Loading story…
Belgium’s Centre for Cybersecurity Belgium (CCB) issued a communication clarifying how NIS2 essential entities must demonstrate required cybersecurity measures under the national framework tied to the CyberFundamentals Framework (CyFun). The notice says that by 18 April 2027, organizations that cannot show implementation of controls equivalent to the CyFun assurance level Essential must submit a remediation plan, while entities already able to demonstrate that level—or able to justify a lower level through risk analysis—will not need to do so.
The remediation plan must show compliance equivalent to CyFun assurance level Important and explain how the organization will reach the Essential level by 18 April 2028. The CCB said the communication applies across all three conformity-assessment routes: CyFun certification by an authorized conformity assessment body, ISO/IEC 27001 certification by an authorized body, and conformity assessment by the CCB inspection service. Officials also stressed that the notice does not alter the legal obligations or deadlines established by Belgium’s NIS2 law and its Royal Decree.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Belgium's Centre for Cybersecurity issued a communication explaining that NIS2 essential entities unable to demonstrate cybersecurity measures equivalent to CyberFundamentals assurance level "Essential" by 18 April 2027 will be required to submit a remediation plan. The notice says this approach applies across CyFun certification, ISO/IEC 27001 certification, and CCB inspection-service conformity assessments, and does not change existing legal obligations or deadlines under the Belgian NIS2 Law and Royal Decree.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The NIS2 Directive has introduced new, binding cybersecurity requirements for organizations across the European Union, emphasizing that cybersecurity is a core business risk requiring executive-level oversight. The directive mandates enhanced risk management, supply chain security, incident response, and reporting measures, as well as increased management accountability. In Spain, NIS2 became binding in January, prompting organizations to adopt modern security technologies and integrate comprehensive strategies to protect sensitive data and ensure regulatory compliance. Industry leaders highlight the need for systematic approaches to compliance and stress that IT risks must be managed as business risks under the new regulatory landscape.
Jun 29, 2026
European organizations are facing significant challenges in implementing the NIS2 Directive, with many CISOs reporting that compliance efforts are being hampered by excessive documentation requirements and unclear regulatory expectations. The process often results in a heavy administrative burden, where compliance is measured by the ability to produce extensive paperwork rather than demonstrable improvements in actual security posture. This disconnect between regulatory intent and practical outcomes has led to concerns that the focus on documentation may not translate into meaningful risk reduction. A recent study highlights that NIS2 is projected to reach around 70% adoption by the end of 2025, which is lower than other frameworks such as HIPAA and GDPR but higher than PCI DSS. The study attributes this to the stronger enforcement mechanisms of NIS2, which, like GDPR and HIPAA, relies on public authorities for oversight and sanctions, as opposed to the contractual enforcement model of PCI DSS. The comparison underscores the importance of independent regulatory oversight in driving compliance and suggests that while NIS2's adoption is progressing, the effectiveness of its implementation remains a concern due to the administrative complexities involved.
Jun 29, 2026
The European Commission has referred **France, Ireland, Spain and the Netherlands** to the Court of Justice of the European Union for failing to transpose the `NIS2` Directive into national law more than 20 months after the deadline. Brussels is seeking both lump-sum and daily financial penalties until each country formally notifies full implementation of the cybersecurity law, which expands security and incident-reporting obligations across **18 critical sectors** and sits at the center of the EU’s wider cyber regulatory framework. In France, the enforcement action follows another delay in parliamentary review of the national transposition bill, with examination now expected in September rather than July despite the measure being treated as a government priority. The French debate has also been complicated by a disputed provision, **article 16 bis**, which would protect end-to-end encryption and has drawn criticism from the parliamentary intelligence delegation over concerns it could restrict access to protected data, while **ANSSI** continues operational preparations through preregistration work and a new agreement with the Banque de France and the **ACPR**.
Jul 9, 2026