Belgium CyberFundamentals

Belgium

v2023

6 domains

44 controls

Belgian Centre for Cybersecurity CyberFundamentals Framework

Verified

Belgium CyberFundamentals is a compliance framework from Belgium with 6 domains and 44 controls that map to 39 other frameworks. The largest domains are Belgium CyberFundamentals: Protect (18 controls), Belgium CyberFundamentals: Identify (9 controls), Belgium CyberFundamentals: Detect (7 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

Belgium CyberFundamentals: Detect

7 controls

Controls in the Belgium CyberFundamentals: Detect domain of Belgium CyberFundamentals — 7 controls
Code	Title	Description
BE-CF-12	Network monitoring and defense	Network monitoring and defense. Implements CyFun DE.CM-1: the network is monitored to detect potential cybersecurity eve...
BE-CF-17	Continuous monitoring strategy	Continuous monitoring strategy. Implements CyFun DE.CM: the information system and assets are monitored to identify cybe...
BE-CF-28	Audit event logging and storage	Audit event logging and storage. Implements CyFun PR.PT-1: audit and log records are determined, documented, implemented...
BE-CF-29	Audit record review and analysis	Audit record review and analysis. Implements CyFun DE.AE-2: detected events are analysed to understand attack targets an...
BE-CF-30	Time synchronization	Time synchronization. Supports CyFun PR.PT-1: reliable, synchronised time sources underpin audit log integrity and event...
BE-CF-31	Audit log protection and retention	Audit log protection and retention. Implements CyFun PR.PT-1: audit and log records are protected from unauthorised acce...
BE-CF-32	Accountability and non-repudiation	Accountability and non-repudiation. Implements CyFun PR.PT-1 / PR.AC-1: actions are attributable to individual users to...

Belgium CyberFundamentals: Identify

9 controls

Controls in the Belgium CyberFundamentals: Identify domain of Belgium CyberFundamentals — 9 controls
Code	Title	Description
BE-CF-13	Risk assessment procedures	Risk assessment procedures. Implements CyFun ID.RA: asset vulnerabilities are identified, internal and external threats...
BE-CF-14	Vulnerability scanning and management	Vulnerability scanning and management. Implements CyFun ID.RA-1 / DE.CM-8: vulnerability scans are performed and identif...
BE-CF-15	Security categorization	Security categorization. Implements CyFun ID.AM-5: resources are prioritised based on their classification, criticality...
BE-CF-16	Threat intelligence integration	Threat intelligence integration. Implements CyFun ID.RA-2: cyber threat intelligence is received from information-sharin...
BE-CF-26	System component inventory	System component inventory. Implements CyFun ID.AM-1 and ID.AM-2: physical devices, systems and software platforms withi...
BE-CF-33	Asset management and data flow mapping	Asset management and data flow mapping. Implements CyFun ID.AM-3 / ID.AM-4: organisational communication and data flows...
BE-CF-34	Business environment	Business environment. Implements CyFun ID.BE: the organisation's mission, objectives, stakeholders, role in the supply c...
BE-CF-35	Cybersecurity governance and policy	Cybersecurity governance and policy. Implements CyFun ID.GV: an organisational cybersecurity policy is established and c...
BE-CF-36	Supply chain risk management	Supply chain risk management. Implements CyFun ID.SC: cyber supply chain risk management processes are identified, estab...

Belgium CyberFundamentals: Protect

18 controls

Controls in the Belgium CyberFundamentals: Protect domain of Belgium CyberFundamentals — 18 controls
Code	Title	Description
BE-CF-01	Account management and provisioning	Account management and provisioning. Implements CyFun PR.AC-1: identities and credentials for authorised devices, users...
BE-CF-02	Access enforcement and least privilege	Access enforcement and least privilege. Implements CyFun PR.AC-4: access permissions and authorisations are managed, inc...
BE-CF-03	Multi-factor authentication requirements	Multi-factor authentication requirements. Implements CyFun PR.AC-7: users, devices and other assets are authenticated co...
BE-CF-04	Remote access controls	Remote access controls. Implements CyFun PR.AC-3: remote access to organisational systems is managed and secured.
BE-CF-05	Wireless access restrictions	Wireless access restrictions. Implements CyFun PR.AC-3 / PR.PT-4: wireless access is managed and communications and cont...
BE-CF-06	Identity proofing and verification	Identity proofing and verification. Implements CyFun PR.AC-6: identities are proofed and bound to credentials and assert...
BE-CF-07	Boundary protection and segmentation	Boundary protection and segmentation. Implements CyFun PR.AC-5 / PR.PT-4: network integrity is protected through network...
BE-CF-08	Cryptographic protection of data	Cryptographic protection of data. Implements CyFun PR.DS-1 and PR.DS-2: data-at-rest and data-in-transit are protected u...
BE-CF-09	Denial-of-service protection	Denial-of-service protection. Implements CyFun PR.DS-4 / PR.PT-4: adequate capacity to ensure availability is maintained...
BE-CF-10	Transmission confidentiality and integrity	Transmission confidentiality and integrity. Implements CyFun PR.DS-2: data-in-transit is protected for confidentiality a...
BE-CF-11	Session management controls	Session management controls. Implements CyFun PR.AC-7 / PR.PT-4: sessions are authenticated and managed to protect confi...
BE-CF-23	Baseline configuration establishment	Baseline configuration establishment. Implements CyFun PR.IP-1: a baseline configuration of information technology and c...
BE-CF-24	Configuration change control	Configuration change control. Implements CyFun PR.IP-3: configuration change control processes are established and appli...
BE-CF-25	Security impact analysis	Security impact analysis. Implements CyFun PR.IP-3: changes are assessed for security impact before implementation under...
BE-CF-27	Software usage restrictions	Software usage restrictions. Implements CyFun PR.IP-1 / PR.DS-6: authorised software usage is governed and integrity-che...
BE-CF-37	Awareness and training	Awareness and training. Implements CyFun PR.AT: all users are informed and trained, and privileged users, third-party st...
BE-CF-38	System maintenance	System maintenance. Implements CyFun PR.MA: maintenance and repair of organisational assets are performed and logged wit...
BE-CF-39	Data security lifecycle management	Data security lifecycle management. Implements CyFun PR.DS-3 / PR.DS-5: assets are formally managed throughout removal,...

Belgium CyberFundamentals: Recover

3 controls

Controls in the Belgium CyberFundamentals: Recover domain of Belgium CyberFundamentals — 3 controls
Code	Title	Description
BE-CF-40	Recovery planning	Recovery planning. Implements CyFun RC.RP-1: a recovery plan is maintained and executed during or after a cybersecurity...
BE-CF-41	Recovery improvements	Recovery improvements. Implements CyFun RC.IM: recovery planning and processes are improved by incorporating lessons lea...
BE-CF-42	Recovery communications	Recovery communications. Implements CyFun RC.CO: public relations are managed, reputation is repaired after an incident,...

Belgium CyberFundamentals: Respond

5 controls

Controls in the Belgium CyberFundamentals: Respond domain of Belgium CyberFundamentals — 5 controls
Code	Title	Description
BE-CF-18	Incident response planning and testing	Incident response planning and testing. Implements CyFun RS.RP-1: a response plan is maintained, tested and executed dur...
BE-CF-19	Incident handling and containment	Incident handling and containment. Implements CyFun RS.MI-1 / RS.MI-2: incidents are contained and mitigated.
BE-CF-20	Incident reporting and notification	Incident reporting and notification. Implements CyFun RS.CO-2 / RS.CO-3: incidents are reported consistent with establis...
BE-CF-21	Forensic analysis capabilities	Forensic analysis capabilities. Implements CyFun RS.AN-1 / RS.AN-3: detection notifications are investigated and forensi...
BE-CF-22	Lessons learned and improvement	Lessons learned and improvement. Implements CyFun RS.IM-1 / RS.IM-2: response activities incorporate lessons learned and...

Belgium CyberFundamentals: Scoping and Regulatory Alignment

2 controls

Controls in the Belgium CyberFundamentals: Scoping and Regulatory Alignment domain of Belgium CyberFundamentals — 2 controls
Code	Title	Description
BE-CF-43	Assurance level selection and scoping	Assurance level selection and scoping. Core to CyFun: the organisation selects the appropriate assurance level (BASIC, I...
BE-CF-44	NIS2 alignment	NIS2 alignment. Core to CyFun: the CyberFundamentals key measures are mapped to the obligations of the NIS2 Directive (a...

Your Compliance Coverage

If you comply with Belgium CyberFundamentals, you already cover:

NIST Cybersecurity Framework 2.0

100%

44 controls mapped

Compare →

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

32%

14 controls mapped

Compare →

API 1164

30%

13 controls mapped

Compare →

+ 36 more: NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements (30%), ISO/IEC 27400:2022 (25%)

See all 39 mapped frameworks ↓

Maps to 39 other frameworks

44 total controls

NIST Cybersecurity Framework 2.0

44 source controls mapped|32 target controls covered

100%

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

14 source controls mapped|10 target controls covered

32%

API 1164

13 source controls mapped|12 target controls covered

30%

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

13 source controls mapped|8 target controls covered

30%

ISO/IEC 27400:2022

11 source controls mapped|5 target controls covered

25%

ASD Strategies to Mitigate Cyber Security Incidents

10 source controls mapped|11 target controls covered

23%

ISO/IEC 27011:2024

9 source controls mapped|6 target controls covered

20%

ISO/IEC 27010:2015

8 source controls mapped|5 target controls covered

18%

APPI

7 source controls mapped|4 target controls covered

16%

IEC 62351 - Power Systems Communication Security

7 source controls mapped|3 target controls covered

16%

Barbados Data Protection Act 2019

6 source controls mapped|1 target controls covered

14%

ASIS SPC.1-2009 - Organizational Resilience Standard

6 source controls mapped|2 target controls covered

14%

NIST SP 800-171

6 source controls mapped|2 target controls covered

14%

ISO/IEC 30111:2019

4 source controls mapped|2 target controls covered

ISO/IEC 29134:2023

4 source controls mapped|2 target controls covered

ISO/IEC 29147:2018

4 source controls mapped|3 target controls covered

AML/CTF Act 2006 (Australia)

4 source controls mapped|2 target controls covered

ISO 19011

3 source controls mapped|5 target controls covered

ISO 31000:2018

3 source controls mapped|4 target controls covered

ISO/IEC 27557:2022 - Organisational Privacy Risk Management

3 source controls mapped|2 target controls covered

SQF Code Edition 9 - Safe Quality Food

3 source controls mapped|2 target controls covered

ISO/IEC 27031:2011

3 source controls mapped|1 target controls covered

AS9100D - Aerospace Quality Management System

3 source controls mapped|1 target controls covered

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

2 source controls mapped|4 target controls covered

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution

2 source controls mapped|3 target controls covered

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework

2 source controls mapped|4 target controls covered

IEC 60601-1 - Medical Electrical Equipment Safety