NIS2 & CyFun
Difference Between NIS2 & CyFun
NIS2 is the European legislation that requires organizations to strengthen their cybersecurity, while CyFun (CyberFundamentals) is the practical framework, developed by the CCB, to meet those requirements. NIS2 defines what must be done, CyFun shows how.
| NIS2 | CyFun | |
|---|---|---|
| Type | Legislation | Framework / Tool |
| Focused on | Obligations, risk management, incident reporting | Concrete measures, standards and roadmaps |
| Approach | Legal and results-oriented | Technical, practical and implementation-oriented |
In summary
- NIS2: The why and what (legal obligation)
- CyFun: The how (concrete implementation)
- CyFun is the Belgian translation/implementation of NIS2, developed by the CCB.
Threat Landscape
Geopolitical Context
Cybercrime is closely tied to geopolitical instability. In regions such as KK Park, Myanmar — politically unstable after a coup, high corruption, no extradition treaties — cybercrime has become a logical choice due to impunity.
- An estimated 23,000 hackers and scammers active in a single city
- Fully professionally organized: HR, managers, targets, daily operations
- Countries without an extradition treaty = impossible to prosecute
- The FBI has a list full of 'most wanted' hackers, knowing exactly where they are, but powerless to act
Geopolitical tension = increased cyber risk
The greater the geopolitical tension between countries, the greater the motivation for state-sponsored and criminal hackers. Cyberattacks are the "easiest way to wage war."
Cybercrime as a Professional Industry
- Cybercriminals have become organized, professional entities
- 547 known hacking groups, including Lockbit, Medusa, Play Hacking Group
- Leaked data is used in 4 ways:
- Guessing passwords more easily (credential stuffing)
- Identity fraud
- Spear phishing
- Sale on the dark web
Who would even want to hack me?
Knowing who was attacked often only becomes clear after the breach. Attackers only look afterward at what the potential loot or impact could be. Everyone is a potential target.
Known Cases
Case 1 — Limburg.net (Medusa, 2023)
- November 14: first login attempts with valid passwords → blocked by MFA
- November 17: an RDP session without MFA → successful breach
- Only a month later, when file encryption started, did Limburg.net realize they'd been hacked
Would CyFun have prevented this? MFA on all services (including RDP) is a baseline requirement in CyFun.
Case 2 — City of Antwerp (Play Hacking Group)
- The City of Antwerp was down for 2 years after the attack
- Recovery costs: ±100 million euros, aside from any potential fine
Case 3 — Salesforce Connected App
- The attacker created a new "Connected App" in Salesforce via social engineering (phone call)
- Looked harmless, but granted full access → game over
NIS2 Guidelines
Critical vs. Highly Critical Entities
| Category | Maximum downtime |
|---|---|
| Highly critical | Less than 1 day |
| Critical | Less than 1 week |
Supply Chain
One of the most important additions in NIS2 is the supply chain obligation:
If you park a service with a supplier, you must contractually enforce cybersecurity requirements and actively monitor compliance.
Liability of Governing Bodies
Board members can be held jointly and severally liable, up to and including imprisonment.
Vastamo Case
Vastamo was a Finnish psychotherapy center. The CEO was sentenced to 3 months, suspended because basic measures weren't taken after a data breach in which patient records were stolen.
CyFun Audit Methodology
Phases
| Phase | Contents |
|---|---|
| Phase 1 | Gap analysis and interviews |
| Phase 2 | Addressing issues: writing policies, acquiring tools, etc. |
| Phase 3 | Preparing a claim via self-assessment |
Risk of self-scoring
If your organization marks something as "pass," and an external auditor later disagrees, you bear full responsibility. Be conservative in your scoring.
Way of Work (Interview)
- During the interview: note everything, don't score yet
- The client may send supporting evidence afterward
- Notes serve as the consultant's personal guide
Maturity Levels
Every measure gets a score on both implementation and documentation. Always start with documentation.
| Score | Meaning |
|---|---|
| 1 | No policy documents (signed by management) present |
| 2 | A policy document exists, but hasn't been updated in the last 2 years |
| 2.5 | The measure is deliberately excluded with justification (max. 1 per assessment, well substantiated) |
| 3 | Documented and implemented |
| 4+ | Optimized / continuously improved |
Important for key measures
For a score above 3, the auditor will check much more strictly. In practice, give key measures at most a 3, unless you can back it up with rock-solid evidence.
Policy document vs. execution: - The policy document shows the minimum requirements set by management - The contract/SLA with the vendor is the proof that this is actually carried out that way
Audit Sheet vs. Gap Analysis
| Document | Purpose |
|---|---|
| Audit Sheet | Purely the findings — technical, complete, objective |
| Gap Analysis | A strategic overview for management — explains what, why and how (plan of action) |
The recipient's language
The gap analysis must be written in the language of the recipient. Non-IT profiles need a different approach than technical profiles.
Final note
In the end, what counts isn't the consultant's score, or the client's — it's the score of the body that carries out the final audit.