Knowledge base · NIS2 and CyFun
What does a NIS2 or CyFun programme cost an SME?
An honest answer starts with this: it depends on where you stand today. A price tag here would be guesswork. What we can do is split the bill into five cost blocks, show what pushes it up or down, and point out where companies miscalculate. That lets you judge any quote yourself.
The idea
Five blocks, two of which appear in no quoteThe adviser's quote is only part of the bill
Anyone starting a NIS2 or CyFun programme usually requests quotes from an adviser and possibly an IT partner. Those are the visible amounts. The hours of your own people and the maintenance afterwards appear nowhere on paper, yet over several years they weigh heavily. So if you only compare quotes, you are comparing the smallest part. There is one particularity regarding the assessment itself: as far as we know, there are no official rates for a CyFun assessment. Each assessment body sets its own price, so ask more than one.
The blocks
Where the money goes
Guidance and project management
Defining the scope, choosing the level, gap analysis, action plan and follow-up of the implementation. This is the block where an adviser such as RGI comes in.
Technical measures at the IT partner
Backups, access management, logging, patch management, segmentation. This is work for your IT partner or for specialists, and it is invoiced separately.
Internal hours
Getting policies approved, adapting processes, collecting evidence, training staff, answering the assessor's questions. Usually the biggest block and almost never budgeted.
Verification or certification
An accredited assessment body tests your self-assessment and evidence. This is a cost item of its own, separate from the guidance, and it should stay that way.
Maintenance afterwards
Measures keep running, evidence keeps being added, incidents are rehearsed and the assessment has to be repeated in due course. This block never goes away.
Price drivers
Two companies of the same size can be far apart
These are the factors that make the difference.
The starting point
A company with working backups, access management and a board that takes part has a smaller gap to close than a company that still has to build all this.
The chosen level
Basic, Important and Essential require an increasing number of measures. The level follows from your risk analysis and your category, not from your budget.
Number of sites and systems
All relevant network and information systems must fall within the scope. Every extra branch, cloud environment or application increases the work.
Existing ISO 9001 or ISO 27001
A working management system carries part of the policy, documentation and internal audit. An ISO 27001 certificate with an appropriate scope is also a recognised route in itself. What exactly ISO 9001 can reuse, you check per requirement.
An OT environment
Production machines and control systems cannot simply be patched or segmented. That requires specialist work and consultation with the supplier.
Availability of your own people
A programme without anyone internally who is given time stalls or shifts to external hours, and those are more expensive.
Miscalculations
Where the comparison goes wrong
Counting only the one-off sum
Put the costs side by side over three to five years, including maintenance and reassessment. The ranking of quotes then often changes.
Forgetting the IT partner
An adviser writes the plan, but the measures have to be implemented somewhere. Ask your IT partner beforehand what their part costs.
Policy without evidence
An approved policy is not enough. The assessor asks for evidence that it is being carried out. Anyone who has to build that afterwards pays twice.
Looking for an assessor too late
The number of bodies is limited. Anyone who only looks for a slot late works under time pressure and has little choice.
No budget for year two
A label that nobody maintains loses its value. Plan for maintenance from day one.
The cost of doing nothing
The statutory fines are not the biggest item, but they do set the upper limit
These are the fines under the Belgian NIS2 Act for the main breaches. In addition, directors can be held liable if the entity breaches the risk management obligations, and the CCB can impose binding instructions or additional measures.
| Situation | Fine |
|---|---|
| Essential entity, risk management or incident notification | EUR 500 to EUR 10,000,000 or 2% of the group's worldwide annual turnover, whichever is higher |
| Important entity, risk management or incident notification | EUR 500 to EUR 7,000,000 or 1.4% of the group's worldwide annual turnover, whichever is higher |
| Breach of the identification and registration obligation | EUR 500 to EUR 125,000 |
| Obstructing supervision | EUR 500 to EUR 200,000 |
| Repeat offence within three years | Fine doubled |
Subsidies
Support exists, but the conditions change faster than this page
The percentages below are on the official government pages. Always check the current conditions, the available budget and your own eligibility with the authorities themselves before you decide or order anything.
| Measure | What the official source says | Note |
|---|---|---|
| VLAIO cybersecurity improvement programmes (Flanders) | Continued in 2026 via recognised service providers, in three packages (START, MEDIUM, PLUS). Support of 50% for SMEs and sheltered workshops (maatwerkbedrijven), 35% for non-SMEs under NIS2 that do not yet have a strong policy or roadmap. | The de minimis rule applies. You choose a recognised provider, not just any adviser. |
| KMO-portefeuille (Flanders) | Advice for cybersecurity only. 45% for small and 35% for medium-sized enterprises, ceiling EUR 7,500 per year. | Ends on 1 January 2027. VLAIO reports that the budget has since been used up and that new applications are no longer possible. Check the current status. |
| Cheque cybersecurity (Wallonia) | 75% of the expert's cost, ceiling EUR 50,000 per beneficiary over three years, for SMEs with head office in Wallonia. | Advice and guidance only. You have to check whether the cheque is currently open. |
Before you sign
Seven questions for every provider
- 1Which phase exactly does your quote cover, and what is explicitly excluded?
- 2How many hours do you expect from my own people, and which roles are those?
- 3Who carries out the technical measures, and is that in this price or in that of my IT partner?
- 4Is the assessor completely independent of you, and who chooses them?
- 5What happens to the price if the scope changes or the self-assessment turns out worse than expected?
- 6What does maintenance cost after the assessment, and what must I be able to do myself?
- 7How does the handover to my organisation work when the project is finished?
How RGI works
A separate fixed-price quote per phase
RGI leads and guides the programme, but does not carry out technical measures itself and does not perform verification or certification. The technical side is done with your IT partner or with specialists from our network, and the assessment by an accredited body. We work in phases, and for each phase we make a separate quote with a fixed price. So you decide each time whether to continue, and you do not pay for phases you do not need. The first conversation is free. Together we look at where you stand and which blocks weigh heaviest in your case.
Frequently asked questions
Briefly answered
A quote on the table that you cannot assess?
Send it over or book a call. The first conversation is free. We go through the five cost blocks together and tell you what is missing.