CyFun 2025, measure by measure, and the record Opafra writes for each.

When a client asks whether you apply the CyFun measures, or has its own measures verified and asks you for the evidence, part of the answer is a record Opafra already wrote. Below are 20 measures from CyFun 2025 that touch access, logging, backups, vulnerabilities and suppliers, by ID and in our own words. Five of them are CCB key measures. The measures Opafra does not answer are listed too.

Who it applies to

Suppliers to entities that apply CyFun.

CyFun is the framework of the Centre for Cybersecurity Belgium that Belgian entities under the NIS2 law are steered towards, and buyers are told to ask their suppliers for CyFun evidence. We read the measures in the CyFun 2025 booklet (level Important) in September 2026. The CCB allows extracts only for non-commercial use, so the measures are given by ID and in our own words.

The score

An average of documentation and implementation, per key measure.

The score per key measure is the average of the documentation score and the implementation score, as the formulas of the CCB's tool compute it. Evidence of implementation therefore counts. Basic needs 2.5 out of 5 in total and per key measure, Important 3 out of 5, and Essential 3.5 in total, with 3 per category and per key measure.

A first verification is always full: every key measure is checked on site. The CCB imposes no format for the evidence, but it must enable the assessment of the effective implementation, and the assessor does not search for it.

Yes, from the record

A record answers 5 measures. For work that goes through Opafra.

The answer is a record Opafra writes, for work that goes through Opafra.

5 yes, 9 partly, 6 no

DE.CM-06.1: external service providers: Are the activities and services of external service providers protected and watched, so that adverse events are noticed? The access record is what a client holds of its MSP: who reached which server, on whose approval, for how long and under which run. Watching events outside it is not covered.
PR.AA-03.2 (key measure): multi-factor authentication for remote access: Is multi-factor authentication required for remote access to the organization's networks? Signing in to Opafra uses multi-factor authentication, and SSH access uses per-person certificates that last five minutes.
PR.DS-11.2: testing backups (2023: PR.IP-4.2): Are the reliability and integrity of backups verified and tested regularly? The restore test records the result and the time the restore took on each run. It does not show that backups are made, or how recent they are.
ID.AM-08.11: remote maintenance (2023: PR.MA-2.1): Is remote maintenance approved beforehand and its performance logged? The record shows the request, the approver, the window and every connection under it. The session itself is not recorded.
PR.PS-06.2: testing changes (2023: PR.IP-3.1): Are changes and exceptions tested and validated before they reach operational systems? The dry run per host is that test beforehand. The approval, bound to the revision that runs, is what Opafra adds.

Partly

The record answers 9 measures in part. The rest sits elsewhere.

The record is a part of the answer. The rest is a policy, a document or a system that Opafra does not see.

GV.SC-02.1: staff changes at service providers: Do external service providers report every transfer, termination or move of staff with physical or logical access to business-critical system elements? The role change log shows changes inside Opafra. Telling the client is a process.
PR.AA-01.1: identities and credentials: Are identities and credentials managed? Every run and connection is tied to a named person, and the SSH certificates come from the organization's own authority. Your organization's directory is outside it.
PR.AA-03.3 (key measure): restricting and authorising remote access: Are usage restrictions, connection requirements and authorisation procedures for remote access set down in documentation? The access record is the evidence that the procedure was followed. The documentation itself is not Opafra's.
PR.AA-05.1: managing and reviewing access rights: Are access permissions and authorisations defined, managed, enforced and reviewed? The access review shows everyone with access to an environment, the decision for each person, the reviewer, the date and the changes. Accounts on your servers you review where they live.
PR.AA-05.3: least privilege: Does the principle of least privilege apply? Roles and grants with an end time exist in Opafra. That the principle is applied is a policy statement.
PR.AA-05.4 (key measure): no admin rights for routine tasks: Does no one hold administrative privileges for routine day-to-day tasks? Access per approval, with a window or a five-minute certificate, supports this. It covers only access that goes through Opafra.
PR.AA-05.6: separation of duties: Is separation of duties ensured in the management of access rights? The requester and the approver are both recorded, and an access request cannot be approved by the person who made it. Self-approval of runs can be blocked, and the record marks every run for which it was allowed. Separation of duties outside Opafra is your policy.
PR.PS-04.1: keeping logs: Are logs maintained, documented and watched? Runs, approvals, grants, sign-ins, role changes and exports are in the audit log, with who, what and when. Watching happens in your SIEM, which can fetch the log through the API.
ID.RA-08.1 (key measure): vulnerability management: Is there a plan for vulnerability management? Patch runs and their deadlines are recorded, with the reason a patch was skipped. Opafra does not scan for vulnerabilities, and the plan itself is your document.

No, not from Opafra

Opafra does not answer 6 measures. They are listed too.

These are the measures where the honest answer is no, or where the answer is a document and not a record.

GV.SC-05.1: supplier agreements: Are agreements with suppliers set down in contracts? No. This sits with the client and is a matter of policy.
GV.SC-07.1: assessing suppliers: Are suppliers assessed for risk at least every year, and again when something changes? No. This too sits with the client: an assessment is a document and not a record Opafra writes.
GV.SC-08.1: suppliers in incident planning: Are suppliers involved in planning for incidents? No. This is policy on the client's side and not a record Opafra writes.
PR.DS-11.1 (key measure): backups on another system: Are backups held on another system? No. Opafra does not record where backups are kept.
PR.PS-01.1: baseline configuration: Is there a baseline configuration? No. A baseline configuration is a document or a standard for your servers, and Opafra does not answer it from the record.
PR.PS-04.2: time source for logs: Is a reliable time source used for log entries? Not stated yet. The time source for log entries is not published, so this is not answered from the record.

What this is and is not

Evidence for a measure, not a verdict.

A yes or a partly applies to work that goes through Opafra. It does not say that an organization reaches a level: the score is the assessor's, and Opafra is not a CyFun verification, a label or a certification.

Answer the CyFun questions with records.

Name the framework your clients use. You get a demo and your price in writing within one business day, with no call.

Get a demo