Knowledge base · CyFun
CyFun verification and certification: how does the assessment work and who may carry it out?
You do not get a CyFun label from your adviser, nor from yourself. An accredited conformity assessment body has to test your self-assessment and evidence. This page explains the difference between verification and certification, who may carry out the assessment, how it proceeds and where it goes wrong in practice.
The difference
Basic and Important: verification. Essential: certification.Verifying and certifying are not the same thing
At the Basic and Important levels, an accredited conformity assessment body tests whether your self-assessment is correct. The result is a verification statement, with which you then apply for the label. At the Essential level it is about certification: a formal audit round with a certificate as the result. The rule of thumb that CyFun always verifies and ISO certifies therefore does not hold for Essential. The level is linked to the number of measures: 34 requirements at Basic, 133 at Important and 218 at Essential, each time a strict extension of the level below. What you build at Basic therefore counts in full towards the next step.
Who may assess
Only a body with both accreditation and authorisation may do it
Accreditation by BELAC
A CyFun assessment body must be accredited by BELAC, the Belgian accreditation body.
Authorisation by the CCB
In addition, the body must be authorised by the Centre for Cybersecurity Belgium. Only the combination counts.
Where the official list is published
The CCB publishes the list of authorised bodies on the CyFun page of Safeonweb@Work, under tools and resources. Consult that list yourself, because it is updated.
The number is limited
Not every body does every level or every edition of the framework. Ask early who does what, and reserve a slot in good time, especially if your date depends on a deadline.
The ISO 27001 route
An ISO 27001 certificate with the correct scope and statement of applicability can be a route to the label. That certificate must come from a body with accreditation and CCB authorisation.
Why your adviser may not do it themselves
Whoever guides you may not judge their own work. Independence is the reason why assessment and guidance remain separate. RGI guides, and does not perform verification or certification itself.
The process
From self-assessment to label in six steps
The CCB describes four steps. In practice, two preparatory steps are added.
- 1You define the scope: which organisation, processes and network and information systems fall under the assessment.
- 2You choose the level with the CCB's CyFun selection tool, based on a risk analysis.
- 3You carry out the self-assessment with the CCB's self-assessment tool and implement the measures that are still missing.
- 4You choose an authorised assessment body and agree the planning, preferably well before your deadline.
- 5The body assesses your self-assessment and the implementation, and issues a verification statement (Basic, Important) or a certificate (Essential).
- 6You apply for the label on the Safeonweb@Work portal.
Checklist
This must be ready before the assessor arrives
A defined scope
In writing, with all relevant network and information systems in it, and a list of the sites and suppliers you include.
A completed self-assessment
A score per measure, with a short justification. The assessor starts from your own judgement and tests whether it is correct.
Evidence per measure
Log files, approvals, training lists, test reports, backup checks, minutes of management body meetings.
Documented key measures
Each level has key measures that explicitly count. Know which ones they are and make sure they are in order.
Designated owners
For each measure someone who can explain how it works and who answers the assessor's questions.
Confirmation by the management body
The management body approves the risk management measures and oversees their implementation. Make sure that is visible.
Where it goes wrong
Four places where assessments get delayed
The scope is too narrow
Anyone who defines only the office or only one application leaves relevant systems out of view. The assessor then cannot confirm that the scope is sufficient.
Policy without evidence of implementation
A nice policy is not enough. If the assessor asks for an example of the last access review or a test report of the backup and it does not exist, the measure has not been demonstrated.
Key measures underestimated
An average score does not help if a key measure stays below the required minimum. Start with those measures.
Contacting a body too late
Assessors' diaries are not infinite. Anyone who only starts looking once the self-assessment is finished waits longer than necessary.
After the assessment
The label is not an end point, but you have to check its validity yourself
After the statement or certificate, you apply for the label on Safeonweb@Work. How long a statement or certificate remains valid and what follow-up the body requires differs per level and per body, and depends on the applicable assessment scheme. Ask the body about this explicitly before you sign, and include maintenance in your budget. Also bear in mind that the framework itself evolves: CyFun 2025 replaces the 2023 edition. Ask the body which edition it assesses and until when. An assessment is a snapshot of a system that keeps running, so evidence must keep being added after the label.
The phasing
What the 2027 and 2028 dates mean for your assessment
This applies to essential entities. The legal obligations have not changed. What changes is what the CCB inspection service tests as a priority. The full story is on the deadline page.
| Date | What the inspection service expects | What that means for the assessment |
|---|---|---|
| Until 18 April 2027 | Priority for verifying measures equivalent to CyFun Important. Without a certificate at Essential level, a remediation plan follows. | An Important verification or certificate is the pivot. Plan the slot now. |
| 18 April 2028 | Final date for measures equivalent to CyFun Essential, via CyFun certification or ISO 27001 certification that covers them. | Essential requires certification. Check in good time which body can do that. |
Frequently asked questions
Briefly answered
Want to know whether you are ready for the assessor?
Book a call. The first conversation is free. Together we go through your scope, self-assessment and evidence.