A Belgian framework built by the CCB on recognised standards
CyFun® is the cybersecurity framework developed by the Centre for Cybersecurity Belgium (CCB), which still owns it and makes it available free of charge. It draws on the NIST Cybersecurity Framework, ISO 27001, IEC 62443 and the CIS Controls and uses anonymised data on successful cyber attacks to focus on what actually protects you.
CyFun® 2025, launched in October 2025, is aligned with NIST CSF 2.0 and NIS2 and organises its requirements into six functions running from governance to recovery after an incident. It coexists with CyFun® 2023 until 18 April 2027 and you are free to choose your version until then, with the framework and its tools published on the CCB's CyberFundamentals page.
Three assurance levels that build on each other from Basic to Essential
Each level takes over everything from the one before and adds its own requirements, including key measures drawn from the most common attacks that must be in place whatever happens.
- Basic brings together the standard measures for any business and its 13 key measures cover multi-factor authentication, least privilege, firewalls, backups, patching and anti-malware among others.
- Important is also designed for targeted attacks by actors with common skills and resources and adds 9 key measures, from remote access to critical systems to vulnerability management and reporting significant incidents to the authorities.
- Essential addresses advanced attacks by actors with extensive resources and adds 7 key measures centred on supplier contracts, maintenance, portable storage devices and mapping network data flows.
The maturity bar rises too, since each key measure must score 2.5 out of 5 at Basic and 3 out of 5 at Important and Essential, which also requires 3 out of 5 in every category. The starting level Small, designed for micro-organisations, serves as an initial assessment but is not among the routes to the presumption of NIS2 conformity described by the CCB.
A risk assessment that determines your level
Your level follows from a risk assessment rather than from your NIS2 status alone. The CCB provides the CyFun® Selection Tool for this, an Excel workbook organised by NIS2 sector in which you estimate, for five types of attack ranging from sabotage to ransomware, the impact on your organisation and the likelihood that each type of attacker will strike. Weighted by your size and by whether attacks are targeted, the total points to Basic below 100 points, Important from 100 to 199 and Essential from 200 upwards.
An essential entity may also justify a lower level, Important for instance, if its risk assessment supports it. This needs no prior approval from the CCB but must be documented, because the inspection service can check it and sanction a wrongly chosen level.
Verification or certification depending on the level you target
In Belgium the presumption of NIS2 conformity comes from a CyFun® verification for Basic and Important, a CyFun® certification for Essential or an ISO 27001 certification whose scope and Statement of Applicability the CCB accepts. CyFun® assessments are carried out by a conformity assessment body (CAB) accredited by BELAC and authorised by the CCB, based on your self-assessment and evidence of implementation.
The timetable depends on your status:
- Essential entities that chose CyFun® had to hold a Basic or Important verification by 18 April 2026 at the latest.
- If their risk assessment points to Essential, they must be certified by 18 April 2027 or else present an Important verification with a plan to reach Essential by 18 April 2028.
- Important entities are in principle only supervised after the fact but must apply the measures in the law and may volunteer for assessment to benefit from the presumption of conformity too.
- The CCB advises suppliers of NIS2 entities to apply at least the Basic level, which a NIS2 customer could also impose on them by contract.
Our advice for getting started
- Run the risk assessment first and keep the justification for your chosen level.
- Start with the 13 Basic key measures, which count at every level, then move up one step at a time.
- Assess each requirement on its documentation and on how it is applied day to day, because the self-assessment tool scores both separately from 1 to 5 and a CAB expects evidence for each.
- Define your scope knowing that it covers the whole organisation unless IT or OT environments are physically or technically separated.
- Remember that a key measure can never be excluded and that any exception must be justified, documented and approved by senior management.
- Contact a CAB from the list published by the CCB early on to set your timetable.
How Sinplify helps you prepare your CyFun® level
Sinplify is a Belgian platform with a CyFun® usage agreement with the CCB that supports Basic, Important and Essential. Every requirement is written in plain language and our European AI reads your documents to recognise what you already do, then prepares what is missing without ever showing you more than three actions at a time. Every confirmed piece of evidence also counts for ISO 27001 and ReCyF and the file for your level is produced in one click.
Sinplify structures and speeds up your approach and prepares your file, while verification or certification remains the job of an authorised CAB. Explore the platform, read our article on ISO 27001 and CyFun® or book a demo to see where you stand.