CyFun in depth (CCB, NIS2 levels, IEC 62443 / OT)¶
From framework structure to baseline¶
NIST CSF gives Scaldimet a structure but stops at outcomes; it does not tell you when an outcome is actually achieved. CyFun, Scaldimet's chosen baseline, is what fills that gap. This Lesson goes deep enough on it to operate it, including the part that matters most for Scaldimet: how it handles operational technology.
What CyFun is¶
CyFun, the CyberFundamentals Framework, was built by the Centre for Cybersecurity Belgium (CCB), the national cybersecurity authority. It uses the NIST CSF structure and adds guidance from established references: ISO/IEC 27001 and 27002, the CIS Controls, and, importantly for a manufacturer, IEC 62443 for operational technology. Two design choices make it practical.
First, CyFun turns each CSF outcome into a control with three parts: the outcome itself, guidance on how to achieve it, and a requirement that defines when it is done. CSF tells you "devices should be inventoried"; CyFun tells you what an acceptable inventory looks like, so the control becomes measurable. That "definition of done" is what lets you later test and audit it (Chapter 3.6).
Second, CyFun is graded by assurance level, calibrated by the CCB against real Belgian attack data:
| Level | For whom | Addresses |
|---|---|---|
| Small | Micro-organisations doing an initial self-check | A short starter set, not a full level |
| Basic | Any enterprise | Common, opportunistic attacks |
| Important | Higher-risk organisations | Targeted attackers of ordinary skill |
| Essential | Critical entities | Advanced, well-resourced adversaries |
The levels map onto NIS2 classification, which is why the level is a risk choice (Lesson 3.1.B): Scaldimet, a NIS2 Important entity, implements CyFun Important. Because the levels are derived from real attacks, each control carries an implicit risk rationale: it is there because the absence of it is what attackers actually exploited.
CyFun also connects to the rest of Scaldimet's baseline. The CCB accepts an ISO 27001 certificate as a route to a CyFun label, by mapping the ISO Statement of Applicability to the relevant CyFun level. So Scaldimet's single socle serves the framework, the law and the customer at once, exactly as Chapter 3.1 planned.
The operational-technology problem, and IEC 62443¶
Scaldimet's hardest controls are not in the office; they are on Site Beta's production floor, and ordinary IT controls do not fit there. CyFun anticipates this by drawing OT guidance from IEC 62443, which is worth understanding at a conceptual level.
Technical explainer (read & discuss, don't build): IEC 62443 for OT
IEC 62443 is the international standard series for the security of industrial automation and control systems: the SCADA, PLCs and controllers that run a production line. OT has different priorities from IT. Availability and safety come first, systems may run for decades on unsupported software, and a reboot can stop or damage a line.
Three ideas matter for Scaldimet. Zones and conduits divide the plant into security zones and control the connections between them. This is the basis for segmenting Beta's flat network. Security levels (SL 1 to 4) define how strong protection needs to be against increasingly capable attackers. Foundational requirements cover areas such as identification and access control, use control and restricted data flow, expressed for industrial environments.
You are not expected to engineer a 62443 architecture. You are expected to understand why Beta's OT controls need OT-specific guidance rather than simply copying Alpha's IT controls.
The risk rationale is direct: the single most important control for Beta, segmenting the OT network so a compromise of the office cannot reach the presses, is a zones-and-conduits idea from IEC 62443, incorporated into CyFun. Teaching it any other way would either ignore the OT reality or disrupt production.
Application: two functions, two OT considerations¶
On paper, pick two CyFun functions. For each, name one control Scaldimet needs, and describe one way that control lands differently on Beta's OT than the same control on Alpha's IT. Do your own two before reading the model.
Model answer (open after you've drafted yours)
Worked examples, for Protect and Detect: for Protect, a segmentation control, on Alpha it is routine network design; on Beta it is a zones-and-conduits exercise (the IEC 62443 idea) around controllers that cannot be taken offline to reconfigure. For Detect, monitoring access, on Alpha you watch user logins; on Beta you watch the contractor's remote sessions into the OT, and adding a monitoring agent to a fragile controller may itself be risky, so it is done with the operational owner, not imposed on them. If your two examples show the same control behaving differently on IT and OT, you have the point: OT puts availability and safety first, which is why CyFun reaches into IEC 62443 rather than copying office-IT controls.
Key takeaway
CyFun, the CCB's CyberFundamentals Framework, takes the NIST CSF backbone and adds a measurable definition of done to each control, drawing on ISO 27001/27002, CIS and IEC 62443. Its Basic, Important and Essential assurance levels are calibrated to attacker capability, so choosing a level (Important, for Scaldimet) is a risk decision, and each control carries an implicit risk rationale. For Scaldimet's operational technology, the controls come from IEC 62443 ideas (zones and conduits, security levels), not from copying office-IT controls, because OT puts availability and safety first.