CyFun NIS2: managing the Basic, Important and Essential levels
The CyberFundamentals Framework (CyFun) is the set of cybersecurity measures published by the Centre for Cybersecurity Belgium (CCB). Organised in increasing assurance levels, it is the reference route to demonstrate conformity with the Belgian NIS2 law, in force since 18 October 2024.
Read a CyFun client case (in French)By Alexandre Vivier, ISO 27001 Lead Implementer · Updated on 10 October 2026
Which level to follow?
The CCB offers four levels: Small, a simple hygiene guide for very small organisations, then Basic, Important and Essential, increasingly demanding. The level depends on the organisation's exposure to threats; the CCB provides a selection tool to determine it.
For an entity subject to the NIS2 law, a CyFun Basic or Important verification, a CyFun Essential certification, or an ISO 27001 certification whose scope and statement of applicability are accepted by the CCB, gives a presumption of conformity.
Basic
Published in CompliKey on 9 September 2026.
Important
Published in CompliKey on 8 September 2026.
Essential
Published in CompliKey on 15 September 2026.
Mappings to other frameworks
A control assessed for CyFun can cover requirements of other frameworks; every mapping is traced requirement by requirement, with no coverage claimed by default.
| Framework | Link with CyFun | Page |
|---|---|---|
| NIS2 (directive) | The European text that CyFun helps implement in Belgium | View NIS2 (directive) |
| ReCyF NIS2 | French equivalent, useful for groups present in France and Belgium (page in French) | View ReCyF NIS2 |
| ISO 27001 | Many shared controls, reused in CompliKey | View ISO 27001 |
CyFun in CompliKey
- 1Activate the level: controls already assessed for another framework are carried over.
- 2Audit on evidence: each control receives a score from 0 to 4, gaps become tasks.
- 3Present your progress: audit report and statement of applicability exported to PDF, in French or English.
CyFun: frequently asked questions
Is CyFun mandatory in Belgium?
No, CyFun is not imposed as such. It is, however, the CCB’s reference route to a presumption of conformity with the Belgian NIS2 law, alongside ISO 27001 certification.
Can I move from one level to another?
Yes. In CompliKey, controls already assessed are kept when you activate a higher level.
Can I reuse my ISO 27001 work?
Yes: shared controls are reused and every mapping remains traceable.
Is the application available in English?
Yes. The interface, the frameworks and the exports are available in French and English.
See CyFun in CompliKey
A demo on a sample NIS2 scope, at the level that applies to you.