YTYK You think you know

Card 18 of 18 Belgium — the local layer ●●○ Working knowledge

Three ways to prove it

A Belgian entity can demonstrate conformity in three ways: a CyFun verification or certification at the right level, an ISO/IEC 27001 certification with a scope that covers the relevant activities, or an inspection by the CCB.

Why it is like this

Giving organisations a recognised route avoids every entity inventing its own evidence pack, and lets the authority spend its inspectors where no third party has already looked.

Not to be confused with

An exemption. A certificate does not end the obligation: the measures must still be in place, the incidents must still be reported, and the certificate's scope is what it covers — not the whole organisation by default.

In practice

An entity with ISO 27001 covering only its datacentre operations has not covered its in-scope service. Scope is where this goes wrong most often.

Source: Centre for Cybersecurity Belgium — NIS2 and CyberFundamentals — CCB — proving conformity. Read on .

Predict Check yourself

An essential entity holds ISO/IEC 27001 covering only its hosting platform, while the in-scope service runs elsewhere. Where does that leave it?

  1. Not demonstrated — a certificate counts for what its scope covers, and the in-scope service is outside it.
  2. Demonstrated — holding 27001 satisfies the requirement regardless of scope.
  3. Demonstrated, provided the certificate is less than three years old.
  4. Exempt from inspection for the duration of the certificate.
Show the answer

Not demonstrated — a certificate counts for what its scope covers, and the in-scope service is outside it.

Scope is the whole question with a certificate. A statement of applicability that excludes the in-scope service evidences nothing about it.