CyberFundamentals as the conformity path
The CCB's CyberFundamentals framework (CyFun®) offers graded assurance levels — Small, Basic, Important and Essential — built from existing standards, with the Important and Essential levels mapped to what NIS2 expects of each class of entity.
Why it is like this
Article 21 states outcomes, not controls. CyFun turns those outcomes into a concrete, auditable control set sized to the entity, which is what makes 'are we compliant' a question with an answer.
Not to be confused with
A Belgian invention from scratch. CyFun is assembled from NIST CSF, ISO 27001, CIS Controls and IEC 62443 — if you already run one of those, much of the evidence exists.
In practice
An important entity targets CyFun Important; an essential entity targets CyFun Essential. The assessment produces a score and a gap list that maps back to Article 21.
Source: Centre for Cybersecurity Belgium — NIS2 and CyberFundamentals — CCB — CyberFundamentals framework. Read on .
Odd one out Check yourself
Three of these are CyberFundamentals assurance levels. Which is not?
Show the answer
Advanced
The levels are Small, Basic, Important and Essential — the last two named after the NIS2 entity classes they are sized for. There is no Advanced level.