CyFun® Verification is an independent verification of your cybersecurity maturity based on the CyberFundamentals (CyFun®) framework from the Belgian Cybersecurity Centre (CCB). Once you get the verification statement by Trust CHECK you can request your label from CCB.

1. Self-assessment: Use CCB tools to evaluate your current cybersecurity maturity.
2. Submission: Submit your self-declaration and supporting evidence to Trust Check.
3. Audit: An on-site or remote assessment validates compliance.
4. Report: Receive an official verification report and certificate.

All steps are traceable and documented to ensure transparency.

• Your filed self-assessment and all documentary and implemented evidences such as:
  • Current cybersecurity policies and procedures
  • Evidence of technical measures (firewalls, backups, monitoring logs)
  • Incident response and business continuity plans
  • Access control and user management documentation
  • Any useful reports

• A CyFun® Verification report is generally valid for 12 months, after which a re-assessment is recommended to ensure ongoing compliance.
• Continuous monitoring and updates are recommended for entities subject to NIS2.

Yes. A verification statement may be revoked if:

• New evidence of non-compliance is discovered.
• The organization fails to maintain required cybersecurity measures.
• Misrepresentation or fraudulent information is found in the submitted documentation.

• Evaluate current cybersecurity maturity.
• Identify gaps and areas requiring improvement.
• Demonstrate compliance to regulators, partners, and clients.

It aligns with obligations under NIS2 for essential and important entities.

• Failure to comply with NIS2 can result in administrative fines and, in severe cases, operational restrictions.
• The exact penalty depends on:
  • The severity of the non-compliance
  • The size and criticality of the entity
  • The risk posed to essential services

CyFun® Verification helps mitigate the risk of fines by providing documented proof of proactive compliance measures.

• Independence: Third-party validation ensures objectivity.
• Official recognition: Reports are recognized by the Belgian Cybersecurity Centre.
• Efficiency: Streamlined process adapted to Belgian legal requirements.

Yes, the verification report can be shared to demonstrate compliance and provide evidence during audits or contractual evaluations

The duration depends on the scope and complexity of your IT environment. Typically:

• Basic Level (Cyber PR1): 2–4 days
• Important Level (Cyber PR2): 3–5 days

• Basic Level: Approximately 34 controls, covering fundamental cybersecurity measures required for important entities.
• Important Level: Around 143 controls (including the Basic’s ones), including advanced technical and organizational measures for essential entities.

These controls align with the CCB CyberFundamentals framework.

• You may request a review or clarification from Trust Check. Check appeals and complaints page.
• The process ensures fairness and transparency.

• You can request a different verifier during the verification plan step.
• Trust Check maintains a pool of qualified verifiers, and assignments are flexible to prevent conflicts of interest.
• Your request is handled confidentially.

• All documents and communications are protected using Traffic Light Protocol (TLP)
• Access is restricted to authorized personnel only.
• Trust Check follows data protection best practices in compliance with GDPR and cybersecurity standards.
• Critical evidences are saved offline after the verification mission

The CyFun® Label is recognized nationally in Belgium as a trusted proof of cybersecurity maturity. It is accepted by authorities, partners, and customers as evidence of compliance.

Today, more and more EU countries are recognizing CyFun®, including France, Romania, and Ireland, with others expected to follow soon.

For organizations, CyFun® means easier access to new markets, streamlined compliance processes, and increased trust from clients and partners.

As CyFun® aligns with European frameworks such as NIS2 and GDPR, it is becoming a continental reference for cybersecurity assurance.

CyFun® and ISO/IEC 27001 are interconnected through reference matrices, enabling organizations to map requirements and controls between both frameworks. This facilitates dual compliance and helps organizations leverage existing certifications to meet new regulatory expectations.

The official CyFun® framework is published by the Centre for Cybersecurity Belgium (CCB) and available on their website atwork.safeonweb.

Under the EU NIS2 Directive, certain organizations classified as essential and important are legally required to taking cybersecurity risk-management measures. Essential entities shall demonstrate cybersecurity maturity. This includes sectors such as energy, transport, health, finance, digital infrastructure, and public administration.
Failure to comply can result in audits, corrective measures, and administrative fines.

The centre for cybersecurity in belgium developped a tool to figure out if your entity fall under the NIS2 law or not. Refer to this link to find the tool.

Obligations of Essential and Important Entities under the NIS2 Law (Belgium)

The Belgian NIS2 law, which transposes the EU Directive 2022/2555, imposes several cybersecurity obligations on entities deemed essential or important for the functioning of society and the economy.

1. Registration

Entities falling within the scope of the NIS2 law must register with the Centre for Cybersecurity Belgium (CCB) via the Safeonweb@work platform. This registration is mandatory and ensures that the CCB can effectively supervise and support these entities.

2. Cybersecurity Risk Management Measures

Both essential and important entities are required to implement appropriate technical, operational, and organizational measures to manage cybersecurity risks. These measures aim to:

• Secure network and information systems.
• Prevent incidents.
• Minimize the impact of incidents on customers and services.

4. Supply chain security

Essential and Important entities must take appropriate and proportionate cybersecurity risk-management measures on their supply chain. This is why many companies outside NIS2 scope adopt CyFun® to strengthen cybersecurity governance or because a customer, supplier, or partner requires proof of compliance.

5. Notification of Significant Incidents

Entities must report any significant incidents to the national CSIRT, which in Belgium is the CCB. This includes:

• Incidents causing severe operational disruption.
• Incidents with potential cross-border effects.
• Financial or reputational damage.

The reporting process includes:

• Initial notification within 24 hours.
• Detailed incident report within 72 hours.
• Final report within one month.

4. Obligations for management

The management bodies of NIS2 entities are responsible for:

• Approving cybersecurity risk-management measures and supervise their execution.
• Following a training to ensure that their knowledge and skills are sufficient to identity risks and treatment

In case of non-compliance, management can be held liable.

5. Supervision

• Essential entities must undergo regular compliance assessments, choosing one of the following:
  • CyberFundamentals Certification or verification.
  • ISO/IEC 27001 Certification.
  • Audit by the CCB’s audit service.
• Important entities must not undergo a regular compliance assessment.

6. Sanction

Essential and Important entities which do not respect their obligations can be subjected to a series of administrative measures and fines.