FREE TOOL
Which CyberFundamentals level does your client need?
CyberFundamentals (CyFun), the Belgian cyber security framework from the Centre for Cybersecurity Belgium, has three levels: Basic, Important and Essential. This free tool uses the CCB’s own risk-scoring rule on a sector and company size to tell you which one applies, and how many controls that means.
From Commission Recommendation 2003/361/EC, consolidated with partner and linked companies.
Pick all three to see the level.
Not sure if NIS2 applies at all? The free NIS2 scope check answers that in five questions. Do the scope check →
How is the CyFun level decided?
The CCB’s CyFun Selection Tool scores a company by sector and size [2]. Each of the 18 NIS2 sectors has a published risk score; the tool scales that score to the company’s size (small, medium or large, under Commission Recommendation 2003/361/EC) and compares it to three bands: under 100 is Basic, 100 to 199 is Important, 200 or more is Essential.
Picking no sector at all is a valid answer: it is what the CCB itself tells anyone unsure to do, and the result is Basic, the entry level to build on.
This is a different question from whether NIS2 applies to your client at all, or whether it makes them an essential or important entity under the law. A small important entity can still land on CyFun Basic as a starting point. The free NIS2 scope check answers the legal-scope question in five questions.
The full picture of the three levels is on the levels page.
What happens after you know your level?
Essential entities have no choice in the long run: a certificate at Essential level is due by 18 April 2027, done by an accredited conformity assessment body. A company may start from an Important-level verification plus a plan to reach Essential by 18 April 2028, or justify a lower level with its own risk assessment and show by 18 April 2027 that it meets it (Royal Decree of 9 June 2024, art. 6-7) [3].
Important entities are supervised reactively, after an incident, not audited up front. A voluntary CyFun assessment is still possible, and if one is done it must verify at least the Important level (Royal Decree, art. 11) [3], even if the company’s own risk score points to Basic.
Outside NIS2, or on Basic by choice: there is no mandatory audit. Basic and Important are verification routes; only Essential is a full certification.
Once you know the level, the next question is how much work it is. The effort estimator and the audit cost estimator build on this result.
Frequently asked questions
- Which CyFun level does my client need?
- It depends on their sector and size. The CCB’s own risk-scoring tool gives a score under 100 for Basic, 100 to 199 for Important, and 200 or more for Essential. This tool runs that exact rule.
- What if we are not sure which sector applies?
- Pick "not sure / none of these". The result is Basic, which is also the CCB’s own advice to anyone unsure: start at Basic and upgrade as needed.
- Is the CyFun level the same as being an essential or important entity under NIS2?
- No. The law decides essential or important status from sector and size. The CCB risk assessment separately points to a CyFun level, and a small important entity can still land on Basic as a starting point. The free NIS2 scope check answers the legal question.
- Is a formal audit required at every level?
- No. Essential requires a certificate by an accredited body by 18 April 2027. Important has no mandatory assessment; a voluntary one must still verify at Important level or higher. Basic has no mandatory audit at all.
- How many controls does each level have?
- Basic has 34, Important 133, and Essential 218, each counting the levels below it, per ECP’s own CyFun catalogue and matching the CCB’s published 2025 figures.
- Was there once a lower level than Basic?
- Yes, called Small in the 2023 edition. CyberFundamentals 2025 dropped it: there are three cumulative levels today, Basic, Important and Essential.
Related free tools
- CyFun readiness quiz 19 plain questions covering the 34 controls of CyberFundamentals (CyFun) 2025 Basic. A score and a fix-first list, no email needed.
- CyFun effort estimator Pick a CyFun level and your starting hygiene. See how many weeks preparation typically takes, from 4 weeks for Basic to 36 for Essential.
- CAB audit cost estimator Pick your CyFun tier and hygiene. See the framework, prep time, audit fee and consultancy buckets, plus a Year-1 total range.
2026-11-03
Computed with the free tool at https://easycyberprotection.com/learn/tools/cyfun-level-check/, by Easy Cyber Protection.
#CYBERLEARN