CyFun and the self-assessment spreadsheet: where the 218 controls in DNSC Order no. 1/2026 come from

„CyFun excel” is a very concrete search: people want the file. It is worth clarifying up front what you are downloading, from where, and above all how the Belgian file relates to the obligation in Romania. Because they are not the same thing, even though they look strikingly alike.

What CyFun is

The CyberFundamentals Framework, CyFun for short, was developed by the Centre for Cybersecurity Belgium, which is also the primary scheme owner. Its requirements and guidance are built on the NIST Cybersecurity Framework, ISO/IEC 27001 and 27002, IEC 62443 and the CIS Critical Security Controls. The CyFun 2025 version was explicitly aligned to NIST CSF 2.0 and to European legislation, adding governance measures, supply chain and operational technology.

It has three assurance levels, Basic, Important and Essential, plus a separate questionnaire for the „small” level aimed at micro organisations. The accurate phrasing is not „CyFun has four levels”, but three assurance levels and one additional questionnaire.

The spreadsheet, and what it contains

The self-assessment tools are downloaded from the official scheme site, cyfun.eu. There are three separate files, one per level, each with a filter that shows only the requirements of the chosen level, so scores never have to be transferred between files.

The scoring logic is what matters most:

• each control is scored on two dimensions, policy maturity and implementation maturity;
• the scale runs from 1 to 5;
• scores aggregate as averages, from subcategory to category and then to the total;
• a summary tab shows the total level, the category overview, the list of key measures and a radar chart;
• conformity is established by comparison with the thresholds of the conformity assessment scheme, marked visually.

The same page carries the framework booklets, the key measures overview and, useful if you work across frameworks, a mapping file from CyFun 2025 to NIS2 and to other standards.

Why it looks familiar if you have read DNSC Order no. 1/2026

The national catalogue of measures approved by Order of the DNSC director no. 1/2026 has the same architecture:

Element	CyFun 2025	DNSC Order no. 1/2026
Functions	Govern, Identify, Protect, Detect, Respond, Recover	the same six, in Romanian
Hierarchy	Function, Category, Subcategory, Control	identical
Coding	of the form GV.OC-01.1	identical
Scoring	documentation and implementation, 1 to 5	documentation and implementation, 1 to 5
Levels	Basic, Important, Essential	Bază, Important, Esențial

The figures in the Romanian catalogue, counted from the applicability table of the order: 218 controls in total, of which 34 at Basic level, 133 at Important level and all 218 at Essential level, with 29 key measures and 15 controls flagged as management aspects. The levels are inclusive: Important contains everything in Basic, Essential contains everything.

The lineage is no coincidence. Romania formally adopted the CyFun framework and appears, on the official scheme site, in its scheme owner group alongside Belgium, Ireland, Malta and Cyprus. The implementation guidance in the order cites CyFun explicitly among the reference frameworks.

Careful: the Belgian file does not replace the DNSC tool

This is the part the „cyfun excel” search misses. The Romanian obligation, set out in art. 12 para. (4) of GEO no. 155/2024, is to submit annually to DNSC a maturity self-assessment endorsed by management. The mechanisms DNSC provides are the NIS2@RO platform and its own tools, officially named EVAL_MMS_B for Basic, EVAL_MMS_I for Important and EVAL_MMS_E for Essential, downloadable from the DNSC site when the platform is unavailable.

A self-assessment completed in the Belgian file is not a self-assessment submitted to DNSC. The thresholds differ too: the Romanian methodology requires a minimum of 2.5 on each key measure and 2.5 overall at Basic level, 3 and 3 at Important, and at Essential a minimum of 3 on each key measure, 3 on each category and an overall score of at least 3.5.

What the CyFun file is still good for

• Preparation. If you want to understand the scoring logic before entering the platform, the Belgian file explains it thoroughly, with guidance on every control.
• Mapping. The CyFun to NIS2 and ISO 27001 mapping file helps if you already run a management system and want to see what it covers and what it does not.
• International groups. A Belgian subsidiary and a Romanian one can speak the same technical language, even while reporting to different authorities.
• Internal training. It is a good instrument for teaching a team the difference between „we have a policy” and „the policy is applied and reviewed”.

A calendar detail if you work with Belgian partners: CyFun 2023 and 2025 coexist until 18 April 2027, and attestations issued on the 2023 version remain valid until 18 April 2028 at the latest.

The most expensive scoring mistake

Both models ask for two scores, not one. Organisations with good documentation and weak implementation often score the documentation and assume it covers implementation too. The result shows up directly in the category average and, at Essential level, can block the threshold of 3 per category even when the overall score looks acceptable.

The practical rule: the implementation score is given on evidence, not intent. If you cannot show a record, a log, an artefact or a report, the score does not go above 2.

Where we can help

A sound self-assessment starts from the correct assurance level. If you do not yet know where you sit, the CysNis platform walks through the criteria step by step. If you have the level and want scores that survive scrutiny, a NIS2 compliance analysis with a remediation plan is done on evidence, control by control. ProDefence is a cyber security auditor accredited by DNSC.

If the role of responsible officer is unstaffed, it can be covered through an outsourced NIS2 officer.

Sources

• CyberFundamentals Framework 2025, the self-assessment tools and materials, Centre for Cybersecurity Belgium.
• About CyFun and the FAQ, including the status of the framework in other states.
• Order of the DNSC director no. 1/2026, with the Measures and the self-assessment Methodology, Official Gazette no. 712 of 27 August 2026.
• GEO no. 155/2024, art. 12 para. (4).

This material is informative and does not constitute legal advice. The control counts were tallied from the applicability table of Order no. 1/2026. Tools and addresses may change.

Frequently asked questions