In Belgium, the royal decree implementing the NIS2 law of 26 April 2024 names two frameworks for demonstrating your conformity, the CyberFundamentals Framework (CyFun®) from the Centre for Cybersecurity Belgium (CCB) and the ISO/IEC 27001 standard, which matters to every organisation that already holds ISO 27001 certification or is considering it.
ISO/IEC 27001:2022, the standard that structures your ISMS
ISO/IEC 27001 sets out the requirements for an information security management system (ISMS) that you establish, maintain and continually improve. The current version dates from October 2022 and its clauses 4 to 10 follow the structure shared by ISO management system standards, from the context of the organisation through to improvement.
Annex A contains 93 controls grouped into four themes (organisational, people, physical and technological), compared with 114 in the 2013 version. You select the controls that address your risks and justify that choice in the Statement of Applicability (SoA), and ISO 27001 certification remains voluntary and is issued by an independent certification body, never by ISO itself.
CyFun®, the CCB's free framework aligned with NIS2
Published free of charge by the CCB, the CyberFundamentals Framework brings together concrete measures to protect your data and significantly reduce the risk of the most common cyber attacks. It builds on NIST CSF, ISO/IEC 27001, the CIS Controls and IEC 62443 among others, and its CyFun® 2025 version is aligned with NIST CSF 2.0 and with NIS2.
Alongside the Small starting level, CyFun® offers three assurance levels, Basic, Important and Essential, which you choose based on your risk assessment and which we explain in our article on CyFun® levels. Implementation is validated through a verification (Basic or Important) or a certification (Essential) issued by a conformity assessment body accredited by BELAC and authorised by the CCB, since the CCB itself does not issue any certification.
Two routes to the same presumption of conformity
Essential entities must undergo a regular conformity assessment and choose between CyFun®, an ISO/IEC 27001 certification and an inspection by the CCB, while important entities may opt in voluntarily. A verification or certification obtained under the right conditions gives you a presumption of conformity until proven otherwise, and for the ISO route the CCB sets out its conditions in its NIS2 FAQ and guidance published in September 2026:
- The scope covers the whole entity and all its network and information systems, except an IT or OT environment that is physically or technically separated, operates independently and has no impact on the risks within the scope, provided that separation is documented
- The Statement of Applicability is backed by evidence and reaches a level equivalent to the CyFun® level you have chosen
- The certificate is issued by a body authorised by the CCB and accredited by a signatory to the EA or IAF mutual recognition arrangements
- A parent company's certificate is not enough on its own to cover the NIS2 entity concerned
For essential entities in scope since the law came into force, this certificate must be obtained by 18 April 2027 at the latest, and it can also be used to obtain a CyFun® label through the ‘Labels’ tab on Safeonweb@Work.
What really sets the two frameworks apart
Both routes lead to the same legal outcome without following the same logic:
- Approach: ISO 27001 starts from your risk assessment to select your controls from Annex A, whereas CyFun® sets out the measures expected at each level
- Scope: outside NIS2 you determine the scope of your ISMS yourself, whereas the NIS2 route requires the whole entity and may mean extending an existing certificate
- Validation: a body accredited through EA or IAF for ISO 27001 or by BELAC for CyFun®, authorised by the CCB in both cases
- Recognition: over 70,000 ISO 27001 certificates in 150 countries according to the ISO Survey 2022, whereas CyFun® is first and foremost a Belgian reference
Choosing your route without doing the work twice
If you already hold an ISO 27001 certificate or your clients ask for one, the ISO route is often the most natural choice, provided you extend the scope and complete the Statement of Applicability up to the target CyFun® level, whereas CyFun® offers a free and immediately readable path if you are starting from scratch with a mainly Belgian horizon. The CCB also stresses that it does not impose CyFun® on top of ISO 27001 but does expect an equivalent level of cybersecurity.
To avoid duplicated effort, the CCB publishes alongside CyFun® 2025 a mapping table that links CyFun® controls to the clauses of ISO/IEC 27001:2022 and the controls of ISO/IEC 27002:2022, and it recommends using it to demonstrate equivalence. It links, for example, the CyFun® backup requirement PR.DS-11 to Annex A control 8.13, so a tested backup procedure documented only once serves both frameworks. The table nonetheless remains guidance and you demonstrate your maturity with your own documents.
How Sinplify helps you run both at once
Sinplify structures and accelerates this approach by starting from what you already have, as our European AI reads your policies, procedures and audit reports to recognise the good practices already in place and prepares what is missing. Every piece of evidence your team confirms counts for CyFun®, ISO 27001 and ReCyF at once, so your backup procedure serves both frameworks and every new framework starts with gauges already partly filled and a file of its own.
Explore the platform or book a demo to see Sinplify at work on your own documents.