How long does CyFun Basic take?

Usually 4-8 weeks if your security hygiene is already reasonable, or 12-16 weeks from a near-zero baseline. One real measured implementation took 11 weeks, with 26 days actually worked. The first is an estimate and the second a single case, so neither is a guarantee for your company.

Does working with an MSP make it faster?

We have one sourced comparison, and it covers only the Important-tier CAB-audit path: a first-time Important CAB audit with external consultancy takes 3-6 months of internal time, versus 3-4 months via an MSP running ECP. For Basic and Essential there is no sourced timeline for MSP involvement, so this tool does not invent one.

What about CyFun Essential?

Essential (218 controls) takes 24-36 weeks. The source does not split this tier by starting hygiene, so the range is the same whether your hygiene is reasonable or near-zero.

Is this an official CCB estimate?

No. The CCB publishes the CyFun framework and its control counts, which is where the 34/133/218 figures come from. The weeks estimate is ECP’s own industry-based figure, published on our CyFun audit cost page, not a CCB number.

Why does Basic split by hygiene but Important and Essential don’t?

Because that is what the source estimate says. We do not invent a split for Important and Essential that the source does not make, so both starting points show the same range.

← Free tools

FREE TOOL

How long does CyFun Basic or Important actually take?

This free tool estimates how many weeks CyFun preparation usually takes: 4-16 for Basic, depending on your starting point, 16-24 for Important and 24-36 for Essential. Pick your level and starting hygiene below.

Which CyFun level are you preparing for?

Basic (34 controls)Important (133 controls)Essential (218 controls)

Where are you starting from?

Reasonable existing security hygieneNear-zero baseline

Doing this with MSP or platform support

Estimated preparation time

4-8 weeks

about 1-2 months

This range depends on your starting hygiene.

A real measured example, not a universal average

One real CyFun Basic implementation, measured from the platform event log: 91% audit-ready (31 of 34 controls) in 11 weeks elapsed, 26 days actually worked, roughly one day a week. 87% of recorded activity was automated. This is one case, not a promise of what your timeline will be.

Read the full 11-week case study →

By Tom Janssens · Founder, Easy Cyber Protection · Last reviewed 3 November 2026 · How we write this

How is the weeks estimate worked out?

The CCB CyberFundamentals (CyFun) framework [1] has three tiers: Basic (34 controls), Important (133 controls) and Essential (218 controls). The weeks estimate below comes from another ECP article. It is our own estimate of preparation effort, based on industry experience, and not an official CCB figure.

That estimate splits Basic by your starting point: 4-8 weeks with reasonable existing security hygiene, 12-16 weeks from a near-zero baseline. Important and Essential are not split by hygiene in that source: Important takes 16-24 weeks either way, Essential 24-36 weeks. We show it as it is, rather than invent a split the source does not make.

These are weeks of calendar time, not hours. The source has no hours-per-week figure, so we do not show one.

See the full CyFun audit cost breakdown

What does a real CyFun Basic rollout look like?

The estimate above is a model. Here is one real, measured case: an anonymised Belgian SME reached 91% audit-ready on CyFun Basic (31 of 34 controls) in 11 weeks, with 26 days actually worked, roughly one day a week. 87% of the recorded activity was automated.

That company could not give you an hours figure either. The article says plainly that a platform event log cannot measure hours honestly, only the timespan and the counts. Read it as one real example, not an average.

Read the full 11-week case study →

Frequently asked questions

How long does CyFun Basic take?: Usually 4-8 weeks if your security hygiene is already reasonable, or 12-16 weeks from a near-zero baseline. One real measured implementation took 11 weeks, with 26 days actually worked. The first is an estimate and the second a single case, so neither is a guarantee for your company.
Does working with an MSP make it faster?: We have one sourced comparison, and it covers only the Important-tier CAB-audit path: a first-time Important CAB audit with external consultancy takes 3-6 months of internal time, versus 3-4 months via an MSP running ECP. For Basic and Essential there is no sourced timeline for MSP involvement, so this tool does not invent one.
What about CyFun Essential?: Essential (218 controls) takes 24-36 weeks. The source does not split this tier by starting hygiene, so the range is the same whether your hygiene is reasonable or near-zero.
Is this an official CCB estimate?: No. The CCB publishes the CyFun framework and its control counts, which is where the 34/133/218 figures come from. The weeks estimate is ECP’s own industry-based figure, published on our CyFun audit cost page, not a CCB number.
Why does Basic split by hygiene but Important and Essential don’t?: Because that is what the source estimate says. We do not invent a split for Important and Essential that the source does not make, so both starting points show the same range.

Related free tools

CyFun CAB audit cost breakdown · The real 11-week CyFun Basic case study

Use this with your clients

#CYBERLEARN

Train the team: Implementer

See the course →

Sources

CCB CyberFundamentals (CyFun) framework