB can issue a CyFun® label on the basis of an ISO/IEC 27001:2022 certificate.
Is CyFun cheaper than ISO 27001?
Usually yes. The CyFun® framework and its self-assessment tools are free of charge, and the Basic and Important levels are verified rather than certified. ISO 27001 adds management-system work (documented ISMS, internal audits, management reviews) and a three-year certification cycle with yearly surveillance audits. The real cost depends on your size, scope and starting maturity; a gap analysis gives the clearest estimate.
General information based on the Belgian NIS2 law of 26 April 2024, the Royal Decree of 9 June 2024, the CyFun® framework and the CCB FAQ and communications available on 8 November 2026; not legal advice. The CCB may update its guidance and timelines: always check the latest version on the CCB and Safeonweb@work websites.