The technical framework for NIS2, in Romania
CyFun, or CyberFundamentals, is the technical methodology that DNSC adopted from the Belgian authority and uses to provide the implementation framework for NIS2. While the NIS2 law sets out the obligations, CyFun translates them into concrete controls, aligned with standards such as ISO 27001, IEC 62443, NIST CSF or CIS Controls, thereby providing the reference framework for NIS2 compliance.
The six functions
Govern
Roles, policies, risk and supply chain management.
Identify
Assets, data, suppliers, vulnerabilities and risks.
Protect
Access, multi-factor authentication, encryption, training, backups.
Detect
Security monitoring and alerting.
Respond
Incident response plan and reporting to DNSC.
Recover
Continuity and recovery objectives.
Three levels, one clear direction
Basic
The essential set of controls, for basic requirements.
Important
An extended set of controls, for important entities.
Essential
Full coverage, for essential entities.
The required compliance level is set both on the basis of the entity's classification criteria and through the risk assessment process. The maturity level for NIS2 compliance is 3 on a scale from 1 to 5, assessed separately against documentation and implementation criteria.