Your customer is in Belgium. What can you expect?
In Belgium the NIS2 law has applied since 18 October 2024, with the Centre for Cybersecurity Belgium as the authority. Belgian NIS2 customers may link their questions to CyberFundamentals (CyFun). Flemish local authorities can question their processors with the VTC questionnaire, and financial entities may ask DORA questions. On this page you find the right guide for each situation.
This page brings together what is different in Belgium compared with the rest of Europe. The general guides apply here too; the guides below cover Belgian laws, frameworks and questionnaires.
What applies in Belgium
| Framework | For whom | Status on 13 October 2026 |
|---|---|---|
| NIS2 law | Organisations in the sectors of the law, and through them their suppliers | In force since 18 October 2024 |
| CyberFundamentals (CyFun) | Belgian organisations, also to demonstrate NIS2 conformity | CyFun 2025 published; 2023 still available for a while |
| VTC questionnaire | Flemish local authorities, for processors of personal data | Sent to local authorities and agencies in August 2024 |
| DORA | Banks, insurers and other financial entities | Applies since 17 January 2025 |
Sources: Centre for Cybersecurity Belgium, CCB on CyFun 2025, CCB on the 18 April 2026 deadline. Sources for the VTC questionnaire and DORA are in the respective guides.
Guides for Belgium
- NIS2 in Belgium: The Belgian NIS2 law, CyFun and what it means for you as a supplier.
- CyberFundamentals (Belgium): The CyFun levels and what Belgian NIS2 customers ask of you.
- Flemish VTC questionnaire (local authorities): Per processing activity, with evidence: what Flemish authorities ask.
Supervisors
| Topic | Supervisor |
|---|---|
| Privacy (GDPR) | Data Protection Authority (GBA/APD); for Flemish public bodies also the Flemish Supervisory Commission (VTC) |
| Financial sector (DORA) | National Bank of Belgium or the FSMA, depending on the entity |
| NIS2 | Centre for Cybersecurity Belgium (CCB), together with sectoral authorities |
General guides that also apply in Belgium
- Completing a security questionnaire as a supplier
- Your customer's NIS2 questionnaire
- GDPR questionnaire for processors
- DORA questionnaire for ICT providers
- Security questionnaire without ISO 27001
- Answering your customer's AI due diligence
- The evidence ladder
- 9 mistakes in questionnaire answers
Also supplying Dutch customers? See the Netherlands.
How Holdvero helps
With Questionnaire Rescue we answer your customer’s questionnaire based on your own documentation, with a source for every answer. Unsure about a few questions? With the free Deal Review we look at up to 10. Holdvero does not provide certification, audits or legal advice.
Frequently asked questions
Am I in scope of the Belgian NIS2 law as a supplier?
Not automatically. Your customer being in scope does not bring you into scope. You can be in scope on your own account because of your own activities, sector and size; check that separately. Your customer must however assess security at its suppliers.
Do I need a CyFun label?
Not automatically. Ask what your customer expects: a label, a self-assessment, ISO 27001 or just answers with evidence.
Does Holdvero only work in Belgium and the Netherlands?
No. We work for suppliers across Europe, in Dutch and English.
Received a questionnaire from a Belgian customer?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price