Read-only
The audit observes, it never modifies your systems.
NIS2In force since 18 October 2024 in Belgium
Understanding NIS2 compliance and the CyFun framework, without jargon.
Audit, gap analysis, alignment with CyFun (CCB): here's how it works, and the self-assessment tool I wrote, with public source code.
An educational approach
I reply personally
One point of contact: me
Oct182024
NIS2 is already in force
Since 18 October 2024: it is no longer a deadline, it is an obligation.
Every month counts. Understanding the expected level early means reducing the risk of a penalty.
Quick check
NIS2: does it apply to you?
3 questions, 2 minutes, no email. Instant on-screen result.
Question 1 / 3
NIS2, in plain terms
What the directive changes for you, without jargon
NIS2 raises the level of cybersecurity required of thousands of organisations. Three questions to find out where you stand. The CyberFundamentals Framework (CyFun), from the Centre for Cybersecurity Belgium (CCB), is the recognised way to demonstrate your NIS2 compliance.
My self-assessment tool
ClawkWerk: a CyFun audit tool with public source code, secure by design
My audit engine, written in Go and aligned with CyFun 2025 (CCB), with results per NIST CSF 2.0 function, assesses compliance on evidence. The source code is public on GitHub, for non-commercial use.
Explicit scope
Only the hosts you entrust to me. No unrequested scan.
Your credentials are never stored
Read-only service account, provided by you, never kept or exported.
Tamper-proof log
Every action is logged: a traceable and conclusive audit.
Remediation validated by a human
Fixes are proposed for validation, never applied automatically.
No data retained
Report delivered, then audit materials erased.
An assisted self-assessment, not a certification
My tool facilitates the CyFun self-assessment and prepares your file. It does not replace the official verification, reserved for BELAC-accredited bodies.
The 3 assurance levels
Basic, Important, Essential: choosing the right level
Three progressive levels. The right choice depends on your NIS2 category and your exposure. We help you decide.
Essential baseline
Basic
For whom: SMEs that want a solid foundation and coverage of the most common threats.
What's covered
- Essential cyber-hygiene measures
- Backups, MFA, updates
- Covers the bulk of common attacks
What I prepareI can help you produce a gap report and a prioritised remediation plan, ready for the CyFun self-assessment.
Get in touchReinforced
Important
For whom: NIS2 “important” entities and SMEs handling sensitive or critical data.
What's covered
- The entire Basic level, reinforced
- Detection and incident response
- Governance and risk management
What I prepareI can help you build the compliance dossier and prepare for verification by an accredited body.
Get in touchNear-complete
Essential
For whom: NIS2 “essential” entities and organisations with high security requirements.
What's covered
- The entire Important level, deepened
- Advanced measures and regular testing
- Measured continuous improvement
What I prepareI can contribute to structuring a security programme: audit documentation and a multi-year roadmap, a demanding level I keep training on.
Get in touchThe Walloon cybersecurity voucher can finance a large part of an audit and remediation effort. Here, for information, is how the scheme works.
A question about NIS2 or ClawkWerk?
Write to me: NIS2 category, CyFun level, how the tool works. An honest answer, no jargon.
I reply personallyOne point of contact: meData in Belgium