Insights
Many organisations under NIS2 are unsure how to determine their CyFun assurance level and assume it simply follows from their qualification: an essential entity works at level Essential, an important entity at level Important. That assumption feels safe. It is often more expensive than it needs to be.
The qualification follows from the law: your sector, your size and, in some cases, a designation by the competent authority. It determines which obligations apply to you and how you are supervised. The assurance level, often simply called your CyFun level, answers a different question: how much assurance your security measures need to provide, given the risks you actually face.
The CCB allows an entity to work at a lower CyFun level than the one that matches its qualification, for example an essential entity at level Important, provided it can objectively justify that choice based on its risk analysis. The qualification itself does not change, and neither do the obligations that come with it.
The qualification, then, is the starting point. A documented risk analysis can show that a lower assurance level is appropriate, because it establishes what the organisation is actually exposed to. The levels are cumulative: each one includes everything in the level below it and builds on that.
I recently saw a public authority, qualified as an essential entity, work through the risk analysis for each NIS2 sector it operates in. It documented its reasoning and decided that assurance level Important was sufficient. A separate legal entity linked to the same authority went even further: its analysis showed that level Basic was enough.
That saves considerable time and resources. Level Basic has 34 requirements, level Important 133 and level Essential 218 (CyFun 2025). A lower assurance level means fewer CyFun requirements, and therefore less to implement, document, test and maintain. For a public authority, those savings matter even more, because in the end it is the citizen who pays.
There is a second saving. Only essential entities are subject to regular, mandatory conformity assessments; important entities are subject to ex-post supervision and can opt for a voluntary assessment. For an essential entity on the CyFun route, only assurance level Essential leads to certification. At level Basic or Important, its measures are verified instead by a conformity assessment body accredited by BELAC and authorised by the CCB. A verification also requires preparation and evidence, but it is less extensive than certification at level Essential.
The protection is no weaker than the risks require. The measures that remain are precisely the ones needed to bring those risks properly under control, and they reduce the risk to a sufficiently safe level. Where a specific risk calls for an additional measure, that measure is taken as well. Measures have to be proportionate to the risk they address.
A company is in exactly the same position. The money is its own rather than the taxpayer’s, but the reasoning does not change. Measures the risks do not call for cost time and budget that could have gone elsewhere.
The analysis shows which level is needed. What the organisation does with that result is a decision, and that decision belongs to the board. It can accept the lower level the analysis supports, or keep the level that matches its qualification by default.
Keeping the higher level is allowed, and it can feel like the cautious option. But if the analysis was done properly and the justification is sound, you are spending more than you need to cover the risks properly. That is a decision too, and it should be made deliberately, not by default.
Under NIS2, the management body, in most organisations the board, has a legal duty to approve the organisation’s cybersecurity risk-management measures and to oversee their implementation. The assurance level sets the baseline for those measures, supplemented where the risk analysis calls for more. So put the choice to the board, together with the analysis behind it.
The CCB does not approve the choice in advance. The justification has to be documented internally, and the inspection service can question it at any time. That is not a reason to avoid a lower level, but precisely the reason to do the analysis properly.
A properly conducted and documented risk analysis is the basis for a choice you can defend. If someone who knows what to look for can pick it apart without much effort, the homework was not thorough enough. The analysis has to rest on facts and figures, not on a feeling that the impact will probably be limited.
Done that way, the analysis does more than reduce the workload. Should anything ever go wrong, there is a clear, well-argued record of why the decision was taken.
If your organisation falls within the scope of NIS2, ask yourself two questions this week. Is our assurance level backed by a risk analysis that an outsider could check for themselves? And has the board formally considered both the choice and the analysis behind it?
If the answer to the first question is no, the level you work at is an assumption, not a decision. If the answer to the second is no, the board is responsible for a choice it never made, even though the law requires it to approve the measures that follow from that choice. Putting that right calls for a deliberate decision and a sound justification. Recording the decision in the minutes is not a legal requirement, but it is good practice. That way, should anything ever happen, you can show the supervisor a choice that is justified and documented.
Your assurance level does not follow automatically from your qualification: it is a considered decision that you can explain with confidence if the supervisor challenges it. It can also save you a great deal, without making your protection weaker than your risks require.