Insights

NIS2 became enforceable in Belgium in October 2024. Several months on, the CCB is already seeing a familiar pattern: organisations assumed they were compliant and are discovering they are not — tripping over the same three gaps, again and again.

If you are navigating NIS2 compliance as a Belgian SME, you have likely encountered two framework names: ISO 27001 and CyFun. Both are legitimate paths to demonstrating cybersecurity maturity — but they are not interchangeable.

"We're too small to be targeted" dramatically underestimates what dealing with a breach actually costs. Here are the real direct, regulatory, operational, and reputational numbers — and why prevention costs a fraction of recovery.