Français
NederlandsNIS2, CyFun, ISO 27001 and CRA compliance
From assessing your obligations to preparing for the conformity assessment, we help you take proportionate measures and demonstrate them, with the rigour of a firm that is itself ISO/IEC 27001 certified.
Who it is for
- Essential and important entities under the Belgian law of 26 April 2024, which transposes NIS2.
- Local authorities and public bodies.
- Suppliers to these entities, whose customers ask for security guarantees.
- Manufacturers of products with digital elements, covered by the Cyber Resilience Act.
- Organisations aiming for ISO/IEC 27001 certification.
What we do
NIS2 scope and obligations
Qualification of your entity, registration with the CCB, risk management measures and incident reporting.
CyberFundamentals (CyFun) audit
Assessment of your measures against the target CyFun level (Basic, Important or Essential) and of the gaps to close.
Conformity assessment readiness
Action plan, evidence and mock audit before CyFun verification or certification, or ISO/IEC 27001 certification, by an accredited body.
ISO/IEC 27001
Setting up or strengthening your information security management system: risk analysis, statement of applicability, policies.
Cyber Resilience Act
Security requirements for digital products, vulnerability handling and manufacturers' reporting obligations.
Incident response
Response plans, reporting procedures to the CCB and crisis exercises with management.
Our approach
Measures proportionate to your situation, and evidence an auditor can verify.
Qualification
Are you in scope, in what capacity and at what level? A first conversation is often enough to answer.
Gap analysis
Assessment of existing measures against the chosen framework, based on the available evidence.
Action plan
Measures prioritised by risk, effort and deadlines, then approved by management.
Through to assessment
Implementation with your teams and suppliers, then preparation for verification, certification or inspection.
Frequently asked questions
Is my organisation covered by NIS2?
The Belgian law of 26 April 2024 applies to essential and important entities across many sectors, depending on their activity and size; the CCB can also identify certain entities. Suppliers outside the scope are often affected indirectly, through their customers' requirements.
What must essential entities demonstrate, and by when?
They must undergo a regular conformity assessment: CyFun certification, ISO/IEC 27001 certification or inspection by the CCB. The first deadline is 18 April 2027, unless the entity is formally identified later.
Do important entities need to be certified?
It is not mandatory. They can opt for CyFun verification or ISO/IEC 27001 certification, which give a presumption of conformity, provided the chosen scope is acceptable to the CCB.
CyFun or ISO 27001: which should we choose?
Both routes are recognised. CyFun is more prescriptive and designed for NIS2 in Belgium; ISO 27001 suits organisations that want an internationally recognised management system. The choice depends on your customers, your size and your maturity.