Compliance / By country / CyFun
CyFun (Cyber Fundamentals Framework) and Microsoft 365
Belgium's tiered Basic / Important / Essential framework, referenced for NIS2. Siemserva by Senserva maps 218+ Microsoft 365 and Entra ID checks to the areas CyFun emphasizes, so a scan of your tenant doubles as evidence.
What CyFun is
CyFun is the tiered framework (Basic, Important, Essential) issued by Belgium's Centre for Cybersecurity (CCB), increasingly referenced for NIS2 compliance. Its identity and access-control measures map to Microsoft 365 and Entra ID findings.
How Siemserva maps to CyFun
CyFun asks for strong identity, access control, and monitoring. Siemserva evidences those areas with the checks below, each ranked by Severity and checked against your own tenant:
Identity and access management (60 checks)
Conditional Access (60 checks)
Multi-factor authentication (42 checks)
Auth User Not MFA RegisteredAuth Microsoft Authenticator Authentication Method In Use But Not Allowed By UserAuth Password Authentication Method In Use But Not Allowed By Senserva Security ManagerAuth Passwordless Microsoft Authenticator Authentication Method In Use But Not Allowed By UserAuth Require Passwordless But Its Not Used By UserAuth Software Oath Authentication Method In Use But Not Allowed By UserLogging and audit (43 checks)
Threat detection and risky sign-ins (13 checks)
See every check with its Severity and remediation in the checks catalog, or the per-control detail in the control reference.
CyFun and Microsoft 365: common questions
Does CyFun apply to Microsoft 365?
CyFun (Cyber Fundamentals Framework) does not name Microsoft 365 specifically, but its identity, access-control, and logging requirements are met (or missed) in your Microsoft 365 and Entra ID configuration. That is where Siemserva checks provide the evidence.
How does Siemserva map to CyFun?
Siemserva runs 218+ Microsoft 365 and Entra ID checks across the areas CyFun emphasizes, multi-factor authentication, Conditional Access, privileged access, and logging, ranks the gaps by Severity, and produces audit-ready evidence. It is evidence, not an official mapping or certification.
Is this an official CyFun certification?
No. Senserva is not an assessor and issues no certifications. It provides the configuration evidence, Severity ranking, and remediation that make an assessment defensible. Confirm requirements with your assessor or regulator.
More: the frameworks crosswalk, Microsoft 365 compliance by country, and the audit evidence guide.