Compliance Overview
CyberFundamentals Basic Level · 34 Controls · NIST CSF v1.1
6
Compliant
13
Partial
8
Non-Compliant
7
Not Assessed
Key Measures (13)
Mandatory controls derived from Belgian cyber incidents
Identities and credentials are issued, managed, verified, revoked, and audited
Remote access is secured with multi-factor authentication (MFA)
Access permissions and authorizations are managed
Access to critical information is identified and managed
Least privilege access is enforced
Administrator privileges are not used for daily tasks
Network integrity is protected with firewalls
Network segmentation is implemented where appropriate
Backups of information are conducted, maintained, and tested
Maintenance and repair of assets is performed and logged with approved tools
Audit/log records are determined, documented, implemented, and reviewed
Event data are collected and correlated from multiple sources
Malicious code is detected
Improvement needed: Organizational cybersecurity policy is established and communicated
Draft a cybersecurity policy covering acceptable use, password requirements, incident reporting, and data handling. Have management approve it. Distribute to all employees and obtain acknowledgment. Review annually.
Improvement needed: Governance and risk management processes address cybersecurity risks
Establish a risk management process. Conduct a cybersecurity risk assessment at least annually. Document risk appetite and tolerance levels. Integrate cyber risks into overall business risk management.
Improvement needed: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk
Maintain a risk register combining threats, vulnerabilities, likelihood, and business impact. Use a simple risk matrix (likelihood x impact). Prioritize mitigation based on risk scores. Review quarterly.
Improvement needed: Least privilege access is enforced
Audit all Global Administrator accounts — limit to maximum 2-4. Remove standing privileged access; use PIM for time-limited elevation. Restrict default user permissions in Entra ID. Disable self-service group creation if not needed.
Improvement needed: Administrator privileges are not used for daily tasks
Create dedicated admin accounts (e.g., admin-john@company.com) separate from daily-use accounts. Admin accounts should not have mailboxes or Microsoft 365 licenses. Use Privileged Identity Management (PIM) for just-in-time access.
+3 more findings