Organisations are actively preparing for increasing cybersecurity regulation, including the NIS2 Directive, many are looking for practical frameworks that improve cyber resilience without introducing unnecessary complexity.
Cyber Fundamentals (CyFun) is a risk-based cybersecurity framework designed to help organisations assess, improve and demonstrate their cybersecurity maturity. It aligns with recognised standards including the NIST Cybersecurity Framework (CSF) 2.0 and supports organisations preparing for legislation such as the NIS2 Directive.
At a recent cybersecurity conference, Gerard Joyce explored how CyFun is being adopted across Europe and why it is becoming an increasingly important option for organisations seeking a practical route to stronger cyber governance across both Information Technology (IT) and Operational Technology (OT).
Many cybersecurity frameworks are comprehensive but can be challenging to implement consistently.
Cyber Fundamentals was developed to provide organisations with:
The framework has already been formally adopted in several European countries, including Belgium, Ireland, Romania, Malta and Cyprus, with additional countries monitoring its development.
One of the key principles behind Cyber Fundamentals is proportionality.
Rather than applying identical requirements to every organisation, CyFun provides three assurance levels that reflect organisational size, complexity and risk.
Designed for smaller organisations or those facing lower levels of cyber risk. The Basic level focuses on implementing fundamental cybersecurity controls to defend against common threats.
Introduces stronger governance, security monitoring, logging, incident management and third-party risk management capabilities for organisations with greater operational exposure.
Designed for larger organisations and operators of critical services that require mature cybersecurity practices capable of addressing sophisticated threats.
This tiered approach allows organisations to improve cybersecurity at a pace appropriate to their risk profile while providing a clear roadmap for continual improvement.
Cyber Fundamentals follows the same six core functions that underpin the NIST Cybersecurity Framework 2.0.
These are:
Together these functions are supported by:
Importantly, the framework extends beyond traditional IT environments to include Operational Technology (OT), making it suitable for organisations managing industrial systems, manufacturing environments, utilities and other forms of critical infrastructure.
Cyber Fundamentals is designed to complement, rather than replace, established cybersecurity standards.
Organisations already working with frameworks such as the ones below, will recognise many of the same governance, risk management and security principles.
CyFun's strength lies in providing a practical implementation pathway that helps organisations improve cyber resilience while supporting regulatory compliance.
Yes.
Although the NIS2 Directive does not require organisations to adopt a single cybersecurity framework, it does require organisations to implement appropriate cybersecurity risk management measures, governance arrangements, incident reporting processes and supply chain security controls.
Cyber Fundamentals provides a structured approach that supports these objectives and offers organisations a practical route towards improving cyber maturity while preparing for NIS2 obligations.
Organisations considering Cyber Fundamentals should begin with governance before focusing on technical controls.
Recommended first steps include:
Organisations already using NIST CSF may also find the official implementation guidance and profiles useful when assessing their current and target cybersecurity posture.
Certification for Cyber Fundamentals is expected to become available in 2027. However, organisations do not need to wait for certification and can begin implementing the framework immediately through self-assessment and continuous improvement.
Cyber Fundamentals provides organisations with a practical, scalable approach to improving cybersecurity maturity while aligning with recognised international standards and emerging regulatory expectations.
By combining governance, risk management and technical controls into a structured framework covering both IT and Operational Technology environments, CyFun offers organisations a clear pathway towards stronger cyber resilience and future certification readiness.
Whether organisations are just beginning their cybersecurity journey or looking to strengthen existing programmes, Cyber Fundamentals provides a structured and proportionate approach that can evolve alongside business needs and the changing threat landscape.
Cyber Fundamentals (CyFun) is a risk-based cybersecurity framework that helps organisations improve cyber resilience through a structured set of governance, technical and operational controls. It is aligned with recognised standards, including NIST Cybersecurity Framework 2.0, and supports organisations preparing for regulatory requirements such as NIS2.
No. Cyber Fundamentals is a separate cybersecurity framework, but it is closely aligned with NIST Cybersecurity Framework 2.0. It adopts similar core functions while providing a practical implementation framework with defined assurance levels and detailed security controls.
Yes. Cyber Fundamentals has been designed to be proportionate to organisational size and risk. The Basic assurance level focuses on fundamental cybersecurity controls appropriate for smaller organisations or those with lower cyber risk, while larger organisations can progress to the Important and Essential assurance levels.
Yes. Unlike some cybersecurity frameworks that primarily focus on Information Technology, Cyber Fundamentals also includes Operational Technology. This makes it suitable for organisations that manage industrial systems, manufacturing environments or critical infrastructure.
While NIS2 does not mandate a specific cybersecurity framework, Cyber Fundamentals provides a structured approach to governance, risk management and security controls that can help organisations demonstrate good cybersecurity practices and prepare for NIS2 obligations.
The framework is built around six core functions, 22 categories, 106 sub-categories and 220 cybersecurity controls. These controls provide organisations with a comprehensive roadmap for improving cybersecurity maturity.
Certification is expected to become available in 2027. Organisations do not need to wait until certification is introduced and can begin by completing a self-assessment, identifying gaps and implementing improvements against the framework.
A good starting point is securing board or senior management commitment, appointing an executive sponsor, carrying out a maturity assessment and gap analysis, and working towards the Basic assurance level before progressing to more advanced levels.
For readers wishing to explore the standards and legislation referenced in this article:
Gerard Joyce is CTO at calQrisk and has more than 30 years' experience delivering governance, risk and compliance solutions. He works with organisations across financial services and other regulated industries to strengthen operational resilience, cybersecurity and regulatory compliance. Gerard regularly presents on topics including NIS2, DORA, cyber resilience and governance frameworks.
