In Romania, CyFun uses three assurance levels: Basic, Important and Essential. The level determines how many controls you have to implement and how rigorously. The levels are cumulative: Essential includes everything Important requires, which includes everything Basic requires. The higher you go, the more additional controls you add and the greater the degree of compliance.
What each level means
Basic covers fundamental cyber hygiene, suitable for organizations with lower risk. Important adds a broader set of controls, expected of most entities in the field. Essential is the most comprehensive, required of organizations whose disruption would have major effects on society or the economy, those that ensure the critical service.
How the classification results
There is no classification at random or by preference. The starting point is the entity classification (essential or important), and the classification is formally confirmed both through the criteria of sector, size and turnover, and through the risk assessment, according to the DNSC methodology and the impact on the critical service. In practice, an important entity usually tends towards the Important level, and an essential one towards the Essential level, but the risk assessment, and the associated impact, can determine the classification when the exposure requires it.
The maturity level: value 3 as the reference
In addition to the general maturity level, each control is assessed on a maturity scale from 1 to 5: from non-existent or ad-hoc (1-2), to defined and consistently applied (3), up to managed with metrics and continuously optimized (4-5). The compliance reference is maturity 3, assessed separately for documentation and for implementation. In practical terms: it is not enough to have a written procedure, you must also apply it consistently and be able to prove it.
What it means for your effort
The level and the maturity reference tell you, together, where you stand, what you need and how much work you have ahead. A higher level means more controls and more solid evidence, but also a stronger trust indicator for clients and partners. The important thing is not to "overinvest" (beyond what is required of you), but neither to miss key controls.
Our free assessment gives you an initial orientation on the maturity level, while the formal one you confirm through the risk assessment.