Knowledge base · CyFun
CyFun Basic, Important or Essential: which level do you need?
Your CyFun level follows from your risk analysis and your NIS2 category. The CCB does not assign it. This article explains what each level involves, how to determine yours, when a lower level can be justified and why the work you do at a lower level is not lost.
The levels
Each level covers a different attack profileThe level follows the kind of attacker you want to arm yourself against
The CCB describes four levels. Small is the starter level for micro-organisations with limited technical knowledge, intended for a first assessment. Basic contains the standard measures for all enterprises. Important must reduce the risk of targeted attacks by actors with common skills and resources. Essential targets advanced attacks by actors with extensive skills and resources. The CCB applied the levels retrospectively to historical attack data: according to that exercise, Basic covers 82 percent of attacks, Important 94 percent and Essential 100 percent. Less has been published about Small. Ask the CCB or the assessment body how an external assessment at that level works.
Comparison
Three levels side by side, according to CyFun 2025
The numbers come from the CyFun 2025 data as stated on our CyFun page.
| Level | Number of requirements | Assessment | Typical profile |
|---|---|---|---|
| Basic | 34 | Verification by an accredited conformity assessment body, then apply for the label | Organisations outside NIS2 taking a first step, suppliers whose customer asks for a basic level, lighter and sector-specific cases |
| Important | 133 | Verification by an accredited conformity assessment body, then apply for the label | Important entities and essential entities on their way to Essential |
| Essential | 218 | Certification | Essential entities and organisations with the highest risk profile |
Determining your level
Your level follows from three sources, in this order
- 1Start with your NIS2 category. Essential entities are expected to reach Essential, unless their risk analysis justifies a lower level. For important entities, Important is the usual direction. A strict one-to-one rule does not appear in the CCB texts we consulted. If you do not yet know your category, start with the scope article.
- 2Carry out your own risk analysis. The CCB offers the CyFun Selection Tool for this as the first step of its four-step model: risk analysis, self-assessment with the Self-Assessment Tool, assessment by a body and application for the label.
- 3Hold your customers up against your analysis. Tenders and customers subject to NIS2 can impose a level contractually. Such a requirement can be higher than your own analysis calls for, and then the requirement wins.
- 4Record the choice in writing, with the reasoning. Anyone who later has to defend a deviating level needs that justification.
Lower than expected
Only with justificationA lower level can be justified if your risk analysis supports it
An essential entity may choose a lower CyFun level if that is objectively justified by its own risk analysis. No CCB approval is needed for this. The justification remains documented internally, and the inspection service can challenge it. According to the notice from the CCB inspection service, no remediation plan is needed for anyone who, on the basis of the risk analysis, can justify a lower assurance level and demonstrates compliance with that level by 18 April 2027. A lower level is therefore a defensible choice, not a shortcut. It only works if the analysis is sound, stands up in an inspection and was not written mainly to avoid work.
Pivotal level
ImportantImportant is now the level where many files converge
Until 18 April 2027, the inspection service gives priority to verifying measures equivalent to CyFun Important, and Essential must be reached by 18 April 2028. This makes Important the level at which essential entities are assessed first and the intermediate step in a remediation plan. What exactly that means per route and per category is explained on the phasing page. We do not repeat that content here.
Structure
The levels build on each other, so work is not lost
Strict subsets
Basic is a strict subset of Important, and Important of Essential. What you build at a lower level counts in full at a higher level.
ISO 27001 as an entry route
An ISO 27001 certificate with the right scope and statement of applicability can be used to obtain the label. The assessment body checks the scope.
Choose the goal first
An intermediate level makes sense if it fits your end plan. If you know your target level, you can order the measures so that each step prepares the next.
Editions
CyFun 2025 replaces the 2023 edition
The new edition has different requirement texts and different numbering.
What changed
According to the CCB, 2025 aligns with NIST CSF 2.0, national and European rules and NIS2. There is more attention to the supply chain and OT, and the controls are worded more clearly to make auditing easier. The edition has six functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER. GOVERN is new, with governance measures from Important onwards.
Transition period
The CCB says that both editions remain available for a period, after which only the new one is accepted. We did not find an end date on any CCB page. Check it with your assessment body and start any new programme on 2025.
Scoring and key measures
Each level has key measures that weigh extra heavily, and conformity thresholds that take maturity into account. The exact scores and numbers are in the CCB Self-Assessment Tool, and that is your source.
Assessment
A recognised body assesses, we lead the programme
For a CyFun assessment you work with a conformity assessment body that is accredited by BELAC and recognised by the CCB. The list is on Safeonweb@Work. Self-assessment is done in an Excel tool with spider diagrams, plus mapping and policy templates from the CyFun toolbox. RGI provides guidance as project manager: scoping, gap analysis, planning and preparation of the assessment, together with your IT partner or specialists from our network. RGI does not verify or certify itself.
Frequently asked questions
Briefly answered
Which CyFun level suits you?
In a first conversation of 30 minutes we determine together your category, your target level and the order of your steps. The conversation is free.