CyberFundamentals: how can you prove your SME complies with NIS2?

The scenario in brief

Example, made up for illustration. A 70-person distribution company learns that it falls under the NIS2 law. The managing director already has antivirus, backups and multi-factor authentication. The question is simple: ‘How do I prove, tomorrow, that we are compliant?’

The Belgian answer comes down to one word: CyberFundamentals, often shortened to CyFun. It is a set of security measures, published free of charge by the CCB, that works as both a roadmap and proof. Here is how it works, without the jargon.

What is CyberFundamentals?

CyberFundamentals is a cybersecurity framework created by the Centre for Cybersecurity Belgium (CCB), the national authority in charge of NIS2. A ‘framework’, here, means a structured list of measures: who can access what, how you back up, how you respond to an attack, and so on.

It does not start from scratch, and that is what makes it credible:

• Recognised standards: it draws on international security standards, including ISO/IEC 27001 and the American NIST framework.
• Real attacks: the measures were chosen on the basis of data from successful attacks. You protect yourself first against what actually happens.
• A shared framework: Ireland has chosen the same framework. It has become a joint owner and is preparing to adopt it as its national scheme, according to its National Cyber Security Centre.

The Belgian NIS2 law of 26 April 2024 has applied since 18 October 2024. Its article 42 is clear: an entity that has its measures assessed by an approved body is presumed to be compliant, unless proven otherwise. If you are inspected, the proof is already there.

The levels: from simplest to most demanding

CyFun builds up like a staircase. Each level includes the one before and adds measures. The choice is not a matter of gut feeling: the CCB provides a risk assessment tool that tells you which level suits your business.

For an SME that is not itself covered by NIS2, the Basic level is the right place to start: it is the first level, the one that protects against the most common attacks.

Self-assessment, verification, certification: three steps

The process always follows the same logic: you measure where you stand yourself, you fix the gaps, then an independent third party confirms. That third party is a conformity assessment body (often called a CAB). It must be accredited by a national accreditation body (in Belgium, BELAC), then approved by the CCB.

1. Choosing the level: you, with the CCB's risk assessment tool.
2. Self-assessment: you, with your IT provider if needed.
3. Verification (Basic and Important): an accredited body gives you a report that confirms your level, or not.
4. Certification (Essential): an accredited body issues a CyFun Essential certificate.

The self-assessment is the most useful part for a business owner. It is done measure by measure, with two maturity scores: one for what is written down (procedures, rules), the other for what is actually done. The result becomes your action plan for the months ahead.

What if you already have ISO 27001?

CyFun is not the only way in. Under the Royal Decree of 9 June 2024, an essential entity can also go through ISO/IEC 27001 certification (the international standard for information security management), or opt for a direct inspection by the CCB based on a self-assessment. For an SME with no existing certification, CyFun is usually the most accessible route.

The timetable for your status

It all depends on the category the law puts you in. Both categories have the same security obligations; what differs is how they are supervised.

So an important entity does not have to go through verification. But if the CCB inspects it, it will have to show what it has put in place. A voluntary verification, at least at Important level, is the clearest way to do that: it gives the same presumption of conformity.

What the label does not do for you

The label proves that your security measures are in place. It does not cover all of NIS2. Three obligations still have to be handled separately:

• Report serious incidents to the CCB: an early warning within 24 hours, a notification within 72 hours, a final report no later than one month afterwards.
• Involve senior management: it approves the measures, oversees their implementation, is accountable for them and takes cybersecurity training.
• Register with the CCB, if you have not done so yet.

Nor is a label a protection in itself. It is a snapshot of things at one point in time. If backups are no longer tested six months later, the label will not save you from an attack.

Not in scope? CyFun is still useful

Many Belgian SMEs are below the NIS2 thresholds (in principle, fewer than 50 full-time staff and annual turnover or balance sheet total below 10 million euros). Three reasons to look at CyFun anyway:

1. Your customers will ask you for it. The law requires NIS2 organisations to secure their relationships with their direct suppliers. They will ask you questions, or even require a CyFun level. Having the Basic level in hand saves you from answering in a rush.
2. It is a free list of priorities. The documents and self-assessment tools are published by the CCB at no cost. They are a far better guide than a list of good practices found at random.
3. Your insurer speaks the same language. A recognised framework makes security questionnaires easier, whatever they are: the expected measures largely overlap.

What to do on Monday morning

1. Check whether NIS2 applies to you (sector, headcount, turnover) to find out whether you are essential, important or out of scope.
2. Download CyberFundamentals and the risk assessment tool from the CCB website, then note the level it gives you.
3. Block out two half-days with the person who looks after your IT, in-house or external, to complete the self-assessment measure by measure.
4. Sort the gaps into three columns: this month, this quarter, this year. Start with multi-factor authentication, off-site backups and updates.
5. Keep the evidence as you go: screenshots, written procedures, reports of restore tests. The verifier will ask for them.
6. Once the score is reached, ask two approved bodies for a quote for the verification.

This process takes time, but every step already reduces your risk. Even without going as far as the label, an honest self-assessment is better than none.

Prepare your self-assessment→