Your Belgian customer asks CyberFundamentals questions
CyberFundamentals (CyFun) is the framework of the Centre for Cybersecurity Belgium (CCB), with four levels: Small, Basic, Important and Essential. Belgian NIS2 organisations use it to show their own security, so they ask suppliers about their controls in the same terms. As a supplier you do not automatically need a CyFun label yourself, but you do need answers with evidence.
In Belgium the NIS2 law has applied since 18 October 2024. The Centre for Cybersecurity Belgium (CCB) works with the CyberFundamentals framework, CyFun for short. If you supply a Belgian organisation in scope of NIS2, you may get questions that refer to CyFun.
The four levels
| Level | Intended for |
|---|---|
| Small | An initial assessment, for micro-organisations or organisations with limited technical knowledge |
| Basic | Standard measures for all businesses, using technology and processes that are usually already available |
| Important | Aimed at targeted attacks by actors with common skills and resources |
| Essential | Aimed at advanced attacks by actors with extensive skills and resources |
An accredited conformity assessment body can verify whether an organisation meets a level.
Why your customer asks about it
According to the CCB, Belgian essential entities had to show by 18 April 2026 that they were working on a conformity assessment, for example a CyFun verification at Basic or Important level, or ISO 27001. NIS2 also requires organisations to manage the risks in their supply chain. So they look at you, using the language they know: CyFun.
What you may receive
- A question about your CyFun level, or whether you have a verification or label.
- A questionnaire following the CyFun structure, with topics such as identify, protect, detect, respond and recover.
- Questions about your own suppliers, access management, backups, logging and incident reporting.
- A request for ISO 27001 or equivalent evidence if you have no CyFun.
How to approach it
- Ask what the customer expects. A label, a self-assessment or just answers? And at which level?
- Use what you have. If you have ISO 27001, refer to it. The topics largely overlap.
- Consider a self-assessment at Basic. The CCB publishes the measures per level. An honest self-assessment shows where you stand.
- Answer with evidence. For each measure, the document, setting or report that shows it.
- Name gaps with a plan. Better “planned for Q1” than a “yes” that does not hold up in an audit.
How Holdvero helps
Holdvero is not a conformity assessment body and does not provide CyFun verification or labels. We do complete your Belgian customer's questionnaire based on your own documentation, with a source for every answer and open items where evidence is missing. Up to 150 questions: Questionnaire Rescue, €695. See also the NIS2 supplier questionnaire and, for Flemish local authorities, the VTC questionnaire.
Frequently asked questions
Do I need a CyFun label as a supplier?
Not automatically. If you are not in scope of NIS2 yourself, a label is usually not a legal obligation. Your customer may still ask for it or value it. Ask what they expect.
I am a Dutch company. Will I get this too?
Yes, if your customer is a Belgian organisation in scope of NIS2. It depends on the customer, not on where you are based.
Does ISO 27001 count?
For NIS2 entities in Belgium, ISO 27001 is a recognised route alongside CyFun. As a supplier, an ISO 27001 certificate is also strong evidence. Ask your customer whether they see it as equivalent.
Which level should I choose?
That depends on your customer and your risk. Basic is meant for all businesses and is a logical start for a self-assessment. The CCB offers a tool to choose the level.
Need help with CyberFundamentals questions?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price