For organisations qualifying as ‘essential entities’ under NIS2, 18 April 2027 is an important deadline: the date by which essential entities are expected to demonstrate compliance with the applicable NIS2 cyber security requirements, whether through CyFun® certification, ISO/IEC 27001 certification with equivalent measures, or a Centre for Cyber security Belgium (CCB) inspection.
However, the CCB recognises the challenges and competing priorities essential entities face in an increasingly dynamic technological threat landscape.
26 / 08 / 26
The CCB’s Inspection Service has now published a communication that provides pragmatic guidance on the steps essential entities should take if it will not be able to demonstrate the required level of conformity in time. It highlights that these actions do not extend the deadline or change the obligations.
The CCB’s communication sets out a remediation approach for essential entities using each of the three conformity assessment routes: CyFun® certification, ISO/IEC 27001 certification or CCB inspection.
Any essential entity that cannot demonstrate the required ‘Essential’ level by 18 April 2027 is asked to provide a remediation plan that preferably demonstrates compliance with the CyFun ‘Important’ level or an equivalent level of assurance, and describes the measures that will be taken to reach the ‘Essential’ level by 18 April 2028.
We encourage Beltug members that qualify as NIS2 essential entities to assess their readiness for the April 2027 deadline and review the CCB communication here.