CyFun-conform, het Belgische cybersecurity-kader
Begeleiding bij het Cyber Fundamentals Framework van het CCB — op het juiste assurance-niveau voor uw organisatie.
To put that in time terms, work out how long a CyFun programme would take in your situation. If you already run a certified quality system, see per requirement what your ISO 9001 system already carries.
No sales pitch. No obligation. We reply within 1 business day.
CyFun is hét Belgische referentiekader en een pragmatische opstap naar NIS2-conformiteit.
Pragmatic experts based in Belgium
20+
years experience
1
single point of contact
BE
local, short lines
We work with
No sales pitch. No obligation. We reply within 1 business day.
Welk CyFun-niveau is voor u verplicht?
CyFun is het Belgische framework van het Centrum voor Cybersecurity België (CCB). De huidige editie is CyFun® 2025, die de editie 2023 vervangt: de requirementteksten en de nummering wijken af van de oude editie. Steeds meer aanbestedingen en leveranciersrelaties vereisen een CyFun-niveau. Wij helpen u bepalen welk niveau van toepassing is en hoe u er pragmatisch naar toe werkt.
CCB-erkend framework, gevraagd in steeds meer Belgische aanbestedingen.
Important has become the pivot level
Until this date the CCB inspection service prioritises verifying that essential entities have measures equivalent to CyFun Important. Entities without an Essential-level certificate by then must submit a remediation plan to the inspection service.
Important is therefore not only a target for those who deliberately choose it: it is also the level against which essential entities are checked until April 2027, and the intermediate step in a remediation plan towards Essential by 18 April 2028.
Source — CCB — inspectiedienst (NCCA), mededeling NCCA/JK/INS/2026-002, 11 augustus 2026
What is CyFun (Cyber Fundamentals)?
CyFun is the Belgian Cyber Fundamentals Framework from the Centre for Cybersecurity Belgium (CCB). It bundles recognised cybersecurity best practices (NIST CSF, ISO 27001, IEC 62443, CIS Controls) into one Belgian reference framework. The current edition is CyFun® 2025, replacing the 2023 edition; requirement texts and numbering differ from the old edition. The 2025 edition follows six functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER — GOVERN was added compared with the old edition.
CyFun levels: Basic, Important, Essential
CyFun 2025 counts 34 requirements at Basic, 133 at Important and 218 at Essential. Basic is a strict subset of Important, and Important of Essential: what you build at a lower level counts in full towards a higher one. The assessment form differs per level: Basic and Important run through verification by an accredited conformity assessment body, resulting in a verification statement, after which the label is requested. Essential runs through a certification audit with annual surveillance and three-yearly recertification. The rule of thumb that CyFun always verifies and ISO certifies therefore does not hold for Essential. During the intro call we determine together which level is realistic and meaningful.
Implementing CyFun: step plan
Implementing CyFun starts with scoping: which level applies, which processes and systems are in scope? Then comes a gap analysis against the CyFun controls, a priority plan and the implementation of the missing measures. RGI guides the trajectory in four steps — intro call, gap analysis, roadmap with implementation and optionally a verification audit — without 200-page reports.
CyFun and NIS2: the practical bridge
The CCB has aligned CyFun with NIS2, which makes it the pragmatic stepping stone for many Belgian companies. Essential entities have three routes to demonstrate conformity: CyFun certification at Essential level (or verification at a lower level, if justified by the risk analysis), ISO/IEC 27001 certification with an appropriate scope, or an inspection by the supervisory authority or a sectoral inspection service. For important entities a conformity assessment is voluntary; those who choose it obtain a presumption of conformity through verification or certification.
CyFun for Belgian tenders and B2B
CyFun is requested in an increasing number of Belgian tenders and B2B contracts — especially by government, critical sectors and large companies that want to secure their supply chain. A demonstrable CyFun label is therefore not just a security choice, but also a commercial argument. RGI helps you reach the right level and validate the label with a CCB-recognised verifier.
Source and attribution
CyFun® and the CyberFundamentals Framework are developed and published by the Centre for Cybersecurity Belgium (CCB). RGI bv is not affiliated with the CCB and does not act on its behalf.
How we help you
Niveaubepaling
Basic, Important of Essential: wat past bij u.
Self-assessment begeleiding
Correct ingevuld, zonder giswerk.
Maatregelen implementeren
Concrete invulling van de CyFun-controles.
Brug naar NIS2
CyFun als basis voor uw NIS2-traject.
From question to result in 4 steps
- 1
Intro call
30 min, no obligation
- 2
Quickscan or gap analysis
clear report, planning tailored to your scope
- 3
Roadmap & implementation
in phases, each with its own quote and fixed price
- 4
Ongoing oversight or certification
optional via CISO-as-a-Service
Pragmatic experts, no consultancy theatre
Pragmatic, no bureaucracy
Concrete actions, no 200-page reports.
SME & mid-market focus
No big-4 overhead, no enterprise pricing for a 50-person company.
Local and accessible
Belgian firm, short lines, fast response.
One single point of contact
Twenty years of experience, from first call to result.
What a project costs
Every project is tailor-made. The price depends on your starting point and scope. Each phase gets its own quote with a fixed price, which you receive in concrete form after the free intro call. No surprises later.
No sales pitch. No obligation. We reply within 1 business day.
Answers upfront
Pick whatever works best for you
Book a 30-min slot directly, or reach us by phone, email, WhatsApp or Threema.
Call now
+32 484 111 022
info@rgi-bv.be
+32 484 111 022
Threema
end-to-end encrypted
Rob Gielen
Book a free 30-min call
No sales pitch. No obligation. We reply within 1 business day.
Book a free 30-min callWord CyFun-conform met de juiste aanpak
No sales pitch. No obligation. We reply within 1 business day.