NIS2 in Belgium: a step-by-step compliance guide

A practical route through the Belgian NIS2 Law: confirm scope, register with the CCB, choose a CyFun level or ISO/IEC 27001, report incidents and pass the conformity assessment.

This guide is for the person who has to make NIS2 work inside a Belgian organisation, whether a CISO, an IT manager, a compliance lead or an external vCISO. It covers the whole route: confirming scope, registering with the CCB, choosing an assurance level, closing gaps and getting through a conformity assessment. You will finish with a dated plan, owners and the evidence each step should produce, ordered by what a supervisor will ask for first.

Before you start

Name a single NIS2 coordinator with a direct line to the management body. Gather legal entity data (enterprise number, headcount, turnover, balance sheet, group links) and a list of services provided in Belgium and elsewhere in the EU. You will also need someone who is authorised to log in to Safeonweb@Work on behalf of the enterprise. Finally, put a date in the diary for the first management briefing. Under NIS2, the management body approves and oversees the risk-management measures, so its members have to be involved from the start.

Step 1: Confirm scope and classification

Under the Belgian law, NIS2 covers entities of a type listed in Annex I or Annex II that are at least medium-sized under Commission Recommendation 2003/361/EC. It also covers some entities regardless of size, such as DNS service providers, TLD registries, qualified trust service providers and public electronic communications providers^[4]. Large Annex I entities are generally essential. Medium-sized Annex I entities and all in-scope Annex II entities are generally important. The CCB offers a scope test tool on Safeonweb@Work^[3].

• Map each service to an Annex I or II sector and subsector. Record why you mapped it that way.
• Calculate size using staff headcount and financial data. Include linked and partner enterprises as the Recommendation requires.
• Check whether any regardless-of-size rule applies, and whether the CCB has identified the organisation directly.
• Record the result as essential, important or out of scope, and have it signed off.

Step 2: Register with the CCB on Safeonweb@Work

Registration happens through an online form on Safeonweb@Work. Entities in certain digital sectors had to register by 18 December 2024. All other essential and important entities, and DNS registration service providers, had to register by 18 March 2025^[2]. If you have not registered yet, do it now.

• Register the legal entity, its sector(s), contact details, public IP ranges and the EU Member States where you provide services.
• Appoint at least two contacts so that incident communication does not depend on one person.
• Diarise a check of the registration data every quarter. Notify the CCB of changes straight away. The Directive allows at most two weeks^[4].

Step 3: Brief and train the management body

The management body must approve the cybersecurity risk-management measures and oversee how they are implemented. It can be held liable if the entity breaches its obligations. Its members must also follow training so they can identify risks and assess cybersecurity practices^[2]. The CCB treats training as an early step and encourages ongoing awareness training for staff as well^[3].

• Run a training session for directors on NIS2 duties, the organisation’s risk profile and how incidents are escalated.
• Agree a standing cybersecurity agenda item with a fixed frequency, at least quarterly.
• Minute the approval of the NIS2 programme, the budget and the chosen conformity route.

Step 4: Choose the conformity route and CyFun level

In Belgium, a presumption of conformity comes from one of two recognised frameworks: CyberFundamentals (CyFun) or ISO/IEC 27001. CyFun has three assurance levels, BASIC, IMPORTANT and ESSENTIAL. The CCB’s CyFun selection tool, which is built on a risk assessment, tells you which level fits^[3]. The ESSENTIAL level is the normal target for essential entities. An essential entity that wants to work to a lower level must be able to justify that choice, and inspectors can sanction a level that is wrongly low^[2]. The ISO/IEC 27001 route needs a scope and Statement of Applicability that cover the NIS2 services and that the CCB accepts.

• Run the CyFun selection tool and record the result.
• If you already hold ISO/IEC 27001, check that its scope covers every in-scope service and site.
• Decide which CyFun version to use. CyFun 2025 was published on 29 October 2025, and CyFun 2023 stays available only for a transition period^[5].

Step 5: Run a gap analysis and build a phased plan

The CCB’s suggested approach takes three steps. First, assess your current maturity with the CyFun self-assessment tool. Then implement the missing measures in phases that fit the review deadlines. Finally, update the self-assessment and collect evidence as you go^[3]. Start with the CyFun key measures, because assessors look at them first.

• Score every control at your target level and identify the gaps in the key measures.
• Group the remediation work into quarterly phases, each with an owner, a budget and a target date.
• Link each control to the risk register so that you can justify any exclusions with a recorded risk decision.

Step 6: Implement the Article 21 measures

Article 21(2) of the Directive lists ten areas: risk analysis and security policies, incident handling, business continuity and crisis management, supply chain security, secure acquisition and development including vulnerability handling, assessing effectiveness, cyber hygiene and training, cryptography, HR security together with access control and asset management, and MFA with secured communications^[4]. CyFun and ISO/IEC 27001 Annex A both cover these areas. Implementing your chosen framework properly therefore covers Article 21.

• Roll out MFA on remote access, privileged accounts and email first, since these are high-impact and quick to prove.
• Test the backup restore and the crisis plan, and record the results.
• Ask key suppliers for at least CyFun BASIC or an equivalent. This is what the CCB recommends for supply chains^[3].

Step 7: Set up incident notification to the CCB

Since 18 October 2024, essential and important entities have had to report significant incidents to the CCB^[3]. An incident is significant if it has caused, or could cause, severe operational disruption or financial loss, or if it affects others through considerable material or non-material damage. Notification follows the Directive’s sequence: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month. Trust service providers have a 24-hour limit for the notification^[4]. In some cases you must also inform the recipients of your services.

Stage	Deadline	Content
Early warning	24 hours	Suspected malicious cause and possible cross-border impact
Incident notification	72 hours	Initial assessment, severity, impact and indicators of compromise
Intermediate report	On request	Status updates
Final report	1 month after notification	Root cause, mitigation and cross-border impact

• Build the significance criteria into your incident classification procedure.
• Store the CCB platform access and the emergency contact details in the incident runbook.
• Run a tabletop exercise that times the 24-hour and 72-hour steps.

Step 8: Pass the conformity assessment

Essential entities must undergo a regular conformity assessment. By 18 April 2026, the CCB expected each essential entity to hold, or be actively working towards, a CyFun BASIC or IMPORTANT verification, or to have a signed agreement with an accredited body. Under the ISO route, the entity had to submit its certification scope, its Statement of Applicability and its latest internal audit report. A third option was to submit a self-assessment and request an inspection, which the CCB warns may lead directly to supervisory measures. The final certification at the chosen level is due by April 2027^[1], which the CCB’s NIS2 page sets at 18 April 2027^[2]. CyFun assessments are carried out by conformity assessment bodies that BELAC has accredited and the CCB has authorised^[6].

• Book the assessment body early, because capacity is limited ahead of April 2027.
• Run an internal audit and a management review before the external assessment.
• If you missed 18 April 2026, write down the reason and the recovery plan, and send it to the CCB proactively.

Step 9: Keep it running

NIS2 is a continuous obligation. Review the risk assessment yearly, re-run the CyFun self-assessment after major changes and report regularly to the management body. The companion template includes the full readiness checklist, a deadline tracker and a management-reporting sheet. In Secrato, each step maps to a CyFun or ISO control in the Unified Control Library, so one set of evidence supports the verification, the ISO audit and any CCB inspection.

How this connects to other frameworks

CyFun is built around the NIST Cybersecurity Framework and is aligned with ISO/IEC 27001. Work done for one therefore carries over to the other (see CyFun and ISO 27001). For financial entities, DORA applies as lex specialis for ICT risk management and incident reporting. Supply-chain measures overlap with GDPR processor due diligence.

Frequently asked questions

We are an important entity. Do we need a CyFun verification?

It is not mandatory. Important entities are supervised ex post, but they may choose the same conformity assessment as essential entities and gain a presumption of conformity^[2]. After an incident, a verification statement makes it much easier to show that you complied.

Is ISO/IEC 27001 accepted instead of CyFun?

Yes, if the certification scope and the Statement of Applicability cover the NIS2 services and the CCB accepts them. Use a certification body that is accredited and authorised to certify under the Belgian NIS2 acts^[1][6].

What are the fines?

The Directive sets maximum fines of at least €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities^[4]. In Belgium, fines are doubled for repeat breaches within three years^[2].