CyFun · CyberFundamentals

How CyFun assessment works

The route depends on the assurance level. The organization prepares its self-assessment; an independent conformity assessment body evaluates the evidence. The self-assessment guides the work but does not prove conformity on its own.

The Essential certification process

1. Define the scope and prepare

   Identify the systems, services, locations and activities covered. Complete the applicable CyFun self-assessment and gather evidence supporting each declared maturity score.

2. Stage 1 — assess readiness

   The auditor checks the consistency and support for your scores, documented management controls and available evidence. Findings determine readiness, priorities and the Stage 2 audit plan.

3. Stage 2 — test implementation

   The auditor evaluates how measures operate in practice, including key measures and management controls. Records, interviews and operational evidence must support the self-assessment; policies alone are not enough.

4. Address findings and obtain a decision

   Required maturity thresholds must be met. Major nonconformities must be resolved and closed; action plans for minor nonconformities must be accepted, or the findings closed, before a positive certification decision. A sufficient score alone does not secure certification.

5. Maintain certification

   Keep the self-assessment current. Surveillance reviews changes, maturity, key measures and all specified management controls, together with certificate and mark use. Surveillance takes place at the client’s premises. Recertification reviews continued effectiveness and improvement and includes an on-site audit.

What evidence should you prepare?

Prepare records that show both how controls are defined and how they operate. Examples include:

• A dated, version-controlled self-assessment with supporting evidence for the claimed maturity scores.
• Scope, asset and service information, risk assessments, approved policies, objectives and assigned responsibilities.
• Internal audit results, management reviews, corrective actions and evidence of continual improvement.
• Operational records such as access reviews, incident handling, tested continuity and recovery plans, and supplier risk management.

ISO 27001 now. A defined route toward CyFun.

Complade’s SCC-accredited ISO/IEC 27001 certification audits are available now for international applicants. An implemented ISMS can provide relevant governance, risk, internal audit and management review evidence for a later CyFun assessment. The applicable CyFun measures and maturity requirements still need to be addressed.

The Belgian scheme also provides a route based on an accredited ISO/IEC 27001 certificate, with a suitable scope and Statement of Applicability. Eligibility and acceptance are determined by the CCB under the applicable rules. An ISO certificate does not automatically issue a CyFun certificate or label, and Complade’s ISO 27001 accreditation does not itself authorize CyFun assessment.

Certification and the Belgian label are separate

After the relevant conformity assessment, eligible organizations apply to the CCB through Safeonweb@work for the CyFun label. The CCB reviews eligibility and issues the label and associated QR code. Complade does not issue the CCB label.

Complade’s certification offering