Presumption of Conformity to NIS2 can be obtained through CyberFundamentals verification (assurance levels BASIC and IMPORTANT), CyberFundamentals certification (assurance level ESSENTIAL) or ISO/IEC 27001 certification (provided the scope and Statement of Applicability is found acceptable by the CCB). 

Conformity against the requirements of the respective assurance levels in the CyberFundamentals Framework will be assessed according to the requirements set out in the CyberFundamentals Conformity Assessment Scheme (CAS).

Conformity assessments in a NIS2 context (though CyFun® or ISO/IEC 27001) shall be performed by an accredited and authorised conformity assessment body.

Accreditation of a conformity assessment body is done according to EU Regulation 765/2008 setting out the requirements for accreditation and market surveillance, unless otherwise determined by the Belgian legislation. Accreditation requests can be addressed to the National Accreditation Body (BELAC for Belgium) according to the applicable procedure.

The authorisation for all conformity assessment bodies operating in a NIS2 context is provided by the CCB as National Cybersecurity Certification Authority (NCCA). Accreditation is one of the requirements for authorisation.

In November 2025 a new version of the  'CyberFundamentals Framework Conformity Assessment Scheme' (CyFun® CAS) and the 'CyberFundamentals Framework Conformity Assessment Scheme Clarifications' has been published. The document ‘Transition new CAS & clarification’ explains the transition arrangement for both documents. 

Download Conformity Assessment Scheme Download Conformity Assessment Scheme clarifications Download CAB authorisation conditions Download the NIS2 authorisation request Transition new CAS & clarifications
Image
cyber_at_work.jpg

Transition from CyFun® 2023 to CyFun® 2025

The new CyberFundamentals Framework, CyFun® 2025, was published on 1 October 2025 by the Centre for Cybersecurity Belgium (CCB). A transition plan for accredited Verification and Certification Bodies has been defined. 

Key points from the transition scheme:

  • Verification and Certification Bodies (VBs and CBs) must obtain accreditation for verification or certification against CyFun® 2025 by 18 April 2027 at the latest.
  • CyFun® 2023 and CyFun® 2025 will continue to coexist until 18 April 2027, and entities will have the choice of which version of CyFun® to apply until then.
  • Verification and Certification bodies (VBs and CBs) have the option to carry out verifications or certifications according to CyFun® 2023 until 18 April 2027 at the latest. Verification statements and certificates according to CyFun® 2023 are valid until 18 April 2028 at the latest.

The document below describes the transition plan in detail.

Download