CyberFundamentals Framework 2025

CyFun® 2025 was created to match international standards like the NIST Cybersecurity Framework 2.0 and national and European legislations and regulations, such as the European NIS2 Directive. It includes the latest knowledge and best practices in cybersecurity.

Earlier this year, over 80 experts and organisations helped review the first draft. Their feedback made the framework easier to understand and more practical to use.

Key improvements

• More focus on protecting the supply chain (e.g. your suppliers and partners)
• More focus on OT
• Clearer rules and controls to make checking and auditing easier
• Governance measures have been added starting from the Important Assurance Level, helping organisations improve oversight and align cybersecurity with business goals
• Extra guidance to help with using and understanding the framework

Transition period

To make the switch easier, both CyFun® 2023 and CyFun® 2025 will be both available for a while. After that, only the new version will be accepted for self-assessments and third party conformity assessment.

1. General

In support of the ‘CyberFundamentals Framework’ the Centre for Cybersecurity Belgium (CCB) has developed a tool in MS^© Excel.

The self-assessment tool takes into account the requirements for assurance level 'Basic', assurance level 'Important' and assurance level 'Essential' of a specific version of the framework as well as the requirements identified in the Conformity Assessment Scheme (CAS). The versions of the CyberFundamentals framework and CAS with which the tool is aligned, are identified in the tool. For this reason, the tool shall not be modified as part of any verification or certification activity.
 

2. Tool layout

The self-assessment tool in MS^© Excel includes several tabs, each with its own function. Besides introduction, maturity levels and references, there are the tabs with the controls for assurance level ‘Basic’, ‘Important’ and ‘Essential’ (‘details’ tab) and for each assurance level a summary (‘summary’ tab).

The controls are assessed through two angles:

The table below shows the different maturity levels and the definitions used to assess maturity from both perspectives:

3. Calculation method

A sub-category may consist of several controls and each of those controls shall be assessed for documentation and implementation according to the maturity table above. A value from 1 to 5 has to be entered per control in the "details" tab of the applicable assurance level. The tool calculates an arithmetic average for documentation and implementation per sub-category (e.g. ID.AM-1) to then calculate another arithmetic average for documentation and implementation per category (e.g. ID.AM).

These calculated values are visible in the ‘details’ tab of the applicable assurance level.

4. Summary report

The ‘summary’ tab for the respective CyberFundamentals assurance levels contains:

1. An overall maturity level (‘Total Maturity Level’) calculated as an arithmetic mean of the maturity levels of the categories.
2. A summary of the different maturity levels for each category using the respective values of the arithmetic averages of what was calculated in the ‘details’ tab.
3. A listing of the key measures to be met, the data for which is taken from the values entered in the ‘details’ tab.
4. A radar chart (spider chart ) is also displayed based on the data from the summary of categories.

Determining conformity with the Conformity Assessment Scheme (CAS)

The overview includes the target scores as determined for the specific assurance levels as described in the CAS. It is against these target scores that the values of the self-assessment are assessed.

When the values colour red one is not conforming to the required maturity level, green shows conformance.