CyFun Certification and Verification Support in Belgium
Reach the CyFun® level the CCB expects, on time. We scope your NIS2 obligations, close the gaps on the CyFun® key measures and prepare the evidence your conformity assessment body will check, led by an ISO 27001 Lead Implementer.
CyberFundamentals (CyFun®) is the cybersecurity framework of the Centre for Cybersecurity Belgium (CCB) and the backbone of conformity assessment under the Belgian NIS2 law of 26 April 2024 and its Royal Decree of 9 June 2024. It comes in three cumulative assurance levels: Basic, Important and Essential. Basic and Important are verified, Essential is certified, always by a conformity assessment body (CAB) accredited by BELAC and authorised by the CCB, and a positive result gives you a presumption of conformity with the NIS2 security measures. Essential entities must undergo a regular conformity assessment: according to the CCB, they must show Essential-level conformity by 18 April 2027, or submit a remediation plan with an Important-level verification to reach Essential by 18 April 2028. Important entities have no formality to complete but must implement the measures, and a voluntary verification is the simplest way to prove it. ICTLAB prepares you for that assessment; it does not assess or certify you, which keeps the CAB audit independent. We determine your entity category and CyFun® level, assess your maturity against the key measures (scored for policy and implementation), build the remediation roadmap, write the policies and procedures, assemble the evidence pack and run an internal pre-audit before the CAB visit. CyFun® 2023 and CyFun® 2025 coexist until 18 April 2027, so we also help you choose the version to apply. Already running, or planning, ISO 27001? We map CyFun® to your Statement of Applicability so one programme serves both.
What We Deliver
Scoping & CyFun Level Selection
Confirmation of your NIS2 category (essential or important), the assessment scope (whole organisation, or a documented IT/OT separation) and the CyFun® level, based on your risk assessment and the CCB selection tool. Timeline: 1 to 2 weeks.
Gap Assessment on the Key Measures
A guided CyFun® self-assessment of every requirement of your level, scored for policy and implementation, with particular attention to the key measures such as backups, multi-factor authentication and patch management. Timeline: 2 to 4 weeks.
Remediation Roadmap
A prioritised plan that closes the key measures first, with owners, effort estimates and milestones aligned with the CCB dates. It can also serve as the remediation plan the CCB transitional approach asks essential entities to submit. Delivered with the gap report.
Policies, Procedures & Technical Measures
The documents CyFun® expects (security policy, access management, backup, vulnerability management, incident response with CCB notification, supplier security) and hands-on support to implement the technical measures. Timeline: indicatively 2 to 9 months, depending on level and starting maturity.
Evidence Pack
A structured evidence file per requirement and per key measure (documents, screenshots, logs, records), cross-referenced to your self-assessment so the CAB can verify it efficiently. Built progressively during remediation.
Internal Pre-audit & CAB Assessment Support
A mock assessment run like the CAB will run it, then support before and during the verification or certification audit, follow-up of findings and the CyFun® label request in the Safeonweb@work portal. Timeline: pre-audit 1 to 2 weeks before the CAB visit.
How We Work
Scope & Level
Confirm your NIS2 category, define the scope and select the CyFun® level and version (2023 or 2025) with a documented risk rationale.
Gap Assessment
Run the CyFun® self-assessment with your teams and measure policy and implementation maturity on every requirement and key measure.
Roadmap
Prioritise the gaps, key measures first, and plan the work against the CCB milestones of 18 April 2027 and, if needed, 18 April 2028.
Remediation & Documentation
Write the policies and procedures, implement the technical measures and collect evidence as you go.
Internal Pre-audit
Test the evidence pack against the requirements of your level and fix the last gaps before you book the CAB.
CAB Assessment & Label
Support you during the verification or certification by your authorised CAB, close the findings and request the CyFun® label.
Technologies We Use
Frequently Asked Questions
What is CyFun and who needs it?
CyFun® (CyberFundamentals) is the cybersecurity framework published by the Centre for Cybersecurity Belgium (CCB). It draws on the NIST Cybersecurity Framework, ISO/IEC 27001 and 27002, the CIS Controls and IEC 62443, and it is free of charge. Under the Belgian NIS2 law of 26 April 2024, essential entities must undergo a regular conformity assessment, for which CyFun® is the reference route. Important entities can use a voluntary CyFun® verification to obtain a presumption of conformity, and suppliers increasingly use it to answer customer security questionnaires.
Which CyFun level do I need: Basic, Important or Essential?
The level follows from your risk assessment, supported by the CCB CyFun® selection tool. For essential entities, the CCB expects measures equivalent to CyFun® Essential unless a documented risk assessment justifies a lower level, a choice made on the entity's own responsibility (Article 7 of the Royal Decree of 9 June 2024) that the inspection service can challenge. Important entities generally target Basic or Important, depending on their risk profile. The levels are cumulative: Important contains Basic, and Essential contains both.
What is the difference between CyFun verification and CyFun certification?
Verification applies to the Basic and Important levels: the CAB checks your self-assessment and the key measures and issues a verification statement. Certification applies to the Essential level: a more extensive audit, with evidence of implementation for each key measure, leading to a certificate. In both cases the CAB must be accredited by BELAC (or an equivalent accreditation body) and authorised by the CCB, and once the assessment is finalised you can request a CyFun® label in the Safeonweb@work portal.
What are the CCB deadlines for CyFun?
For essential entities, the CCB set a first milestone on 18 April 2026 (at least a CyFun® Basic or Important verification statement, now passed). By 18 April 2027 they must hold a CyFun® Essential certificate when Essential is the applicable level. Under the transitional approach the CCB communicated in August 2026, an entity that is not there yet can submit a remediation plan with a CyFun® Important verification and reach Essential by 18 April 2028. Entities that justified a lower level must demonstrate conformity with it by 18 April 2027. Entities that came into scope later should check their own timeline with the CCB.
Does ICTLAB issue the CyFun certificate or verification statement?
No. Only a conformity assessment body accredited by BELAC and authorised by the CCB can verify or certify you; the CCB publishes the list of authorised CABs on Safeonweb@work. ICTLAB prepares you: scoping, gap assessment, remediation, evidence pack and internal pre-audit, then support during the CAB audit. Keeping preparation and assessment separate is what makes the result credible to the CCB, your customers and your board.
How long does CyFun preparation take, and what does it cost?
It depends on your level, size and starting maturity. As an indication, an organisation with sound IT hygiene can be ready for a Basic or Important verification in about 2 to 4 months, while an Essential certification usually takes 6 to 12 months of remediation. The CyFun® framework and its tools are free; you pay the preparation work and the CAB, which invoices its assessment directly. ICTLAB quotes on request after a short scoping call, and the gap assessment gives the most reliable estimate of the remaining effort.
Can CyFun be combined with ISO 27001?
Yes, and it is often the most efficient option. ISO 27001 provides the management system (risk process, internal audit, management review, continual improvement) and CyFun® the control baseline the CCB recognises. For NIS2, an ISO 27001 certificate only counts if its scope covers the whole organisation and its Statement of Applicability is equivalent to your CyFun® level. Mapping the CyFun® requirements into the SoA lets one certificate serve international customers and the Belgian regulator, and the CCB can issue a CyFun® label on the basis of an ISO/IEC 27001:2022 certificate.
From Our Blog
8 November 2026
How Much Does ISO 27001 Certification Cost in Belgium (2026)?
ISO 27001 certification cost in Belgium for 2026: consulting, Stage 1 and 2 audits, surveillance and internal effort by company size. Plan your budget now.
8 November 2026
CyFun vs ISO 27001: Which One for NIS2 in Belgium?
CyFun or ISO 27001 for NIS2 in Belgium? Compare levels, CCB presumption of conformity, effort and the April 2027 deadline, then choose your route.
5 November 2026
ISMS & ISO 27001 Audit: What Auditors Check, Step by Step
How an ISMS is audited for ISO 27001: mandatory documents, Stage 1 vs Stage 2, nonconformities and the NIS2 route in Belgium. Get audit-ready.
13 June 2026
DORA vs NIS2: Overlap, Differences and Which One Applies
DORA and NIS2 both govern cyber resilience, but which applies to your organisation? Scope, the lex specialis rule, the five DORA pillars, key dates, and a decision guide for Belgian entities.
13 June 2026
DORA ICT Third-Party Risk: Building Your Register of Information
DORA's third-party rules (Art. 28 to 30): what the Register of Information must contain, the mandatory contractual clauses (Art. 30(2) vs 30(3)), critical-or-important functions, and the 2025 reporting deadlines.
12 June 2026
NIST CSF 2.0 for European SMEs: A Practical Implementation Guide
A step-by-step guide to NIST Cybersecurity Framework 2.0 for European SMEs: the six functions (Govern, Identify, Protect, Detect, Respond, Recover), tiers, profiles, and how it maps to NIS2 and ISO 27001.
Related Services
NIS2 Compliance
Navigate NIS2 with confidence. We help Belgian organizations understand their obligations, close compliance gaps, and build the security capabilities the directive demands.
ISO 27001 Certification
Get certification-ready without the overhead. We build a right-sized ISO/IEC 27001:2022 ISMS: risk-based, audit-ready, integrated with your NIS2, GDPR and DORA obligations, and guided by an ISO 27001 Lead Implementer.
Security Audit
Comprehensive evaluation of your security posture against industry standards. Our audits identify gaps and provide actionable remediation plans.