Structure
Levels that build on each other
Small, Basic, Important and Essential. You choose a level through a risk assessment, and each one includes everything below it.
Belgium’s CyFun framework, with your suppliers on record
CyberFundamentals (CyFun) is the framework the Centre for Cybersecurity Belgium built to turn NIS2 into concrete measures. Under Belgium’s NIS2 law, a verified or certified CyFun level gives a presumption of conformity with the risk-management measures.
Montro keeps the supplier side of those measures in one register, and records the CyFun level your own suppliers hold, so both directions of the supply chain are on file.
Framework
How CyFun is built
CyFun 2025 is organised around the six functions of NIST CSF 2.0 and draws on ISO 27001, the CIS Controls and IEC 62443. Each level adds requirements to the one before.
Assessment
Verified or certified
Basic and Important are verified, and Essential is certified, by a conformity assessment body authorised by the CCB.
Scope
What the presumption covers
A valid level covers the Article 21 risk-management measures in Belgium’s NIS2 law, as long as its scope covers the whole organisation. Registration and incident reporting sit outside it.
How Montro helps
Your supply chain measures, kept current
CyFun takes its supply chain measures from the Govern function of NIST CSF. Montro keeps the record those measures rely on, from the suppliers you depend on to the decisions taken on each.
Suppliers in proportion
Each supplier in the register carries an owner and a criticality your team sets, so measures can be applied where they matter most.
Your suppliers’ own labels
When a supplier holds a CyFun label or an ISO 27001 certificate, its level and expiry sit with its entry, and a lapse comes back to your team for review.
Practice as well as policy
CyFun looks at what is documented and what is actually done. Each supplier decision is recorded as it’s made, so the register shows the practice behind the policy.
What you get
What your assessor can see
Supplier evidence ready for verification or certification.
Reasoning
A reason behind each supplier’s tier
Why a supplier is treated as critical, or not, is recorded with it, so the risk-based choices behind your measures can be explained.
Across borders
One register across your entities
If you operate in Belgium and elsewhere, the same supplier entries can support CyFun alongside ISO 27001 and other countries’ NIS2 rules.
Reassessment
Ready for the next cycle
Assessments repeat. Decisions taken since the last one are already on record, so the next review starts where the last one ended.
Assurance levels
Which CyFun level fits
Basic
The baseline
For any organisation, using measures most already have. The CCB recommends it for every company in the supply chain of a NIS2 entity.
Important
Against targeted attacks
Built for attackers with common skills and resources. The level most important entities aim for.
Essential
Against advanced attacks
Built for attackers with extensive skills and resources. Essential entities work towards certification at this level.
FAQs
Questions about CyFun, and how Montro supports its supply chain measures.
No. Belgium’s NIS2 law requires the risk-management measures, not CyFun itself. CyFun, or ISO 27001 with the right scope, is the route that gives a presumption of conformity.
It can. Customers that are NIS2 entities may ask their suppliers for a CyFun level by contract, and the CCB recommends at least Basic for every company in that supply chain.
Belgium’s NIS2 law has applied since 18 October 2024. Essential entities need a conformity assessment at Essential level, or its equivalent, by 18 April 2027. Important entities can opt in to the same assessment voluntarily.
It was rebuilt around the six functions of NIST CSF 2.0, including the new Govern function, where supply chain measures sit. The 2023 and 2025 editions run side by side for now.
It was built for Belgium, and the legal presumption of conformity applies there. Ireland’s National Cyber Security Centre has also indicated a preference for CyFun, so check with your national authority on how it is treated where you operate.
Keep reading
The frameworks CyFun draws on
CyFun is built from the frameworks below, and the same supplier evidence carries across.
Third-party records are becoming decision logs. The firms that get this right will be the ones that can show who decided, on what evidence, and when.
- Pen-test summary on request
- Frankfurt hosting
- Sample register
- Expert Series guests
- Cyber Ireland member
See it on your own suppliers
A read-only connection, about an hour to set up, and a named person who can say yes to a decision.
Priced to scope — never per seat, never per supplier. Upgrade only when the evidence earns it.
