Clients asking about NIS2?
White-label NIS2/CyFun compliance platform for MSPs
Use our platform to get you and your clients audit-ready. Step by step, through CyFun (Cyber Fundamentals), the official framework for NIS2 compliance in Belgium, Cyprus, Ireland, Malta and Romania. You stay the expert; the busywork goes.
An MSP intern achieved 91% audit-ready in 11 weeks, working one day weekly
while also handling second-line helpdesk support
Why your clients (will) ask for NIS2 compliance
Since 2024, the EU law NIS2 requires about 4,000 Belgian companies (registered by January 2026) to prove protection against hackers. Your client doesn't need to be on that list to face the question.
- It comes down the supply chain. Those roughly 4,000 companies now have to ask the same of their own suppliers, and your client only needs to sell to one of them. The question arrives as a supplier questionnaire, and "we're fine" is not an answer to it.
- CyFun is the yardstick. An official, free checklist, written in Belgium and now shared by five EU countries. Not the only route to NIS2 (ISO 27001 is another), but the one most Belgian SMEs take.
- The requirement stops being your opinion. "You need MFA on every account" gets argued down every budget round. Backed by a control in CyFun, it is not up for debate. You stop selling security and start reporting against a standard.
- The clock is not theirs. Ignoring it can cost a company up to €10 million. Getting ready takes months, so the work starts long before anyone goes looking for an auditor.
You're already their IT provider. This isn't a new vendor for them to evaluate. It's the next step in what you already handle for them.
What you would use instead, and where it breaks
You can do CyFun without us. These are the usual alternatives.
- A CyFun spreadsheet per client. Free, and fine for one client. At ten clients it is ten files, with no shared evidence and no history of what changed.
- An outside consultant. Billed by the day, per client. Your margin goes to them, and so does part of the relationship.
- A general GRC platform. Mostly built for software companies chasing SOC 2 or ISO 27001, and priced per company. CyFun, where it exists, is one framework among many.
- A security tool for MSPs, priced per user. Some now cover Cyber Fundamentals too. Compare what one client costs you, and what you can show an auditor.
- Your Microsoft 365 security reports. They show how your tools are set up, not the policies, roles and processes that make up the other half of CyFun.
- Waiting. Your client's biggest customer will not.
ECP is built for one job: an MSP running CyFun for several clients. One fee per client, no monthly base fee, and the same workflow for every client.
What it costs your client: a project, then a recurring fee
Two parts. First a project to get your client audit-ready, which you bill at your own rate. Then one recurring fee per client for the platform, which you resell.
1. The project: getting audit-ready
| Phase | What it is | What it took in practice |
|---|---|---|
| Getting audit-ready | A real project, with hands-on setup and fixing. | What it took in practice11 weeks total, averaging 1 day per week (at one five-person MSP: CyFun Basic, with a sound technical baseline). |
| Continuous compliance | Lighter and ongoing, driven by the integrations. | Reviewing what changed and re-approving documents. |
Expect real time on both sides. The fixing is the same MFA, firewall and backup work you already do for clients, so there is nothing new to learn.
2. The recurring fee: the platform
One fee per client, no base fee, no modules. Determined by the client's employee count. All CyFun levels, from Basic to Essential, are included, with no cost for switching.
Drag the total, or any row, to match your own book.
That is €2,435 per month of recurring revenue.
Recurring revenue you are not billing today, and the gaps it surfaces (MFA, backups, patching) become projects on top.
The requirement comes from the framework, not from you. You stop arguing for a security budget and start reporting against a standard.
| Band | Employees at that client | Clients | Per client / month | Subtotal |
|---|---|---|---|---|
| Nano | 1 – 4 | 0 | €49 | €0 |
| Micro | 5 – 12 | 1 | €99 | €99 |
| Core | 13 – 29 | 2 | €169 | €338 |
| Growth | 30 – 49 | 2 | €229 | €458 |
| Medium | 50 – 249 | 2 | €395 | €790 |
| Large | 250 – 999 | 1 | €750 | €750 |
| Enterprise | 1,000+ | 0 | — | — |
| Total | 8 | €2,435 | ||
Pre-pay monthly (MSRP), quarterly (−6%), six-monthly (−8%) or annually (−12%).
Plus €400 onboarding, once. That is for you, not per client: one guided session where we walk through the platform together. Adding a client is immediate, not a rollout. After that you move at your own pace, not ours. All amounts excluding VAT.
Connect a client's Microsoft 365 and stop chasing screenshots
Most of a CyFun Basic file is proving things that are already true inside the client's tenant: who has multi-factor switched on, which accounts are administrators, whether the old mail protocols are still open. ECP reads that straight from Microsoft 365 and files it against the right control, so the answer is waiting when the auditor asks for it.
Seventeen of the thirty-four Basic controls take their evidence straight from Microsoft 365. Three more if the client runs Defender for Endpoint.
Twelve separate checks look at identity
- ✓ whether the older mail protocols, which sign in with a password alone, are blocked
- ✓ whether administrators have actually set up a second factor, and were not merely asked to
- ✓ how many accounts hold full control of the tenant
- ✓ whether staff can approve third-party apps without an administrator
It reports what it finds, including when the answer is no. A failing check is evidence too. Some name the accounts involved, others report on a setting. Either way it reads as a task list rather than a score.
The platform finds the gaps. Fixing them stays your job.
Think scoreboard, not gym: it shows what is missing, and the work stays yours.
What the platform does, and what you do
What the platform does
- Finds missing controls, ranked by what is quickest to fix.
- Gives step-by-step fixes for each gap.
- Drafts policy documents for your final review.
- Lets you re-check any time, so you can track progress.
What stays your work
- Switching on the technical controls (MFA, firewalls).
- Testing backups, so you know a restore works.
- Collecting audit evidence that shows compliance.
- Making the policy calls that need your judgment.
So how do I sell this?
Reselling this to clients?
Partners buy below the rates above and invoice their own client under their own brand. It is a fixed percentage off the published card, the same for a partner with three clients as for one with fifty. We don't publish the number, because your clients read this page too. One rate card, the same for every partner, not negotiated. Ask for access and the card comes with my reply.
50 pages, free. Provide your work email, and the PDF is delivered immediately. Preview the opening chapters without obligation.
What MSP owners ask before they say yes
Is compliance expertise required?
You need judgment, not a compliance team. The platform does the routine work: mapping controls, collecting evidence, finding gaps and building the audit package. You decide the scope, which risks to accept, and whether the evidence is good enough. Solo CyFun consultants report this reduces their per-client hours by about 40-50%.
What do my clients see?
Your brand, on every report, email and page. Your clients see you as the compliance expert.
Can I determine my own pricing?
Yes. We bill you per client. You set the price for your clients.
How do we begin?
Schedule a 20-minute call with Tom. He guides you through the platform, sets up your first client, and you launch the same week. No contract required.
What does "audit-ready" mean?
It means your client has documented evidence of security controls aligned with the CyFun framework. The actual audit is done by certified CAB auditors, not by us or you. Five bodies can verify CyFun at Basic and Important level today, and none is authorised for Essential yet, so those entities currently take the ISO 27001 route.
How is pricing structured?
One fee per client, based on size, as in the estimator above. Plus a one-time €400 onboarding fee. No monthly base charge. Rates are billed monthly.
You select your term:
- Monthly
- Quarterly, 6% off
- Six-monthly, 8% off
- Annually prepaid (12% discount)
Larger volumes can be billed more frequently. Just let us know.
You set your own price. The estimator shows a suggested retail price for the end client, not a requirement. Charge what your market pays. Partners buy well below it.
Every licence includes AI support. If you want a human involved, there is an optional ladder on top of it. Each rung includes the one below it:
- Guidance, €400 a quarter: unlimited AI support, five human-reviewed email questions a quarter, a one-hour onboarding session and a quarterly report
- Asynchronous advisory, €1,500 a month: email and WhatsApp, responded to within 24 hours
- Half a day a week, €4,500 a month: the above plus four hours of meetings a week
- One day a week, €7,000 a month: the above plus eight hours of meetings a week, on site or online
Guidance does not replace the one-time €400 onboarding.
Turn NIS2 into recurring revenue, without hiring.
Request access, take the guide, or look at the demo first.
"Small businesses are badly underserved in cybersecurity. Helping them is my personal goal."
Tom Janssens, Founder
20+ years across IT and innovation management, including Eurocontrol (the organisation behind European air traffic) and Belgian SMEs.