The CyFun Readiness Guide explains the Basic, Important and Essential levels, the evidence each one expects, and how CyFun fits with NIS2. Plain language, ready to share with your team.
We'll email it to you straight away.
Quantarra helps teams in healthcare, telecom, SaaS and logistics stay audit-ready across frameworks, including CyFun.
CyFun, developed by the Centre for Cybersecurity Belgium (CCB), is a practical, recognised way to show you manage cyber risk. Assessors want evidence, not policies.
The Belgian NIS2 Act covers many medium and large organisations in the sectors it lists. If you are in scope, you must register with the CCB.
For example, a CyFun verification at least at Basic or Important level, or a signed agreement with an accredited assessment body.
The CCB says late or incomplete submissions may result in administrative measures or financial penalties.
Not an essential entity? Important entities still need to show appropriate measures, and customers in scope may ask their suppliers for proof. CyFun gives you a clear, checkable answer. Source: Centre for Cybersecurity Belgium. Scope and routes are summarised; confirm what applies to you with the CCB.
Get ready for your assessor with a clear plan, starting today.
Get the free guideRead it in order the first time. After that, keep the evidence template and the checklist open while you work.
Who the Belgian NIS2 law covers, and the dates that matter.
The assurance levels, and which version to work to.
Three questions that decide how much evidence you need.
Start hereThe routes the CCB names, and who assesses CyFun.
Control, owner, evidence, review date: a one-page template.
TemplateThe habits that slow assessments down, and the fix for each.
Prepare, build, prove, keep: one page to tick through.
ChecklistControls, owners and evidence in one place.
Your level decides how much evidence you need to gather. The guide helps you choose deliberately and early.
Standard security measures suited to all companies, mostly using technology and processes that are already widely available.
Reduces the risk of targeted attacks by actors with common skills and resources, in addition to known risks.
Adds protection against advanced attacks by actors with extensive skills and resources.
Not sure which level is yours? Chapter 3 walks you through it in three questions.
Get the free guideNo prior knowledge of CyFun needed. Hand it to your team as a shared starting point.
Quantarra is an AI-driven audit and compliance platform, with expert oversight, that turns CyFun from a yearly scramble into continuous assurance. CyFun is one of the frameworks it supports.
Every requirement broken down to the control level, with an owner, a status and a due date.
300+ connectors gather evidence automatically and keep it linked to the control it proves.
An internal review step and a live dashboard for every audit, with a maturity view for CyFun.
Reuse the same controls and evidence across CyFun, ISO 27001, SOC 2 and GDPR.
Assessors work from the same immutable audit ledger as your team, which can cut external audit fieldwork from months to days.
We guide you on what evidence to collect, who owns it, and how to work with your assessor, from first gap check to verification.
Runs on AWS · 24x7 support · 99.99% availability
Tracking CyFun by hand is fine for one assessment. As controls, owners and frameworks grow, it means missed owners, stale evidence and no review trail. Quantarra automates the busywork, so your team spends assessment week reviewing, not scrambling.
The platform itself is remarkably intuitive and robust, truly transforming how we manage our internal audits and maintain continuous compliance.Satbeer Bhatia, Head of Compliance, NucleusTeq
Start with the guide. When you're ready, we'll show you CyFun in Quantarra.
Get the free guideYes. Enter your details and we email you the PDF straight away. You'll get two short follow-up emails, and you can unsubscribe at any time.
CyFun was developed by the Centre for Cybersecurity Belgium for organisations under the Belgian NIS2 law. Any organisation can use it to assess its own cybersecurity, and suppliers to Belgian NIS2 entities may be asked about it.
CyFun 2023 and CyFun 2025 can both be used until 18 April 2027. The guide explains how to choose a version with your assessor and stay on it for the whole cycle.
No. It is general information to help you prepare. The CyberFundamentals framework, the Belgian NIS2 Act and the CCB's guidance are the authority, so confirm what applies to you with the CCB, your assessor or legal counsel.
Yes. CyFun is one of the frameworks Quantarra supports, and you can map controls once and reuse the same evidence across ISO 27001, SOC 2, GDPR and more.
Free, eleven pages, and ready to share with your team. When you want help putting it into practice, we're one call away.
