NIS2 created the Pressure. CyFun® creates the path. NIS Institute leads the way

NIS2 created the Pressure. CyFun® creates the path. NIS Institute leads the way.

Discover how CyFun® translates NIS2 obligations into practical controls, maturity targets, evidence requirements and a clear cybersecurity roadmap. NIS2 establishes what organisations must achieve. CyFun® provides a structured way to decide what to implement, assess progress and demonstrate that cybersecurity measures are working.

How to turn cybersecurity obligations into controls, evidence and measurable progress?

Knowing that your organisation must improve its cybersecurity is not the same as knowing what to do next. NIS2 has increased the attention given to cybersecurity governance, riskmanagement and organisational resilience. But once the initial legal analysis is complete, organisations still face a series of practical questions:

Which cybersecurity measures should we implement?
What is the right level of security for our organisation?
How do we assess our current maturity?
Which gaps should we address first?
What evidence do we need? How do we demonstrate measurable progress?
How do we demonstrate measurable progress?

This is where the CyberFundamentals Framework, better known as CyFun®, becomes particularly valuable.

What is the CyberFundamentals Framework?

CyFun® is a cybersecurity framework developed and owned by the Centre for Cybersecurity Belgium (CCB). It provides organisations with concrete measures and a structured, step-by-step approach to protecting data, reducing exposure to common cyberattacks and improving cyber resilience.

The current CyFun® 2025 edition was updated to align with the NIST Cybersecurity Framework 2.0 and alligns with national and European legislation, including the NIS2 Directive. It also places

emphasis on governance, supply-chain security, operational technology and clearer, more auditable controls.

The framework organises cybersecurity outcomes around six functions:

Govern
Identify
Protect
Detect
Respond
Recover

For organisations that require a formal assurance approach, CyFun® distinguishes between the Basic, Important and Essential assurance levels. Each level reflects a different risk and maturity profile. The objective is not to apply the same measures to every organisation, but to select a proportionate level based on its context, exposure and potential impact.

NIS2 defines the expectations. CyFun® helps organise the work.

Legislation describes obligations and expected outcomes. It does not manage your assets, assign control owners, configure your systems, test your backups or collect evidence for you. Those activities require a working method. CyFun® helps organisations translate broad cybersecurity expectations into:

Defined controls;
Technical and organisational measures;
Clear responsibilities;
Maturity objectives;
Supporting documentation;
Implementation evidence;
Prioritised improvement actions.

This creates a common language between management, IT, cybersecurity, risk, compliance, internal audit and external assessors. Instead of treating NIS2 as one large compliance project an organisation can divide the work into manageable decisions. That structure is essential. Without it organisations can spend significant time producing policies, purchasing tools or launching disconnected initiatives without knowing whether those investments address the most important risks.

Cybersecurity on paper is not enough.

A control may be described in a policy without being consistently implemented.
A security tool may be installed without clear ownership, monitoring or periodic review.
A backup may exist without being adequately protected or tested.
An incident response plan may have been approved without ever being exercised.

This is why evidence and maturity matter. CyFun® supports organisations in looking beyond the simple question of whether a control exists. It helps them examine how consistently that control is documented, implemented, monitored and improved. The framework’s self-assessment tools can support maturity scoring, gap identification and management reporting. The results can then be used to define priorities and build an implementation roadmap rather than becoming another static compliance spreadsheet. Demonstrating progress requires more than checking “implemented” in a questionnaire. The purpose of evidence is not to create unnecessary administration. It is to demonstrate that an organisation understands its risks, has selected appropriate measures and can show that those measures are operating in practice. Good evidence also improves decision-making. It allows management to distinguish between controls that are genuinely effective and controls that merely appear complete on paper.

A practical CyFun® training. Not another general NIS2 overview.

At NIS Institute we believe that cybersecurity training must lead to usable decisions and practical action. NIS Institute is therefore organising a one-day, live-online training on the CyberFundamentals Framework on 23 September 2026. The course is designed for professionals who already have a basic understanding of NIS2 and now need to translate that knowledge into implementation, assessment and evidence. The course does not repeat the general principles of the NIS2 Directive in detail. Instead, it focuses on how CyFun® can be applied in practice.

Training details

https://nisinstitute.eu/training/cyberfundamentals-cyfun-framework/

Date: Wednesday, 4 November 2026

Format: One full day, live online

Training provider: NIS Institute, the specialised training division of CyberMinute

Prior knowledge: Basic knowledge of NIS2 is recommended

Certificate: Participants receive a certificate of attendance

Practical focus: Controls, assurance levels, maturity, evidence, conformity assessment and implementation roadmapping

Participants who want to continue towards an internationally recognized PECB qualification can also choose an optional PECB Pack. This includes self-study materials for one of the following four Foundation training programs:

The PECB Pack includes access to the corresponding certification exam and one free retake. The pack is optional and separate from the CyFun® certificate of attendance.

The CyFun® Framework is a framework owned by the Centre for Cybersecurity Belgium (CCB), operating under the authority of the Prime Minister of Belgium.

The abbreviation “CyFun®” stands for “Cyberfundamentals Framework” and is a registered trademark owned by the CCB.

The CyFun® Framework and CyFun® Conformity Assessment Scheme (CAS) are available on www.cyfun.eu, which is their only authentic source.

The services offered by NIS Institute may contribute to third party assessments, but they do not replace nor fulfil any accredited third-party assessment as described by the CyFun® Framework. Therefore, NIS Institute can never claim that its services fully meet the requirements of the CyFun® Framework and the services cannot be considered for use in conformity assessments resulting in obtaining a presumption of conformity with the NIS2 Directive and its Belgian transposition.

If there is any discrepancy between the products and services offered by NIS Institute and the documents on the website, only the latest version of the documents on the website is deemed authentic.