In an era dominated by digital transformation, everything seems to be moving faster, smarter, and more connected. But here’s the big question: what does that mean for security?
You’ve probably heard a lot about cybersecurity. Firewalls, phishing, ransomware, it’s everywhere in the headlines. But there’s a new player you may not know much about yet: CyFun. And if you’re running a business in Belgium, it’s something you’ll definitely want to pay attention to.
What is CyFun?
CyFun, short for CyberFundamentals Framework, is Belgium’s practical guide to staying safe in a digital-first world. Developed by the Centre for Cybersecurity Belgium (CCB), it helps organizations build stronger cyber defenses while staying compliant with the EU’s NIS2 Directive, which came into force in Belgium on 18 October 2024.
CyFun is the roadmap that shows you what to do, step by step, to protect your organization from digital threats.
How does it work
Cyfun starts with the CyFun Selection Tool. This is a risk assessment tool that results in a well-informed selection of the appropriate CyberFundamentals Assurance Level.
. This assessment considers key factors such as your size, sector, risk exposure, and the potential impact of a cyber incident.
Once the level is set (Basic, Important or Essential), CyFun provides a structured framework to guide your cybersecurity practices. With its upcoming update, it will align fully with NIST Cybersecurity Framework V2.0, organizing everything around six core functions:
- Govern – Define and monitor your cybersecurity strategy, risk appetite, and policies.
- Identify – Understand your risks, assets, and vulnerabilities.
- Protect – Put measures in place to prevent incidents.
- Detect – Build the ability to recognize and track threats.
- Respond – Establish clear incident response and mitigation procedures.
- Recover – Ensure business continuity and resilience after an incident.
These functions give organizations a step-by-step way to strengthen their digital defenses.
Levels that fit your organization
Based on the initial assessment, CyFun assigns organizations to one of three security maturity levels:
- Basic – For organizations with lower risk exposure, focused on foundational cybersecurity controls.
- Important – For organizations with higher sensitivity or societal relevance, requiring stronger measures.
- Essential – For high-risk or critical entities where failure could have major societal or economic impact.
For organizations in the Important or Essential categories under NIS2, CyFun also creates a pathway to certification or formal assurance. This ensures that those with significant societal or economic responsibility can demonstrate compliance through a structured, externally validated process.
Why it matters for Belgium
Adopting CyFun comes with big benefits:
- Stay compliant – It’s the recognized way to meet Belgium’s NIS2 requirements.
- Build trust – The CyFun label shows clients, partners, and suppliers that you take security seriously.
- Reduce risk – Stop cyberattacks before they stop you.
- Grow with confidence – Start small and scale as your organization evolves.
Practical tips for getting started
- Use the CyFun Selection Tool – Identify which cybersecurity level (Basic, Important, or Essential) best fits your organization’s size, sector, and risk exposure.
- Complete the CyFun Self-Assessment – This step is key. The self-assessment helps you evaluate how your organization measures up to the CyFun controls. It highlights where your cybersecurity practices are strong and where you need improvement. You’ll get a clear picture of your current maturity level, along with guidance on the actions needed to reach the next one. It’s a practical, accessible way to prepare for formal assurance and to build a stronger security culture from within. Use the booklets and scoring instructions that you can find on the CCB website to help you with the self-assessment.
- Start with your biggest risks – Focus first on protecting sensitive data, critical systems, and customer information.
- Train your people – Awareness is your best defense; make cybersecurity part of everyday behavior.
- Document your measures – Keep evidence of what’s in place; it’s essential for compliance and audits.
- Get expert help when needed – External consultants or auditors can make your CyFun journey smoother and more efficient.
How Dadir can help
Navigating frameworks like CyFun can feel overwhelming, but you don’t have to do it alone. At Dadir, we help organizations translate complex cybersecurity requirements into practical actions that fit their size, sector, and goals. From awareness and training to strategy and compliance, we make security understandable and achievable.
Conclusion
CyFun may sound like just another framework, but it’s really a game-changer for Belgian cybersecurity. It bridges the gap between complex technical standards and real-world business needs, giving every organization the tools to thrive securely in the digital age.
So, the next time you hear about digital transformation, remember: transformation without security is just an open door for cybercriminals. CyFun is here to make sure that door stays locked.
👉 Ready to strengthen your cybersecurity maturity? Let’s build your CyFun journey together: https://dadir.be/
