meta_id 3416760

On August 18, 2026, Belgium's Federal Cyber Emergency Team (CCB) issued a press release regarding its general communication and information request to Belgian Network and Information Systems Directive 2 (NIS2) essential entities regarding their mandatory conformity assessment obligations dated August 11,2026. The CCB is the national authority for cybersecurity and operates as the national Computer Security Incident Response Team (CERT) for Belgium. The communication addresses compliance requirements under the Network and Information Systems Directive 2 and establishes a structured approach for entities unable to meet initial compliance deadlines: By April 18, 2027, NIS2 essential entities must demonstrate implementation of cybersecurity measures equivalent to the CyberFundamentals Framework (CyFun®) assurance level "Essential". Entities unable to achieve this compliance level must submit a remediation plan to the CCB's Inspection Service. The remediation plan must include evidence of compliance with NIS2 cybersecurity measures equivalent to CyFun® assurance level "Important" and a description of measures planned to achieve "Essential" level compliance by April 18, 2028. The CCB's approach applies across three conformity-assessment routes: CyFun® certification by an authorised Conformity Assessment Body (CAB); ISO/IEC 27001 certification by an authorised CAB; and conformity assessment by the CCB's inspection service. Entities demonstrating full compliance with "Essential" level requirements by April 18, 2027, or justifying lower assurance levels through risk analysis are not required to submit a remediation plan. The CCB emphasised that this communication does not alter the legal obligations or deadlines established by the Belgian NIS2 Law and its Royal Decree. The official communication, containing detailed requirements applicable to each assessment route, has been sent directly to all essential entities.