Services
NIS2 gap assessment
Where do you stand against CyberFundamentals 2025, and what does the law or your customer ask for first?
For whom
Essential and important entities under the Belgian NIS2 law, and suppliers whose customers require a CyberFundamentals level.
Why now
- The Belgian NIS2 law (in force since 18 October 2024) has essential entities demonstrate conformity with CyberFundamentals (CyFun) or ISO 27001: a first step by 18 April 2026, the final deadline on 18 April 2027. For important entities the assessment is voluntary, but a well-documented level makes an inspection much simpler.
- Suppliers increasingly have the framework imposed by contract, even when they are not in scope of the law themselves.
- CyFun 2025 replaces CyFun 2023 and looks more closely at the supply chain. Version 2023 stays usable until 18 April 2027 and verifications under it stay valid until 18 April 2028; after that only CyFun 2025 counts.
What you get
- Completed CyberFundamentals self-assessment at the right level, drafted with you.
- Gap list per measure with the current state and the missing evidence.
- Prioritised roadmap to the conformity deadline, with effort estimates.
- Skeleton of the policy documents the framework expects.
- One-hour debrief.
Not included
- The verification or certification itself: that is done by an accredited conformity assessment body.
- Technical tests, scans or implementation of measures.
For municipalities, public welfare centres and intermunicipal companies
Local authorities are not in scope of the NIS2 law by default. That changes if you carry out an activity listed in the annexes of the law (such as drinking water, waste or a hospital) and are at least medium-sized, or if the CCB designates you. I establish that first, and you get the answer in writing.
Even without an obligation, CyberFundamentals is a sound framework to underpin your information security. The engagement stays under EUR 30,000 excl. VAT: a low-value contract, with a one-page offer (scope, price, delivery date) that is enough for an accepted invoice. Your own contract documents take precedence over my terms.
Frequently asked questions
- Is this eligible for the KMO-portefeuille?
- No. The Flemish KMO-portefeuille subsidy ends on 1 January 2027, and VDHome is not a registered provider, so an engagement with me does not qualify.
- We do not know whether NIS2 applies to us.
- Then the engagement starts with that question. If it does not apply, you get that in writing with the reasoning, and you pay only for that part.