CyFun on Azure
CyberFundamentals on Azure: assurance levels and the evidence behind them
The CCB CyberFundamentals framework is the CCB's preferred path to demonstrating NIS2 compliance in Belgium. Cloudivence, formerly Governator, handles the Azure side: evidence collection, control assessment, attestations and an evidence pack per assurance level.
What CyberFundamentals is, and why it matters on Azure
CyberFundamentals (CyFun) is the cybersecurity assurance framework published by Belgium's Centre for Cybersecurity (CCB). It bundles ISO/IEC 27001, NIST CSF, and CIS Controls into four assurance levels and is the framework the CCB has aligned with NIS2 enforcement: an organisation that reaches the appropriate CyFun level is considered to have met the matching subset of NIS2 Article 21 measures.
For Azure environments, that turns CyFun into concrete evidence work: each control needs proof from the platform or an attestation from a person. Matching the Azure technical state to the control set is the layer Cloudivence takes on. It assesses the 2023 edition of the framework; the 2025 edition is on its roadmap.
The framework is also recognised across the EU through bilateral arrangements with other national authorities, so a CyFun assurance pack travels well beyond Belgium for organisations that operate cross-border.
The three assurance levels, and what Cloudivence covers
Each CyFun level expects a deeper Azure evidence model. Cloudivence assesses all 219 controls of the 2023 edition, and its scores and evidence pack can be filtered to the level you target.
Azure focus areas
Identity hygiene (MFA, no shared admin), Defender free tier on every subscription, basic backup, encryption at rest, public-exposure inventory.
What Cloudivence covers
The 34 controls the framework assigns to Basic, assessed from Defender, Azure Policy, role assignment, storage and backup evidence. Controls Azure cannot show are attested.
Azure focus areas
Defender Plan 2 on production workloads, structured exemption process, RBAC drift alerting, Conditional Access posture, Key Vault inventory, Sentinel onboarding for critical resources.
What Cloudivence covers
The 106 Important controls, from the same evidence plus network, firewall and WAF configuration and the activity log. Exceptions carry an expiry date, and the evidence pack can be filtered to this level.
Azure focus areas
Multi-region BCDR with tested runbooks, customer-managed keys, full Defender plan coverage, network segmentation evidence, dedicated incident-response artefacts, supply-chain attestations.
What Cloudivence covers
The 79 Essential controls. Many of them, such as tested recovery runbooks or supplier attestations, can only be attested: Cloudivence records the attestation and its evidence link, and does not read them from Azure.
How Cloudivence handles CyFun on Azure
Controls matched to your Azure evidence
Each assessment matches CyFun controls to Defender recommendations and Azure Policy results in your environment, and backup controls use an explicit ruleset. The matching is rebuilt on every assessment, so it follows your subscriptions rather than a fixed list.
Seven states, and unknown is one of them
Every control is compliant, partial, non compliant, attested, planned, not assessed or not applicable. A control without evidence counts as zero until someone provides it, and only a control that does not apply leaves the score.
Attestations and exceptions
Controls Azure cannot show, such as training records or recovery tests, are attested with the name of the person attesting, an evidence link and an optional review date. A control exception carries an expiry date and is marked expired once it passes.
An evidence pack at your target level
An Excel workbook with an executive summary, the control evidence matrix, the gap analysis, attestations, findings and exceptions, filtered to Basic, Important or Essential and kept in the report history.
Optional drafted gap narratives
With your own Azure OpenAI deployment configured, Cloudivence can draft a gap narrative per control for a person to review. It is off unless you set it up, and the drafts are not part of the evidence pack.
Reassessment when you run it
The assessment runs after a collection, when the operator starts it. Scheduled reassessment and drift alerts are on the roadmap.
Assessment, or continuous assurance?
CyFun Readiness Assessment
A one-time engagement in which GenioCT uses Cloudivence to produce a point-in-time picture with expert interpretation. Output: a roadmap to your target assurance level with prioritised fixes, attestations, and an evidence pack for your auditor.
Typical timeline: 3-5 weeks.
Cloudivence pilot
Cloudivence in an assisted pilot: collections and reassessments run with you, evidence, attestations and exceptions kept between them, and the evidence pack regenerated when you need it.
Engagement: ongoing.
Related
Start with an Azure Health Check
Not sure where to begin? A quick architecture review gives you a clear picture. No obligation.
- ✓ Risk scorecard across identity, network, governance, and security
- ✓ Top 10 issues ranked by impact and effort
- ✓ 30-60-90 day roadmap with quick wins