Belgian cybersecurity authority outlines NIS2 assessment requirements for essential entities

Belgium’s Cybersecurity Centre (CCB) has issued a general communication and information request to organisations classified as essential entities under the country’s NIS2 framework. The communication concerns the mandatory conformity assessment that these organisations must complete by 18 April 2027.

Essential entities are required to demonstrate that they have implemented cybersecurity measures equivalent to the ‘Essential’ assurance level of Belgium’s CyberFundamentals Framework, known as CyFun®. Organisations that cannot demonstrate this level of compliance by the deadline may be asked to submit a remediation plan.

Such a plan must provide evidence that the organisation already complies with cybersecurity measures equivalent to the CyFun® ‘Important’ assurance level and describe the measures planned to reach the ‘Essential’ level by 18 April 2028.

The approach applies regardless of the conformity assessment route chosen by an organisation, including CyFun® certification or verification, ISO/IEC 27001 certification, or an assessment conducted by the CCB’s Inspection Service.

The CCB stressed that the communication does not change the obligations or deadlines established under the Belgian NIS2 Law and its implementing Royal Decree. Organisations that can already demonstrate compliance with measures equivalent to the ‘Essential’ level by 18 April 2027 will not be required to submit a remediation plan. The same applies where an organisation can justify, on the basis of its risk analysis, the implementation of measures corresponding to a lower CyFun® assurance level.