Frequently asked questions

No. Directive (EU) 2022/2555 binds member states, and the UK ceased to be one. UK operators fall under the NIS Regulations 2018, assessed via the NCSC Cyber Assessment Framework, with the Cyber Security and Resilience Bill before Parliament to replace them.

No. It is a self-assessment against the Article 21 measures with a citation on every control in the core questionnaire, plus an incident register that models the Article 23 clock. Compliance is determined by your national competent authority, not by a tool.

In Belgium a CyFun certification or label carries a legal presumption of NIS2 conformity, as does an ISO/IEC 27001 certification with the appropriate scope and Statement of Applicability — in either case only if its scope covers the whole organisation.

Source: Centre for Cybersecurity Belgium, NIS2 FAQ version 2.1.4, s. 4.9.

18 April 2026: Passed. The first step: a CyFun Basic or Important verification by an accredited and authorised conformity assessment body; on the ISO/IEC 27001 route, the scope, Statement of Applicability and latest internal audit sent to the CCB; on direct inspection by the CCB, a self-assessment or the ISO/IEC 27001 documents. 18 April 2027: CyFun route: Essential certification. ISO/IEC 27001 route: certification by an accredited and authorised conformity assessment body. Direct inspection: a report to the CCB on progress towards compliance. If 18 April 2027 cannot be met: The inspection service asks for a remediation plan by that same date: preferably a certificate at the Important level (on the ISO/IEC 27001 route, a certification with measures equivalent to it; on direct inspection, evidence of those measures), with the measures planned to reach the Essential level by 18 April 2028. 18 April 2028: The latest date the notice gives for reaching the Essential level under a remediation plan. For essential entities only: important entities have no mandatory regular conformity assessment. The FAQ sets these dates per the assurance level an entity's own risk analysis selects, and for an entity that comes into scope later they run from that date. The 11 August 2026 notice does not alter the legal obligations; it says what to do when a deadline cannot be met. Whether you are an essential entity is not something this panel works out.

Source: Centre for Cybersecurity Belgium, NIS2 FAQ version 2.1.4, sections 4.9 and 4.14 (incorporating the inspection service's notice of 11 August 2026).

In Belgium an entity may use a lower CyFun assurance level than its NIS2 category if it can justify that objectively on the basis of its own risk analysis; the justification is documented internally, the CCB's agreement is not needed, and the inspection service may question the choice at any time. It does not change whether the entity is essential or important. Among the examples the CCB gives of entities that may justify a lower level, such as Basic, are long-term care, special needs education, home nursing and outpatient healthcare providers.

Source: Centre for Cybersecurity Belgium, NIS2 FAQ version 2.1.4, sections 4.11, 4.12 and 1.22.5.3.

The CCB reads this as five services: operating oil production, refining, treatment, storage or transmission facilities. Oil storage has no minimum capacity, and means operating a storage facility as a service to a third party: an organisation that stores oil for itself, without that being its economic activity, is not covered. Franchised petrol stations fall under this type of entity, but will probably not exceed the size cap.

Source: Centre for Cybersecurity Belgium, NIS2 FAQ version 2.1.4, s. 1.22.2.2.

These can be healthcare providers, and if they meet the size criteria they are essential or important entities. They keep that qualification and still register, report significant incidents and apply cybersecurity measures, but may justify a lower CyFun assurance level (for example Basic) through their own risk assessment with the CyFun Selection Tool. That risk analysis is the organisation's responsibility, and the inspection service may review it.

Source: Centre for Cybersecurity Belgium, NIS2 FAQ version 2.1.4, s. 1.22.5.3.

An organisation must provide the NIS2 service itself to be in scope, so one that calls on third parties to provide the healthcare does not fall within scope as a healthcare provider.

Source: Centre for Cybersecurity Belgium, NIS2 FAQ version 2.1.4, s. 1.22.5.4.

No, and no software can. Certification comes from an accredited certification body after an audit. What you get here is a self-assessed view of where you stand, with Annex A references on every control in the core questionnaire.

Against the control statement, purpose and guidance that ISO/IEC 27002:2022 gives for each one, from a licensed copy — the same standard of check the regulations got against their own published texts. Six references were corrected by that reading. Until September 2026 they had been checked against the Annex A titles alone, which is a real check and a weaker one, and were labelled as such until the text was in hand.

No. The export is a data-preparation aid: 4 of the 15 templates as plain CSV, with the disclosure in row 1 of every file. It is not xBRL-CSV, is not validated against the EBA taxonomy, and cannot be filed with the Central Bank of Ireland or any other competent authority.

No. The incident register runs the Article 19 clocks and prepares the Annex I template from your own records, but the report goes from you to your competent authority, through the secure electronic channel that authority makes available (Implementing Regulation (EU) 2025/302, Art. 4(1)). DORA Art. 19(5) lets you outsource the reporting to a third party, and you remain fully responsible for it if you do.

DORA is lex specialis for ICT risk in the financial sector, so where both could apply to the same subject matter, DORA's requirements take precedence. That is a legal question for your own advisers, not something a tool decides.

As a structure, yes — it is the vocabulary many frameworks and vendors share, and CyFun is built from it directly. As a legal obligation, no.

2.0 only, read against NIST CSWP 29 and its own outcome text. Sixteen citations in this product were corrected during that read, including one that pointed at a 1.1 subcategory which does not exist in 2.0.

No. What Vivid Risk produces is a self-assessment against the framework with a citation on every scored control. A regulator or an NCSC-led assessment is a different exercise with a different standing.

v4.0, released 4 August 2025, read directly from the published document. All 41 contributing outcomes are held with their exact titles.

It maintains a register classifying every collection of your own data and can export or erase against it. Answering a request that arrives to YOU, within the Article 12(3) month, is yours to do.

Yes. They overlap on incident handling but have different triggers, recipients and clocks. Reporting a breach to your data protection authority does not discharge a NIS2 notification to your CSIRT, or the reverse.

No, and no software can. Certification is awarded by a Certification Body through IASME, and Cyber Essentials Plus adds a hands-on technical audit. What you get here is a view of which of your assessment answers speak to each of the five themes, and — more usefully — which of the scheme's requirements our questions cannot establish for you.

Because a theme shown as covered without that context would be misleading. Cyber Essentials sets hard numbers and our questionnaire asks posture-level questions, so the page separates two different gaps: requirements nothing here asks about at all, and requirements we ask about at a lower bar than the scheme sets. The first needs a new question from us; the second means our question cannot establish the requirement however you answer it, so go and check the setting yourself. Both counts are computed from the mapping, not written down.

No, and they serve different organisations. Cyber Essentials is a baseline certification with five technical controls, aimed at any organisation and mandatory for many UK government suppliers. The Cyber Assessment Framework is an outcome-based framework for operators of essential services under the NIS Regulations 2018, with 14 principles and 41 contributing outcomes. Vivid Risk cites CAF on every scored control; Cyber Essentials is the indicative view on this page.

No. Certification runs through a CCB-recognised conformity assessment body. Vivid Risk shows indicative coverage against the CCB's published requirement lists so you can see where you stand before you start.

Whichever you select. The panel offers Basic, Important and Essential and defaults to Basic; it does not infer a level from your headcount, your sector or your NIS2 entity class. Which level applies to an organisation is that organisation's own determination against its risk profile, and guessing it would be the sort of claim this product exists not to make.

The requirements are the CCB's, published and unambiguous. Which of your questionnaire answers speaks to each one is our mapping, and the CCB publishes no mapping to a third-party questionnaire for it to be checked against. So the requirement list is theirs and the join is ours, and the page says so.

No. It files nothing with ENISA, the Single Reporting Platform, any national CSIRT or any market surveillance authority. It is a private record of what you tell us you filed, and when. The button reads 'Record what I filed'.

Not for reporting. Products placed on the market before 11 December 2027 are generally exempt from the CRA's technical design requirements, but NCSC Ireland is explicit that they are not exempt from Article 14: if the product is available on the EU market today it is in scope whenever it was built. The obligation bites on newly discovered active exploitation — exploits you already knew about before 11 September 2026 do not have to be reported.

Yours. Where an actively exploited vulnerability or severe incident arises in an integrated third-party component, the manufacturer of the final product makes the notifications, once they become aware their specific product is impacted.

Not the part Vivid Risk covers. The CRA does require conformity assessment and CE marking for products with digital elements — and for important and critical product classes that assessment runs through a notified body, not a self-declaration. This product covers the Article 14 incident and vulnerability reporting duty only, which is a cybersecurity obligation. Conformity assessment needs a notified body or an accredited assessor, which we are not.

No. For each system it walks through the steps the Act sets out and shows what your answers indicate, with the article behind each step. The classification is your determination; you record it, with your reasoning.

No tool can. The workspace keeps your register, your determinations, the duties that follow and your records of meeting them, and counts which duties have a record behind them. Whether you comply is for the market surveillance authority.

No. It files, registers and notifies nothing with any authority, provider or person. It records what you sent, to whom and when.

It lets you record that role and lists a provider's duties with their citations. It does not do the provider workload — technical documentation, a quality management system or conformity assessment.

It can. The Act reaches a provider or deployer outside the EU where its AI system's output is used in the EU, and any provider placing a system on the EU market. The free scope check asks about both.