Choosing Scaldimet's baseline¶
The decision¶
Scaldimet has several drivers and limited time. You need one baseline that satisfies as many of them as possible, implemented once, evidenced once, and defensible to a regulator, a customer and your own board. This Lesson makes that choice and justifies it, so the rest of the Module operates a single, coherent socle rather than three competing ones.
Match the baseline to the drivers¶
Work through the drivers and see what a single baseline has to do.
The legal floor is NIS2, in both countries. So the baseline must, at minimum, demonstrably cover the NIS2 risk-management measures (Module 3.4 goes through them). Anything you choose has to map cleanly to NIS2, or you have not satisfied the law.
The Belgian authority offers CyFun, its CyberFundamentals framework. For this scenario, CyFun is a suitable primary baseline for Scaldimet. The CCB developed it as a recognised route to NIS2 conformity, and it draws on established references including NIST CSF, ISO 27001/27002, CIS Controls and IEC 62443. Its assurance levels also allow the organisation to select a proportionate level of controls.
The customer wants ISO 27001. This is the one driver CyFun alone does not satisfy, because the OEM wants the internationally recognised certificate, not a Belgian label. The good news is that the two are designed to be compatible: the Belgian authority accepts an ISO 27001 certificate as a route to a CyFun label, by mapping the ISO Statement of Applicability to the relevant CyFun level. So ISO 27001 and CyFun are not two programmes: they can be operated as one integrated control environment. CyFun provides the baseline and assurance structure; ISO 27001 provides the management system through which Scaldimet operates and continually improves that control environment.
The decision, then: adopt CyFun as the primary baseline (the socle), pursue ISO 27001 certification for the customer on top of that same baseline, and treat NIS2 as the legal floor both frameworks are mapped to. This gives Scaldimet one control environment that addresses the three drivers.
Choosing the level, by risk¶
CyFun is graded. Below its three assurance levels sits a "Small" starter for micro-organisations doing an initial self-assessment; the three real levels are Basic, Important and Essential, each adding controls for a higher class of threat. The Belgian authority calibrated them against real attack data, so the levels are explicitly tied to attacker capability: Basic addresses common, opportunistic attacks; Important adds protection against targeted attackers of ordinary skill; Essential addresses advanced, well-resourced adversaries.
This is where the choice is a risk decision. The level is chosen to match the organisation's exposure and its NIS2 classification. Scaldimet is a NIS2 Important entity (manufacturing, above the size thresholds, but not in the most critical tier). The matching CyFun level is Important: enough to resist targeted attackers of ordinary skill, which is the realistic threat to a car-parts supplier holding OEM design data, without the more demanding Essential level meant for critical infrastructure. Choosing too low leaves real risk uncovered; choosing too high wastes effort that would be better spent on the bespoke risk work in Module 4.
Scaldimet's baseline decision, written down
- Primary baseline (socle): CyFun, at the Important assurance level, matching Scaldimet's NIS2 Important-entity status.
- Customer requirement: ISO 27001 certification, built on the same controls and mapped to the CyFun label, so the OEM gets the certificate it asked for without a second programme.
- Legal floor: NIS2, in Belgium (overseen by the CCB) and France (overseen by ANSSI); the baseline is mapped to the NIS2 measures so the law is demonstrably met.
One socle. The work from here is to operate it, prove it, and audit it.
Application: justify the choice¶
On paper, write the one-paragraph justification you would give Scaldimet's board for this baseline. A sceptical director will ask three questions; answer all three in your paragraph: why this framework and not another? why this level? why not just do ISO 27001 alone? Write your paragraph before reading the model.
Model answer (open after you've drafted yours)
A defensible version: "We will adopt CyFun at the Important level as our baseline and pursue ISO 27001 certification using the same overall control environment. CyFun provides a Belgian baseline aligned with NIS2, while ISO 27001 addresses the customer's certification requirement. The Important level is proportionate to Scaldimet's exposure and NIS2 classification. This gives us one control environment rather than separate programmes."
Key takeaway
Choose one baseline that satisfies the most drivers with the least duplication. For Scaldimet that is CyFun at the Important level as the socle (the Belgian NIS2 path, assembled from established references, graded by risk), with ISO 27001 certification built on the same controls to give the OEM its certificate, and NIS2 as the legal floor both are mapped to. The assurance level is a risk decision: Important matches a manufacturer facing targeted attackers of ordinary skill, neither under-protecting nor over-spending. One socle, operated once, evidenced once, defensible to regulator, customer and board.