Organisations continue to face increasingly sophisticated threats — from supply chain compromises to complex attacks on critical infrastructure. In this landscape, CyberFundamentals 2025 by the Centre for Cybersecurity Belgium offers something rare: a practical, structured, and proportional framework that can be applied by both small companies and large enterprises. It focuses on clarity and actionable measures rather than abstract theory.
The framework builds on NIST CSF, ISO 27001/27002, IEC 62443, and CIS Controls, but its core value is specificity and applicability.
Six Core Functions: A Simple Map for a Complex Reality
CyberFundamentals is organised around six functions that create a common language between technical teams and business leadership:
-
Govern: Cybersecurity as a strategic priority — roles, policies, risk appetite.
-
Identify: Understanding systems, assets, people, data, and the threats around them.
-
Protect: Safeguards, configurations, access control, awareness, cryptography.
-
Detect: Monitoring environments, logging, spotting anomalous activity.
-
Respond: Coordinated incident response, communication, containment.
-
Recover: Restoring operations and strengthening resilience after incidents.
These functions aren’t theory — they help explain cyber risk to executives and embed security into operational decision-making.
Maturity Model: Small → Basic → Important → Essential
The framework provides a proportional assurance model, allowing organisations to scale security:
-
Small — entry level for micro-businesses.
-
Basic — required baseline for all organisations.
-
Important — strengthened measures against common threats and low-skilled attackers.
-
Essential — advanced measures for organisations facing sophisticated adversaries.
At the Essential level, additional governance requirements appear — clear accountability, stronger controls, better communication, and strategic oversight.
The Governance Layer: Key Elements Modern Organisations Cannot Ignore
The document invests heavily in governance. Below are the most important points for any organisation aiming to increase maturity.
1. Mission and context must drive cybersecurity decisions
The organisation must understand its mission, critical services, and dependencies — and base cyber risk management on them.
2. Stakeholder expectations matter
Employees, customers, regulators, partners — their cybersecurity expectations must be identified and integrated into the risk strategy.
3. Legal and regulatory requirements must stay current
Security processes must be updated as laws and regulations evolve.
4. Top management is responsible for cybersecurity
Executive accountability, clear ownership, a designated CISO, and a culture of continuous improvement are mandatory.
5. Policies must be living documents
They require regular review, senior approval, and must include cryptography and access requirements.
6. Cyber risk management must be integrated into ERM
Cyber risks must be recorded, analysed, approved, and reviewed as part of enterprise risk management.
7. Strong focus on supply chain security (C-SCRM)
This is one of the most developed parts of the framework and includes:
-
due diligence before onboarding vendors
-
contractual cybersecurity requirements
-
flaw remediation and patching obligations
-
audit rights
-
continuous supplier monitoring
It aligns closely with ISO 27036 and modern EU requirements (NIS2, CRA).
Why CyberFundamentals 2025 Is Worth Adopting
This framework strikes a balance between “big” standards and the need for business-friendly practicality.
Key advantages:
-
Clear structure for executives
-
Applicable without long implementation cycles
-
Concrete and measurable requirements
-
Useful for audits, self-assessment, and maturity building
-
Strong focus on supply chain risks — a top concern in 2025
Essentially, CyberFundamentals serves as a practical baseline for mature cybersecurity.
Conclusion
CyberFundamentals 2025 is not another heavyweight standard. It is a pragmatic methodology that helps organisations:
-
understand their risks,
-
build robust governance processes,
-
protect critical assets,
-
and prepare for modern cyber threats.
For any organisation seeking a clear, actionable, and scalable framework, CyberFundamentals is a strong candidate — either as a standalone foundation or as an addition to existing security programs.
