Skip to content

CyFun Foundations: Why Cyber Fundamentals Are the Backbone of Modern Compliance Automation

by Vivek Thomas, CEO on

As cybersecurity regulations evolve across Europe, organizations are being asked to demonstrate not just compliance, but structured, risk-based security maturity. Under the EU’s NIS2 Directive, essential and important entities must now evidence how cybersecurity risks are governed, implemented, monitored, and improved over time.

This shift has made one thing clear: modern compliance cannot exist without strong cyber fundamentals.

That is where Cyber Fundamentals (CyFun) plays a pivotal role not as a checkbox certification, but as a foundational framework that enables scalable, automated, and auditable compliance.

The Compliance Shift: From Point-in-Time Audits to Continuous Assurance

Traditional compliance models rely heavily on:

  • Periodic audits
  • Manual evidence collection
  • Spreadsheets and document repositories
  • Last-minute remediation

However, NIS2 and similar regulations demand continuous risk management, not snapshot compliance. Regulators are increasingly focused on:

  • How cybersecurity decisions are governed
  • Whether controls are consistently applied
  • How incidents are detected, responded to, and recovered from
  • Whether organizations can prove this on demand

This is where cyber fundamentals become the backbone of compliance automation.

What Is Cyber Fundamentals (CyFun)?

Cyber Fundamentals (CyFun) is a structured, risk-based cybersecurity framework originally developed in Belgium and now adopted by Ireland as a co-owner of the scheme.

CyFun is:

  • Voluntary and non-statutory
  • A recognised method to organise and evidence controls
  • Strongly recommended by the National Cyber Security Centre (NCSC) as a way to support NIS2 obligations

Importantly, CyFun does not automatically mean NIS2 compliance. Final compliance determinations remain with the relevant National Competent Authority (NCA). CyFun is best understood as a credible and structured way to demonstrate alignment with regulatory expectations.

CyFun and NIS2: How They Fit Together

Ireland’s NIS2 compliance framework will be established through the National Cyber Security Act and associated statutory instruments. These define what organizations must do.

CyFun supports this by defining how organizations can organise, implement, and evidence those requirements in a consistent, auditable manner.

The NCSC:

  • Recommends CyFun as a preferred method to demonstrate compliance
  • Aligns CyFun with published Risk Management Measures (RMM)
  • Recognises that CyFun is not the only route — ISO 27001, NIST, COBIT, and other frameworks remain valid

This flexibility ensures organizations can build on existing security programs while maintaining regulatory consistency.

A Risk-Based, Tiered Model for Cyber Maturity

One of CyFun’s strengths is its tiered maturity approach, which recognises that not all organizations face the same level of risk.

CyFun begins with an initial selection tool that assesses factors such as:

  • Organisation size
  • Sector and criticality
  • Risk exposure
  • Potential impact of a cyber incident

Based on this, organizations are assigned one of three levels:

  • Basic – Foundational cybersecurity controls
  • Important – Enhanced controls for higher-risk entities
  • Essential – Stringent controls for entities of high societal or economic importance

For important and essential entities under NIS2, CyFun provides a pathway to certification or formal assurance, supporting externally validated compliance.

Alignment with NIST CSF 2.0: A Global Foundation

CyFun is fundamentally based on the NIST Cybersecurity Framework, widely recognised as a global best practice.

  • Current CyFun versions are grounded in NIST CSF v1.1
  • A transition to NIST CSF v2.0 is underway, expected by Q3 2025
  • The NCSC is actively contributing to this update

Under NIST CSF v2.0, CyFun aligns with six core functions:

  • Govern – Establishing cybersecurity risk strategy, policy, and oversight
  • Identify – Understanding assets, risks, and vulnerabilities
  • Protect – Implementing safeguards to prevent incidents
  • Detect – Identifying cybersecurity events
  • Respond – Managing and mitigating incidents
  • Recover – Ensuring resilience and business continuity

This structure makes CyFun inherently suitable for automation, mapping directly to controls, workflows, and evidence systems.

Why CyFun Is the Backbone of Compliance Automation

Modern compliance automation platforms depend on clarity, structure, and traceability. CyFun provides all three.

By structuring cybersecurity around defined functions and maturity levels, CyFun enables organizations to:

  • Translate regulatory requirements into clear, actionable controls
  • Continuously collect and organise evidence
  • Maintain an always-ready audit posture
  • Support multiple compliance frameworks in parallel
  • Reduce reliance on manual, audit-driven processes

In short, CyFun turns cybersecurity from an abstract obligation into an operational system — which is exactly what automation requires.

Certification: Optional, but Strategically Valuable

Certification under Cyber Fundamentals will be optional, with Ireland’s national certification system expected to take 18–24 months to establish.

In the meantime, organizations are encouraged to:

  • Use CyFun internally
  • Align controls with the framework
  • Begin preparing for formal assurance

Even without certification, CyFun can:

  • Serve as a trust signal in supply chains
  • Support regulator engagement
  • Enable consistent internal governance

This makes CyFun both a compliance enabler and a business differentiator.

CyFun, RMM, and Regulatory Flexibility

The NCSC’s Risk Management Measures (RMM) define the minimum baseline for NIS2 compliance — the what.

CyFun provides a structured way to address the how.

Organizations may still choose:

  • ISO 27001 for information security
  • ISO 62443 for industrial control systems
  • Direct NCA assessments
  • Self-assessments for lower-risk entities

CyFun complements these approaches, offering a common language and structure that regulators increasingly recognise.

The Future of Compliance Is Built on Cyber Fundamentals

As regulations like NIS2 mature, organizations will be judged not just on whether controls exist, but on whether cybersecurity is governed, repeatable, and demonstrable.

Cyber Fundamentals (CyFun) provides the foundation for this future:

  • Risk-based
  • Standards-aligned
  • Automation-ready
  • Regulator-friendly

For organizations investing in compliance automation, CyFun is not an add on it is the backbone.

Related Articles