DRIMT logoDRIMT

    NIS2 compliance · Belgium & EU

    NIS2 compliance, from CyFun to vendor risk

    A practical guide for CISOs, DPOs and compliance teams: how CyberFundamentals works, how to run an NIS2 risk assessment, and how to get your suppliers under control — with Drimt keeping the evidence ready.

    In force in Belgium

    18 October 2024

    Law of 26 April 2024 transposing NIS2

    Maximum fines

    €10M or 2%

    of worldwide turnover for essential entities (€7M or 1.4% for important)

    Incident reporting

    24h · 72h · 1 month

    Early warning, notification, final report

    CyFun: the Belgian route to NIS2 conformity

    CyberFundamentals (CyFun) is the framework of the Centre for Cybersecurity Belgium (CCB). It turns NIS2 Article 21 into concrete, testable measures. In Belgium you can obtain a presumption of conformity through CyFun verification (Basic and Important), CyFun certification (Essential), or an ISO/IEC 27001 certification whose scope and Statement of Applicability the CCB accepts.

    Assurance level

    Small

    Entry level for micro-organisations making a first assessment.

    Assurance level

    Basic

    Core cyber hygiene measures; presumption of conformity through verification by an authorised body.

    Assurance level

    Important

    Adds measures for higher-risk organisations; also verified by an authorised conformity assessment body.

    Assurance level

    Essential

    The highest level, expected for most essential entities; requires certification.

    The CyFun levels Important and Essential are not the same as the NIS2 entity categories with those names; your level starts from your classification and your documented risk assessment.

    The four CyFun steps

    1. 01

      Risk assessment

      Assess your cyber risk and select your assurance level with the CCB selection tool.

    2. 02

      Self-assessment

      Score your current measures against CyFun 2023 or CyFun 2025 and plan the gaps.

    3. 03

      Conformity assessment

      An authorised conformity assessment body (CAB) verifies or certifies your measures.

    4. 04

      Label (optional)

      Request your CyFun label in the Safeonweb@Work portal once the assessment is done.

    Belgian deadlines for essential entities

    • 18 Apr 2026First step: CAB verification at Basic or Important level, a self-assessment on the CCB inspection route, or an ISO 27001 scope and SoA.
    • 18 Apr 2027Conformity assessment at the Essential level. CyFun 2023 and CyFun 2025 can both be used until this date.

    Entities identified later count these periods from their identification date.

    Organisation profile · CyFun

    Find your CyFun starting level

    Compare your environment and risk exposure with the Small starting set and the Basic, Important and Essential assurance levels. This is Drimt’s indicative triage, not the official CCB selection tool or a control-maturity assessment.

    Your answers stay on this page. No account, email or submission is required.

    1. 01Small
    2. 02Basic
    3. 03Important
    4. 04Essential

    Question 1 of 4

    How complex is your digital environment?

    Drimt uses the highest exposure indicated by your answers, never below a confirmed minimum. No official CyFun score is calculated.

    Official CCB CyberFundamentals resources Official assurance-level selection guidance

    Running an NIS2 risk assessment

    Article 21 starts with risk analysis: every other measure must be proportionate to the risks you identify. NIS2 asks for an all-hazards approach, so the assessment covers your network and information systems and the physical environment they run in. It is also what decides your CyFun assurance level.

    1. 01

      Scope your assets

      List the network and information systems your essential services depend on.

    2. 02

      Rate threats all-hazards

      Score likelihood and impact across cyber, physical and human threats, not just IT.

    3. 03

      Treat and prioritise

      Link each risk to a control, an owner and a deadline proportionate to your exposure.

    4. 04

      Report to management

      Article 20 makes management bodies approve the measures and answer for them.

    Vendor and supply-chain risk under NIS2

    Supply chain security is one of the ten Article 21 measures. You must take into account the vulnerabilities specific to each direct supplier, the quality of its products and its cybersecurity practices, including secure development. Expect your own customers to send you the same questions.

    1. 01

      Map your suppliers

      Inventory every direct supplier and service provider touching your systems or data.

    2. 02

      Tier by criticality

      Rank them by how much an outage or breach on their side would hurt your services.

    3. 03

      Assess their security

      Collect questionnaires, certifications (ISO 27001, CyFun) and secure-development evidence.

    4. 04

      Contract and monitor

      Add security clauses, incident-notification duties and exit plans — then review regularly.

    The 10 NIS2 Article 21 measures

    1. a)Risk analysis and information system security policies
    2. b)Incident handling
    3. c)Business continuity, backups, disaster recovery and crisis management
    4. d)Supply chain security, including supplier relationships
    5. e)Security in acquisition, development and maintenance, incl. vulnerability handling
    6. f)Policies to assess the effectiveness of security measures
    7. g)Basic cyber hygiene and cybersecurity training
    8. h)Cryptography and encryption
    9. i)HR security, access control and asset management
    10. j)Multi-factor authentication and secured communications

    How Drimt helps

    NIS2 & ISO 27001 mapping

    See your controls mapped to Article 21 measures and ISO 27001 in one workspace.

    Continuous risk monitoring

    Connectors keep your risk register current instead of a once-a-year spreadsheet.

    Supply-chain protection

    Track supplier risk alongside your own controls, with evidence in one place.

    Audit-ready evidence

    Generate evidence for CyFun self-assessments, CAB audits and board reports.

    NIS2 mapping is included from the Growth plan. See pricing · Need people too? NIS2 training for management

    NIS2 compliance FAQ

    Does NIS2 apply to my organisation?

    NIS2 covers medium and large organisations in 18 sectors, such as energy, transport, banking, health, digital infrastructure, manufacturing and public administration. In Belgium, in-scope entities must register with the Centre for Cybersecurity Belgium (CCB). Some smaller entities are also covered because of their role.

    What is CyFun?

    CyberFundamentals (CyFun) is the framework published by the CCB. It gives Belgian organisations a proportionate way to implement and prove NIS2 cybersecurity measures, with assurance levels Basic, Important and Essential, plus Small for first assessments.

    Can ISO 27001 replace CyFun for NIS2?

    In Belgium, an ISO/IEC 27001 certification can give a presumption of conformity when its scope and Statement of Applicability are accepted by the CCB. Many organisations combine both: ISO 27001 as the management system and CyFun as the reference set of measures.

    What are the key Belgian NIS2 deadlines?

    For most essential entities, a first step was due on 18 April 2026 (CAB verification at Basic or Important level, a self-assessment on the inspection route, or an ISO 27001 scope and SoA). A conformity assessment at the Essential level is due by 18 April 2027. Entities identified later count these periods from their identification date.

    What does NIS2 require for vendor risk?

    Article 21 requires supply chain security, including the security of relationships with direct suppliers. You must consider each supplier's specific vulnerabilities, the quality of its products and its cybersecurity practices, including secure development.

    Sources

    This page is general guidance, not legal advice.

    Know where you stand before the CCB asks

    Book a demo and get a free audit scan of your NIS2 posture: CyFun gaps, risk register and supplier exposure.