CyFun, short for CyberFundamentals, is a cybersecurity framework originally developed by the Centre for Cybersecurity Belgium and adopted by DNSC as the technical methodology for NIS2 in Romania. The division of roles is simple: NIS2 says what must be achieved, and CyFun says how, through concrete security controls that you can implement and verify.
Why such a framework was needed
Without a common methodology, each entity would interpret differently what sufficient cybersecurity means, and auditors would have no unified reference. CyFun solves this: it provides a structured list of requirements, an objective maturity scale and a clear direction. This way, your self-assessment and the auditor's verification are measured against a standard reference framework.
How it is built
The controls are organized into six functions (Govern, Identify, Protect, Detect, Respond, Recover), grouped into categories and subcategories. Each control has a clear requirement, examples of evidence and guiding steps. Some controls are marked as essential (key), because they have a major impact on risk.
Levels and maturity
CyFun has three assurance levels (Basic, Important, Essential), cumulative: the higher level includes the requirements of the lower one. Separately, you assess your maturity on a scale from 1 to 5, both for documentation and for implementation. The compliance reference is reaching maturity level 3: processes that are defined, consistently applied and proven, not just written down in "compliance" documents.
Aligned with the standards you may already have
CyFun is mapped against internationally recognized standards: ISO/IEC 27001, IEC 62443 (for industrial/OT environments), NIST Cybersecurity Framework and CIS Controls. If you have already worked on any of them, a large part of the effort is reused, you do not start from scratch.
What you gain in practice
Instead of the question of whether you are all right with NIS2, you get a maturity score for each area and a concrete list of what you have to improve, prioritized by risk. It is the kind of answer you can actually work with and that you can show to the management and the auditor.