NIS2 in Belgium: what does your customer ask of you?
In Belgium the NIS2 law has applied since 18 October 2024. The Centre for Cybersecurity Belgium (CCB) is the national authority. Organisations in scope must also assess security at their suppliers. That is why you may receive questions about your security as a supplier, for example linked to CyberFundamentals (CyFun). The CyFun 2025 version puts more emphasis on suppliers. As a supplier you are not automatically in scope yourself.
Do you supply a Belgian organisation in scope of NIS2? Then you may receive questions about your security, for example linked to CyberFundamentals. This is what lies behind them and how to prepare.
The Belgian NIS2 law in brief
- Law: the law of 26 April 2024, in force since 18 October 2024.
- Authority: the Centre for Cybersecurity Belgium (CCB), together with sectoral authorities.
- Reporting: organisations in scope report a significant incident to the CCB within 24 hours.
- Demonstrating: according to the CCB, essential entities had to show by 18 April 2026 that they are working on a conformity assessment, for example through CyberFundamentals or ISO 27001 (CCB).
Why you receive questions
Organisations in scope must also manage the risks in their supply chain. They therefore assess the security of their suppliers and service providers. Your customer does that with a questionnaire, a conversation or contract requirements. That does not put you in scope yourself, unless your company is in one of the sectors and large enough.
CyberFundamentals 2025 and suppliers
The CCB published CyberFundamentals 2025 (CyFun 2025). According to the CCB, this version puts more emphasis on supply chain security, including suppliers and partners. CyFun 2023 and 2025 are available side by side for a while; after that only the new version will be accepted (CCB, CyFun 2025). So customers may also ask how you manage your own suppliers and sub-processors. More about the levels in CyberFundamentals questions from customers.
What you may receive
| Topic | Typical question | Evidence that helps |
|---|---|---|
| Level | Which CyFun level are you at, or do you have ISO 27001? | Label, verification or certificate with scope |
| Your suppliers | Which suppliers and sub-processors do you use, and how do you assess them? | Supplier list and assessment procedure |
| Incidents | How quickly do you inform us, so we can report within 24 hours? | Incident procedure with notification time |
| Access and logging | Do you use MFA and keep logs? | Policy and screenshots |
| Continuity | When did you last test restoring from backup? | Restore test report |
How to approach it
- Ask what the customer expects. A CyFun label, a self-assessment, ISO 27001 or just answers?
- Align your notification time. Your customer must report within 24 hours. Agree how quickly you inform them.
- Map your own suppliers. That is exactly where CyFun 2025 looks more closely.
- Answer with evidence and be honest about gaps. See the evidence ladder.
How Holdvero helps
With Questionnaire Rescue we answer your Belgian customer’s NIS2 and CyFun questions based on your own documentation, with a source for every answer. Holdvero does not provide a CyFun label or certification and does not give legal advice. More about Belgian customers on the Belgium page.
Frequently asked questions
Since when does NIS2 apply in Belgium?
The Belgian NIS2 law of 26 April 2024 has been in force since 18 October 2024.
Do I need a CyFun label as a supplier?
Not automatically. Your customer may ask about your level or about equivalent evidence such as ISO 27001. Ask what exactly they expect.
What is different in CyFun 2025?
According to the CCB, CyFun 2025 puts more emphasis on the supply chain, operational technology and clearer controls. CyFun 2023 and 2025 are both available for a while.
What if I also have Dutch customers?
In the Netherlands the Cybersecurity Act has applied since 15 August 2026. The topics are very similar. See the Netherlands page in the guides.
Received NIS2 questions from a Belgian customer?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price