Demonstrate that your organisation has appropriate cybersecurity measures in place. Vinçotte can assist you with independent verification of CyFun® Basic and Important.
CyFun • CyberFundamentals
What is CyFun®? #
Now that the European NIS2 Directive is in force, the CyFun® framework serves as the official guideline in Belgium. The CyberFundamentals framework is one of two ways to achieve NIS2 compliance in Belgium and was developed by the CCB (Centre for Cybersecurity Belgium). Full details can be found at cyfun.eu.
CyFun®, or CyberFundamentals to give it its full name, is a cybersecurity framework that helps organisations to increase their digital resilience step by step. The framework offers concrete security measures and maturity levels that organisations can use to structure, improve and demonstrate their cybersecurity.
Vinçotte is accredited by Belac for CyFun®!
#
Is CyberFundamentals available to all businesses? #
Yes, the CyberFundamentals framework is available to all organisations: small, medium-sized or multinational, and across every sector. After all, securing your digital assets always starts with the same solid basic principles.
Furthermore, failing to take reasonable cybersecurity measures can lead to personal liability for the company’s governing bodies and senior management. Factors taken into account include the costs involved, the likelihood of a cyberattack and the sensitivity of the data being processed.
#
What is the added value of compliance? #
With the introduction of the NIS2 Directive in Belgium (since April 2024), organisations in 18 sectors are legally obliged to strengthen their cybersecurity. By opting for CyberFundamentals’ structured approach, you immediately comply with the legal standards of this European Cybersecurity Act and the NIS2 Directive.
Even if your organisation is not itself covered by NIS2, your customers who are covered will expect demonstrable proof that you are managing your cyber risks; a label or certificate gives them greater confidence in your company.
#
The CyFun® levels #
CyFun® can help organisations put in place cybersecurity measures that align with the NIS2 principles. CyFun® can also help to clearly demonstrate these measures.
Small #
An entry-level option with accessible guidelines for organisations with limited technical knowledge or resources.
Basic #
Fundamental cybersecurity measures that provide protection against the most common cyber threats. Vinçotte can independently verify this level.
Important #
A higher level with additional measures for organisations facing increased risk or with more stringent security requirements. Vinçotte can independently verify this level.
Essential #
For organisations seeking an internationally recognised certificate, Vinçotte refers them to ISO/IEC 27001. This is the international standard for information security management and differs from CyFun®. Read more about the differences below.
#
How does Vinçotte support your organisation? #
Vinçotte is accredited by Belac for CyFun®!
Vinçotte supports organisations in strengthening and demonstrating their cyber resilience.
Depending on your needs, we offer training courses, gap analyses, penetration testing and specialist support, enabling you to work specifically towards meeting the requirements of CYFUN and other relevant cybersecurity frameworks such as ISO 27001 and TISAX.
In addition, we carry out independent verifications and certifications to objectively determine the extent to which your organisation meets the applicable requirements. Advisory activities and conformity assessment are strictly separated, in accordance with the applicable rules on independence and impartiality. We never certify or verify our own work.
CyFun® Basic and Important: verification #
For the Basic and Important levels, Vinçotte carries out an independent verification. This involves checking whether the cybersecurity measures your organisation claims to have implemented are actually in place. They also check whether these measures are working effectively.
- Review of policy documents, procedures and supporting evidence
- Verification of processes and implementation
- Independent confirmation of the chosen CyFun® maturity level
What is the difference between verification and certification? #
In the case of verification, Vinçotte checks your CyFun® self-assessment and the supporting evidence, and you receive a verification statement. In the case of certification, your organisation undergoes a formal audit and, if the outcome is positive, you receive a certificate.
Internationally recognised certification: ISO/IEC 27001 #
For organisations wishing to demonstrate their information security compliance through an internationally recognised standard, Vinçotte provides support with ISO/IEC 27001.
ISO/IEC 27001 is the world’s most widely recognised standard for Information Security Management Systems (ISMS). It helps organisations to effectively manage, improve and continuously monitor their information security.
- Internationally recognised certification
- Accepted worldwide by customers and stakeholders
- Strong focus on governance and risk management
- Continuous improvement of information security
- Complementary to CyberFundamentals
In Belgium, ISO/IEC 27001 can be used as a pathway to NIS2 compliance, provided that the scope covers all network and information systems and the Statement of Applicability (SoA) covers the appropriate NIS2 measures at a level equivalent to the applicable CyFun® level.
Please contact us if you have any questions about this.
What is the difference between CyFun®, NIS2 en ISO 27001? #
CyFun®, NIS2 and ISO 27001 are often mentioned in the same breath, but they each have a different role.
| Subject | Role | Important to know |
|---|---|---|
| CyFun® / CyberFundamentals | Cybersecurity framework with maturity levels | elps organisations to implement and demonstrate measures in a structured way. Vinçotte offers verification for Basic and Important. |
| NIS2 | European Cybersecurity Directive | CyFun® can help to organise cybersecurity measures and demonstrate compliance, but is not the same as NIS2. |
| ISO/IEC 27001 | International standard for information security management | For organisations seeking internationally recognised certification, ISO/IEC 27001 offers a structured management system approach. |
#
When should you choose CyFun® and when should you choose ISO 27001? #
There is no one-size-fits-all answer when choosing between CyFun® and ISO/IEC 27001: the most suitable approach depends on your organisation’s structure, risks and ambitions, and warrants a thorough analysis, particularly for larger groups with multiple legal entities or overseas branches.
Please contact our experts to discuss your situation, or explore this choice in greater depth through Vinçotte Academy’s specialised Framework Exploration training.
Important deadline: #
Implementation of CyberFundamentals (CyFun®) #
By 18 April 2027 at the latest, organisations falling within the scope of the Belgian NIS2 legislation must have implemented their cybersecurity measures in accordance with the CyberFundamentals (CyFun®) standards.
To meet all legal obligations by this date, it is essential that you start in good time to determine your security level (Basic, Important or Essential) and to implement the required security measures.
Avoid any surprises: assess your cybersecurity and supply chain risks today to ensure you are compliant in good time.
Anyone who is not compliant by this date risks regulatory inspections, administrative warnings and financial penalties.
Contact us using the form below or get in touch directly with our cybersecurity expert, Christian Kitooto, to arrange a meeting with him.
