Ariovis

Use case · Belgium · NIS2 and CyberFundamentals

NIS2 in Belgium: from CyFun to verifiable IAM controls

Belgium has already transposed the NIS2 Directive into national law. The Act of 26 April 2024 entered into force on 18 October 2024 and establishes cybersecurity risk-management, incident-reporting and supervisory requirements for the entities concerned. The Centre for Cybersecurity Belgium (CCB) provides the national framework, including conformity assessment routes based on CyberFundamentals (CyFun), ISO/IEC 27001 or direct inspection, depending on the entity's situation.

Identity and access management supports several of these requirements through the governance of identities, authentication, access rights, privileged accounts and evidence of control operations. An IAM programme cannot provide NIS2 certification on its own, but it can make access-related security measures more consistent, easier to operate and easier to demonstrate during the relevant assessment process.

Which organisations fall within the scope of NIS2 in Belgium?

The scope of NIS2 depends on the services provided, the size of the organisation and the rules linking it to Belgium. The sectors concerned are listed in particular in the annexes to the legislation, with specific criteria and exceptions. An organisation therefore cannot infer that it is subject to NIS2 solely because it belongs to a sensitive sector or has an establishment in Belgium.

The classification must be assessed on the basis of the activities actually carried out, the applicable thresholds and exceptions, and any sector-specific provisions. The CCB provides an official scope-checking tool. For an international organisation, this analysis must also take account of the jurisdiction and territoriality rules under NIS2.

Check whether you are in scope before choosing your controls

The CCB provides a tool for checking the scope of NIS2. This preliminary check helps guide the regulatory analysis without confusing an initial estimate with a definitive legal classification.

Access the CCB's official tool

Essential or important entity: what difference does it make?

Essential entities and important entities are subject to cybersecurity obligations, but their supervision is not organised in the same way. Essential entities are subject to mandatory regular conformity assessments, whereas important entities fall primarily under an ex post supervision regime. An important entity may nevertheless choose to have its measures assessed and must be able to respond to requests from the competent authorities.

The legal category alone does not determine the appropriate CyFun assurance level. An essential entity is not automatically required to achieve the CyFun Essential level: the appropriate level depends on the risk analysis and the assessment framework chosen.

  • Essential entity

    Mandatory regular assessment

    The law provides for a conformity assessment that may be based on CyFun, ISO/IEC 27001 or direct inspection. The assurance level, evidence and deadlines must be assessed according to the chosen route and the applicable provisions.

  • Important entity

    Primarily ex post supervision

    Risk-management and reporting obligations remain applicable. However, the law does not impose on all important entities a general obligation for certification or periodic verification comparable to that for essential entities.

Essential entity ≠ CyFun Essential level. Important entity ≠ CyFun Important level.

Key NIS2 dates in Belgium

Belgium has already passed the first stages of NIS2 implementation. The deadlines still ahead concern, in particular, the conformity assessment of certain essential entities. Their implications depend on the chosen route and, in some cases, the date on which the entity came within the regulatory scope.

  1. Entry into force

    The Belgian NIS2 Act enters into force.

  2. Registration of certain digital service providers

    Initial date set for the registration of certain specific categories of digital services with the CCB.

  3. General registration

    Initial date set for the registration of other entities falling within scope.

  4. CyFun 2025

    Publication of the new version of the CyberFundamentals framework, aligned in particular with the principles of the NIST Cybersecurity Framework 2.0.

  5. First assessment milestone

    An important initial deadline for essential entities: CyFun verification or a formal commitment to this route, submission of ISO/IEC 27001 documents, or submission of the information requested for direct inspection, depending on the chosen route.

  6. Second milestone

    Date set in particular for certain CyFun Important verifications, CyFun Essential certifications, ISO/IEC 27001 certifications or progress reports under the direct inspection route, as applicable.

These dates reflect the initial timetable set by Belgian regulations and the clarifications published by the CCB. They are not all universal deadlines. The entity's specific circumstances, assurance level, date of coming within scope and official communications received must be examined.

CyFun, ISO 27001 or direct inspection: which assessment route?

For essential entities, Belgian regulations provide for several conformity assessment routes. These routes should not be treated as three equivalent security levels: they have their own procedures, documentary requirements and verification arrangements. The choice of route must take account of the risk assessment, scope, arrangements already in place and conditions recognised by the CCB.

CyberFundamentals: a risk-based control framework

CyberFundamentals is the cybersecurity framework developed by the CCB. It enables organisations to structure their measures across several assurance levels: Basic, Important and Essential. The levels represent progressively more demanding requirements, with the choice depending on the risk assessment. Measures at higher levels are additional to the requirements of lower levels.

Under the assessment scheme, the Basic and Important levels are subject to verification, while the Essential level requires certification. These assessments are carried out by conformity assessment bodies meeting the applicable accreditation and approval conditions.

Basic
Fundamental measures intended to address the main cybersecurity risks.
Important
Additional measures to address higher risks, including certain targeted attacks.
Essential
A strengthened level intended to address more advanced threats and requiring certification under the CyFun scheme.

ISO 27001: building on an existing management system

An organisation that already has an information security management system may choose the ISO/IEC 27001 route provided for under the Belgian scheme. This route relies in particular on an appropriate certification scope, a Statement of Applicability (SoA) and demonstration of the security measures implemented. The CCB must be able to assess whether the scope and Statement of Applicability adequately address the corresponding requirements.

ISO 27001 certification therefore does not automatically constitute universal proof of NIS2 compliance. In particular, it must be issued under the applicable accreditation and approval conditions and cover the systems and risks concerned.

For the ISO/IEC 27001 route for essential entities, the initial timetable required submission of the scope, SoA and latest relevant internal audit by 18 April 2026. Certification recognised under the scheme's conditions must be obtained by 18 April 2027 in the general case provided for.

Direct inspection: demonstrating measures to the CCB

The Belgian scheme also provides for a direct inspection route by the CCB. For the essential entities concerned, the initial timetable included submission of a CyFun self-assessment or ISO/IEC 27001 documentary information by 18 April 2026, followed by a progress report by 18 April 2027.

This route does not exempt the organisation from its obligations and may lead to requests for documents, inspections and supervisory measures. It must be considered within the framework of the official procedures.

  • CyFun

    Assessment method
    Basic/Important verification or Essential certification
    Core evidence
    Self-assessment, measures and evidence according to the level

  • ISO/IEC 27001

    Assessment method
    Certification under the recognised conditions
    Core evidence
    Scope, SoA, audit and certification

  • Direct inspection

    Assessment method
    Supervision by the CCB
    Core evidence
    Self-assessment, documentation, reports and requested information

CyFun 2025: what does the new version change?

CyFun 2025 updates the framework to take account, in particular, of the NIST Cybersecurity Framework 2.0, developments in cybersecurity and feedback from organisations using it. The controls are structured around the Govern, Identify, Protect, Detect, Respond and Recover functions. The new version clarifies the objectives of the measures, strengthens governance guidance and makes it easier to assess documentary and operational maturity.

The CCB has provided for a transitional period during which CyFun 2023 and CyFun 2025 may coexist. Until 18 April 2027, the organisations concerned may choose the applicable version under the conditions of the transitional arrangements. Verification statements and certificates issued under CyFun 2023 may remain valid until no later than 18 April 2028, in accordance with the transitional provisions. When preparing an assessment approach today, it is therefore important to identify precisely which version is being used, without assuming that the references and controls in the two editions are interchangeable.

Explore CyberFundamentals 2025 and its tools

From CyFun to IAM controls: what needs to be implemented

In CyberFundamentals 2025, several measures in the PR.AA family (Identity Management, Authentication, and Access Control) directly concern identity governance, authentication and access rights. Their implementation is not simply a matter of technical configuration: it requires identified responsibilities, formalised rules and the ability to verify results.

The mappings below are based on measures published at the Basic level of CyFun 2025. The proposed IAM mechanisms and evidence translate these measures into operational practice. They should not be confused with an exhaustive reproduction of the normative requirements or with an attestation of conformity.

  • CyFun reference

    CyFun 2025 — PR.AA-01.1

    Govern identities

    Purpose of the measure
    Manage the identities and authentication credentials of authorised users, services and equipment.
    Ariovis analysis
    The organisation must be able to distinguish between an identity, its associated accounts and the rights assigned to it. An IAM repository provides a structured view of employees, contractors and technical accounts, but this view must be linked to business repositories, resource owners and lifecycle events. Creating an account is only one step: its modification and deactivation must also be covered by a controlled process.
    Possible IAM mechanisms
    • Identity repository.
    • Identity / account reconciliation.
    • Joiner / Mover / Leaver processes.
    • Identification of technical account owners.
    • Provisioning and deprovisioning.
    Possible operational evidence
    Inventory of identities and accounts, identification of responsible parties, creation and deactivation history, lifecycle rules and discrepancy reports.

  • CyFun reference

    CyFun 2025 — PR.AA-03.2

    Control multi-factor authentication

    Purpose of the measure
    Require multi-factor authentication for remote access to the organisation's networks.
    Ariovis analysis
    MFA must be deployed across the relevant access journeys, but its value also depends on how identities, authentication mechanisms and exceptions are administered. A clear policy must specify user populations, resources, authentication methods and exceptional situations. Other sensitive scenarios may warrant stronger protection in light of the risks, but this does not justify artificially broadening the wording of this CyFun measure.
    Possible IAM mechanisms
    • Identity provider.
    • MFA for the relevant remote access.
    • Authentication policies.
    • Exception management.
    • Logging of policy changes.
    Possible operational evidence
    List of access journeys covered, MFA policy configuration, deployment status, documented exceptions and administration records.

  • CyFun reference

    CyFun 2025 — PR.AA-05.1

    Govern and review rights

    Purpose of the measure
    Define, manage, enforce and review permissions, access rights and authorisations.
    Ariovis analysis
    Entitlements must be governed from assignment through to removal. A rights catalogue without accountable owners, or a recertification campaign that leads to no corrections, is not sufficient to demonstrate operational control. The aim is to define the rules, identify decision-makers, apply the rights actually approved and retain a record of decisions and remediation.
    Possible IAM mechanisms
    • Entitlement catalogue.
    • Request and approval workflows.
    • Roles and assignment rules.
    • Recertification.
    • Revocation and deprovisioning.
    Possible operational evidence
    Access rights matrix, approval decisions, review campaigns, discrepancies identified, remediation completed and revocation history.

  • CyFun reference

    CyFun 2025 — PR.AA-05.2

    Identify critical access needs

    Purpose of the measure
    Determine who needs access to information and technologies critical to the organisation, and the corresponding means of access.
    Ariovis analysis
    Access governance requires knowledge of important resources and their associated responsibilities. A purely technical analysis of directory groups is not always sufficient: the owner of an application or data must be able to explain which user populations have a legitimate need for access. Linking criticality, business use and entitlement in this way allows controls to be prioritised.
    Possible IAM mechanisms
    • Inventory of critical applications and resources.
    • Identification of business and technical owners.
    • Access rights mapping.
    • Assessment of sensitive access.
    • Targeted controls on priority resources.
    Possible operational evidence
    Inventory of critical resources, designated owners, access matrix, approved policies and decision history.

  • CyFun reference

    CyFun 2025 — PR.AA-05.3

    Apply least privilege

    Purpose of the measure
    Limit rights and authorisations to the systems and information needed to carry out tasks.
    Ariovis analysis
    Least privilege means aligning permissions with actual needs, rather than retaining rights granted for a past situation indefinitely. Role models can address some needs, but certain access requires greater granularity or a context-based decision. Entitlement governance must therefore remain consistent with the authorisation mechanisms actually used by applications.
    Possible IAM mechanisms
    • Business and technical roles.
    • Least-privilege policies.
    • Reduction of excessive rights.
    • Exception reviews.
    • Fine-grained authorisation where necessary.
    Possible operational evidence
    Entitlement rules, control results, decisions to reduce rights, exception reviews and records of authorisation changes.

  • CyFun reference

    CyFun 2025 — PR.AA-05.4

    Separate administration from everyday use

    Purpose of the measure
    Avoid using administrative privileges for routine everyday tasks.
    Ariovis analysis
    Privilege control must address both permitted actions and the conditions under which they are performed. Separating administrative use from office use, limiting standing rights and controlling certain privilege elevations helps reduce the exposure of sensitive accounts. A PAM solution can contribute to this control, but deploying it does not, on its own, constitute a least-privilege policy.
    Possible IAM mechanisms
    • Separate administrative accounts.
    • Privileged entitlement management.
    • Temporary elevation where necessary.
    • Session and secrets control.
    • Traceability of sensitive operations.
    Possible operational evidence
    Inventory of privileged accounts, usage rules, identified standing rights, elevation records, logs of the operations concerned and entitlement reviews.

Reuse CyFun controls within shared IAM governance

CyFun controls for identity management, authentication and access rights can draw on IAM processes already used in other frameworks. Their mapping must nevertheless distinguish shared security objectives, requirements specific to the Belgian framework and the evidence actually expected under the chosen assessment pathway.

Editorial reference: 19 October 2026 · Thematic mappings and operational contributions

Identities and lifecycleCyFun 2025 · BasicPR.AA-01.1

Identify users, services and their accounts

Problem addressed
A person leaves the organisation, changes role or is no longer responsible for a service, yet their associated accounts and rights remain active. Conversely, some technical accounts exist without a clearly identified owner or purpose.
Intended outcome
Link each account to an identity or authorised process, then manage its lifecycle through to deactivation.

ReCyF — working version 2.5

  • 10.A.1-EI/EE

    Individual accounts for users and automated processes.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.A.2-EI/EE

    Use of individual accounts restricted to their holders.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.A.5-EI/EE

    Deactivation of accounts no longer required within the timescales defined by the account management policy.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.A.6-EI/EE

    Account reviews at least annually, with correction of anomalies.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

CyFun 2025 — Basic

  • PR.AA-01.1 — Basic

    Management of identities and authentication information for authorised users, services and devices.

    Thematic mapping · Documentary verification to be confirmed

    CyFun 2025 — Basic, 1er octobre 2025

ISO/IEC 27001:2022

  • A.5.16

    Identity management.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.5.18

    Access rights, including their management and review.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

Annex A controls must be examined in light of the risk assessment, the ISMS scope and the Statement of Applicability (SoA).

European references — Article 21(2)

NIS2 Directive

  • Article 21(2)(h)

    cryptography and, where appropriate, encryption.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(i)

    human resources security, access control and asset management.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(j)

    MFA or continuous authentication where appropriate.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

Ariovis analysis

Governance starts with the ability to distinguish a person, an identity, an account and an entitlement. An IAM system can correlate these objects using authoritative sources and orchestrate joiner, mover and leaver events. It must also address technical accounts, whose legitimacy depends on a purpose and an owner, even when no person uses them directly.

Automation only adds value if events are reliable and target systems actually execute decisions. An incorrect HR source or an unmatched account can otherwise create a false sense of control.

IAM mechanisms

  • Identity repository.
  • Identity / account correlation.
  • HR or other authoritative sources.
  • Joiner / Mover / Leaver processes.
  • Provisioning.
  • Deprovisioning.
  • Reconciliation and discrepancy checks.

Possible evidence

  • Active account inventory.
  • Link to an identity or process.
  • Technical account owner.
  • Creation and deactivation history.
  • Leaver event records.
  • List of unresolved discrepancies.
  • Account review results.
Typical responsibilities
HR repository, IAM lead, account or application owners, operations.
Possible indicator
Proportion of active accounts with an identified owner or linked identity.

Nature and limitations of the mappings

A similar identity management objective, but no demonstrated equivalence of lifecycle arrangements or review frequency.

Thematic mapping, subject to the applicability defined within the ISMS.

Automation only adds value if events are reliable and target systems actually execute decisions. An incorrect HR source or an unmatched account can otherwise create a false sense of control.

Explore further: Identities and lifecycle

Technical detail in the context of France’s ReCyF.

Authentication and secretsCyFun 2025 · BasicPR.AA-03.2

Authenticate using risk-appropriate mechanisms

Problem addressed
An organisation has an authentication policy but does not know precisely which access routes are protected, how exceptions are managed or when secrets must be replaced.
Intended outcome
Manage authentication mechanisms, their coverage, secrets management and documented exceptions.

ReCyF — working version 2.5

  • 10.B.1-EI/EE

    Authentication mechanism using at least one secret element.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.2-EI/EE

    Changing default secrets before bringing systems into service.

    Thematic mapping · Identifier and applicability verified in the official document

    The text also requires checking with the supplier that the means and rights needed to make the change are available.

    Version de travail 2.5 du 17 mars 2026

  • 10.B.3-EI/EE

    Renewal of a shared account's secret element when a user of that account is removed.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.4-EI/EE

    Knowledge of secret elements restricted to authorised users.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.5-EI/EE

    Compliance with applicable recommendations on authentication factors and their management.

    Thematic mapping · Identifier and applicability verified in the official document

    The text addresses complexity and renewal frequency according to ANSSI recommendations, taking account of the maximum technically possible.

    Version de travail 2.5 du 17 mars 2026

  • 10.B.6-EI/EE

    Risk reduction measures where a secret element cannot be changed for technical or operational reasons.

    Thematic mapping · Identifier and applicability verified in the official document

    This exception requires appropriate access control and reduction of the risk associated with the fixed secret; additional traceability falls under 10.B.7-EE.

    Version de travail 2.5 du 17 mars 2026

  • 10.B.7-EE

    Additional traceability under the exception provided for in the preceding control, for essential entities.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

CyFun 2025 — Basic

  • PR.AA-03.2 — Basic

    MFA required for remote access to the organisation's networks.

    Thematic mapping · Documentary verification to be confirmed

    The scope stated in the brief remains to be confirmed in the Basic booklet: the indexed Key Measures annex uses different wording for 2025. The detailed booklet could not be read (HTTP 403).

    CyFun 2025 — Basic, 1er octobre 2025

ISO/IEC 27001:2022

  • A.5.17

    Authentication information.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.8.5

    Secure authentication.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

Annex A controls must be examined in light of the risk assessment, the ISMS scope and the Statement of Applicability (SoA).

European references — Article 21(2)

NIS2 Directive

  • Article 21(2)(h)

    cryptography and, where appropriate, encryption.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(i)

    human resources security, access control and asset management.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(j)

    MFA or continuous authentication where appropriate.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

Ariovis analysis

An authentication policy is not measured solely by the presence of MFA. It must make clear which journeys are protected, which mechanisms are used, how exceptions are authorised and how authentication information is administered. Technical secrets and shared access also require treatment appropriate to their actual use.

IGA governs identities and their associated rights, while Access Management enforces authentication policies. Secrets management and PAM solutions intervene where the accounts and operations concerned require additional controls.

IAM mechanisms

  • IdP and Access Management.
  • MFA.
  • Federation.
  • Authentication policies.
  • Exception management.
  • Secrets vaults.
  • Secrets rotation according to applicable needs and rules.
  • Logging of sensitive changes.

Possible evidence

  • Authentication journey inventory.
  • Enforced MFA policies.
  • Coverage of the remote access concerned.
  • Authorised and justified exceptions.
  • Policy change history.
  • Rotation records for the secrets concerned.
Typical responsibilities
Access Management lead, security, application owners and secrets operations.
Possible indicator
Proportion of identified remote access journeys effectively covered by the intended MFA.

Nature and limitations of the mappings

This measure must not be presented as explicitly requiring MFA for every application, every connection and irrespective of context.

Explore further: Authentication and secrets

Technical detail in the context of France’s ReCyF.

Access rights and recertificationCyFun 2025 · BasicPR.AA-05.1 to PR.AA-05.3

Grant, review and remove legitimate access rights

Problem addressed
Access rights accumulate as staff change roles. Application owners do not always have a clear view of assigned permissions, and review campaigns may conclude without effective correction.
Intended outcome
Keep entitlements aligned with actual need, document decisions and check their implementation.

ReCyF — working version 2.5

  • 10.C.1-EI/EE

    Rights assigned to authenticated users and automated processes.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.C.2-EI/EE

    Limitation of rights to the resources required.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.C.3-EI/EE

    Rights granted only to users and processes with a justified need for the resource.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.C.4-EI/EE

    Access rights reviews at least annually, with correction of anomalies.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

CyFun 2025 — Basic

ISO/IEC 27001:2022

  • A.5.15

    Access control.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.5.18

    Access rights.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.8.3

    Information access restriction.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.5.3

    Segregation of duties, where relevant to the control being examined.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

Annex A controls must be examined in light of the risk assessment, the ISMS scope and the Statement of Applicability (SoA).

European references — Article 21(2)

NIS2 Directive

  • Article 21(2)(h)

    cryptography and, where appropriate, encryption.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(i)

    human resources security, access control and asset management.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(j)

    MFA or continuous authentication where appropriate.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

Ariovis analysis

Entitlement governance requires a business decision to be linked to a right actually present in the system. An approved request, role rule or recertification campaign is not sufficient if technical permissions do not align with the expected outcome. The control must cover the legitimacy of the right, its assignment, any exceptions and its removal.

Role models allow some decisions to be standardised at scale. They must nevertheless remain appropriate to the organisation and can be supplemented by fine-grained authorisation mechanisms where decisions depend on the resource, action or context.

IAM mechanisms

  • Entitlement catalogue.
  • Resource owners.
  • Business and technical roles.
  • Assignment rules.
  • Requests and approvals.
  • Recertification campaigns.
  • Exception management.
  • Revocation.
  • Checks for discrepancies between intended and effective rights.

Possible evidence

  • Access rights matrix.
  • Owner approvals.
  • Request history.
  • Recertification decisions.
  • Exception list.
  • Completed corrections.
  • Revocation log.
Typical responsibilities
Business owners, application owners, IAM leads and access rights operations.
Possible indicator
Proportion of revocation decisions actually executed and verified in target systems.

Nature and limitations of the mappings

Entitlement governance requires a business decision to be linked to a right actually present in the system. An approved request, role rule or recertification campaign is not sufficient if technical permissions do not align with the expected outcome. The control must cover the legitimacy of the right, its assignment, any exceptions and its removal.

Explore further: Access rights and recertification

Technical detail in the context of France’s ReCyF.

Shared accountsCyFun 2025 · BasicPR.AA-01.1, PR.PS-04.1 — indirect links

Control shared accounts and preserve accountability

Problem addressed
Some legacy systems or operational constraints lead to the use of shared accounts. Without appropriate controls, it becomes difficult to determine who used an account, when and for which operation.
Intended outcome
Limit shared use, justify exceptions and retain usable attribution of the access concerned.

ReCyF — working version 2.5

  • 10.A.2-EI/EE

    Use of individual accounts restricted to their holders.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.A.3-EI/EE

    Compensating measures and traceability where constraints prevent the use of individual accounts.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.3-EI/EE

    Renewal of a shared account's secret element after removal of a user of that account.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.4-EI/EE

    Protection of knowledge of secrets.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.6-EI/EE

    Exception for secrets that cannot be changed, with an additional traceability requirement for EE in the specified case.

    Thematic mapping · Identifier and applicability verified in the official document

    This exception requires appropriate access control and reduction of the risk associated with the fixed secret; additional traceability falls under 10.B.7-EE.

    Version de travail 2.5 du 17 mars 2026

  • 10.B.7-EE

    Exception for secrets that cannot be changed, with an additional traceability requirement for EE in the specified case.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

CyFun 2025 — Basic

ISO/IEC 27001:2022

  • A.5.16

    Identity management.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.5.17

    Authentication information.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.8.15

    Logging.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

Annex A controls must be examined in light of the risk assessment, the ISMS scope and the Statement of Applicability (SoA).

European references — Article 21(2)

NIS2 Directive

  • Article 21(2)(h)

    cryptography and, where appropriate, encryption.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(i)

    human resources security, access control and asset management.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(j)

    MFA or continuous authentication where appropriate.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

Ariovis analysis

Shared account traceability is not simply a matter of retaining technical logs. It requires an understanding of the conditions in which the account was used and the ability to link its use to a person or authorised operation. Where individual accounts are not possible, the exception must therefore be documented, compensating measures defined and their continued operation verified.

Secrets management, session control and operational procedures can contribute to this control. None of these mechanisms should be presented as blanket permission to share accounts without justification.

IAM mechanisms

  • Shared account inventory.
  • Justification of exceptions.
  • Designation of responsible owners.
  • Secrets management.
  • Rotation when a relevant user's access is revoked.
  • Access control.
  • Usage traceability.
  • Exception review.

Possible evidence

  • Shared account register.
  • Technical or operational justification.
  • List of authorised users.
  • Rotation records.
  • Relevant logs.
  • Periodic check results.
  • Decisions to retain or remove exceptions.
Typical responsibilities
System owner, security lead, PAM or secrets lead, operations.
Possible indicator
Proportion of identified shared accounts with a justified exception and documented traceability arrangements.

Nature and limitations of the mappings

These measures provide thematic points of reference. They must not be presented as a verbatim transposition of the shared account exceptions provided for by ReCyF.

Thematic mappings, to be assessed according to the scope and selected controls.

Explore further: Shared accounts

Technical detail in the context of France’s ReCyF.

Directories and privilegesCyFun 2025 · BasicPR.AA-05.1, PR.AA-05.4, ID.AM-08.2

Secure directories and administration paths

Problem addressed
An organisation has IAM governance, but some groups, delegations, administrative accounts and legacy mechanisms in its directories still enable excessive access or privilege escalation.
Intended outcome
Connect IAM governance with technical directory security and control of administrative rights.

ReCyF — working version 2.5

  • 11.A.1-EI/EE

    Separation of administrative accounts and their use.

    Thematic mapping · Identifier and applicability verified in the official document

    Administration is performed exclusively through administrative accounts, which are themselves reserved exclusively for these actions.

    Version de travail 2.5 du 17 mars 2026

  • 11.A.3-EI/EE

    Application of identity management rules to administrative accounts.

    Thematic mapping · Identifier and applicability verified in the official document

    The rules concern identities and access for administrative accounts.

    Version de travail 2.5 du 17 mars 2026

  • 11.A.4-EE

    Use of administrative accounts limited to the intended resources and administrative operations.

    Thematic mapping · Identifier and applicability verified in the official document

    Connection to managed resources to administer them, or to an administration resource.

    Version de travail 2.5 du 17 mars 2026

  • 11.B.1-EI/EE

    Application of security patches to the directories concerned.

    Thematic mapping · Identifier and applicability verified in the official document

    Patches must be applied without undue delay.

    Version de travail 2.5 du 17 mars 2026

  • 11.B.2-EE

    Identification of the resources forming each directory's trust core.

    Thematic mapping · Identifier and applicability verified in the official document

    The trust core comprises the directory and the resources that can host it or take control of it.

    Version de travail 2.5 du 17 mars 2026

  • 11.B.6-EE

    Annual directory configuration review.

    Thematic mapping · Identifier and applicability verified in the official document

    The review targets unnecessary or anomalous elements; an automated tool is recommended, not mandated by this line.

    Version de travail 2.5 du 17 mars 2026

CyFun 2025 — Basic

ISO/IEC 27001:2022

  • A.8.2

    Privileged access rights.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.8.9

    Configuration management.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.8.15

    Logging.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

Annex A controls must be examined in light of the risk assessment, the ISMS scope and the Statement of Applicability (SoA).

European references — Article 21(2)

NIS2 Directive

  • Article 21(2)(h)

    cryptography and, where appropriate, encryption.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(i)

    human resources security, access control and asset management.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(j)

    MFA or continuous authentication where appropriate.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

Ariovis analysis

Directory security does not automatically follow from entitlement governance. IGA can control the assignment of groups and rights, but protecting Active Directory or LDAP also requires analysis of delegations, sensitive accounts, configurations and paths leading to critical resources. Corrections must be prioritised according to risk rather than limited to an inventory of administrative accounts.

PAM addresses certain privileged uses, but reducing standing privileges and securing the trust core also require architectural, configuration and operational decisions. A bastion host alone does not eliminate attack paths within the directory.

IAM mechanisms

  • Administrative account review.
  • Sensitive group analysis.
  • Separation of administrative activities.
  • Delegation analysis.
  • Privilege reduction.
  • Attack path checks.
  • Directory configuration review.
  • Patch management.
  • Logging of critical changes.

Possible evidence

  • Privileged account and group inventory.
  • Justification of sensitive rights.
  • Attack path mapping.
  • Remediation history.
  • Configuration review reports.
  • Patch tracking.
  • Privileged change logs.
Typical responsibilities
Directory team, IAM architect, identity security, PAM lead and operations.
Possible indicator
Number of critical attack paths identified and subsequently eliminated or controlled within a documented scope.

Nature and limitations of the mappings

These references are neither an exhaustive description of Active Directory hardening nor equivalent to the French requirements for the trust core.

Explore further: Directories and privileges

Technical detail in the context of France’s ReCyF.

Machine identities and certificatesCyFun 2025 · BasicPR.AA-01.1

Govern machine identities and their trust mechanisms

Problem addressed
An organisation knows its staff accounts but has insufficient control over the identities of applications, devices and automated processes. Some certificates, secrets or technical accounts persist without an identified owner or documented lifecycle.
Intended outcome
Link technical identities to their uses and control associated cryptographic mechanisms where these are used.

ReCyF — working version 2.5

  • 10.A.1-EI/EE

    Individual identification of users and automated processes accessing resources.

    Operational contribution · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.A.5-EI/EE

    Deactivation of accounts no longer required.

    Operational contribution · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.1-EI/EE

    Authentication mechanisms for users and automated processes.

    Operational contribution · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.2-EI/EE

    Changing default secret elements.

    Operational contribution · Identifier and applicability verified in the official document

    The text also requires checking with the supplier that the means and rights needed to make the change are available.

    Version de travail 2.5 du 17 mars 2026

CyFun 2025 — Basic

  • PR.AA-01.1 — Basic

    Management of identities and authentication information for users, services and devices.

    Operational contribution · Documentary verification to be confirmed

    CyFun 2025 — Basic, 1er octobre 2025

ISO/IEC 27001:2022

  • A.5.16

    Identity management.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.8.24

    Use of cryptography.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

Annex A controls must be examined in light of the risk assessment, the ISMS scope and the Statement of Applicability (SoA).

European references — Article 21(2)

NIS2 Directive

  • Article 21(2)(h)

    cryptography and, where appropriate, encryption.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(i)

    human resources security, access control and asset management.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(j)

    MFA or continuous authentication where appropriate.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

Ariovis analysis

A machine identity is not simply a service account. It may be represented by a certificate, key, token, application account or a combination of mechanisms. The organisation must distinguish the legitimacy of this identity, the resources it can reach and the technical means used to authenticate it.

IAM can govern the owners, uses and entitlements of these identities. PKI manages certificates and the corresponding cryptographic mechanisms. Controlling risk requires coordination between these responsibilities, particularly when an application is retired, a certificate expires or a secret must be revoked.

IAM mechanisms

  • Machine identity inventory.
  • Identification of owners.
  • Service account management.
  • Technical identity lifecycle.
  • Inventory of relevant certificates.
  • Granting and removal of access rights.
  • Certificate issuance, renewal and revocation through appropriate systems.
  • Control of associated secrets and keys.

Possible evidence

  • Non-human identity inventory.
  • Documented owner and purpose.
  • References to associated accounts or certificates.
  • Validity and renewal dates.
  • Revocation history.
  • Access rights review results.
  • Handling of identities no longer required.
Typical responsibilities
Application owners, IAM team, PKI team, operations and security.
Possible indicator
Proportion of critical technical identities with an owner and a documented renewal or revocation mechanism.

Nature and limitations of the mappings

None of the cited references should be presented as systematically requiring all organisations to deploy a complete PKI.

Certificates are one possible technical mechanism for certain uses. Their management depends on the authentication, trust and cryptographic needs concerned.

Explore further: Machine identities and certificates

Technical detail in the context of France’s ReCyF.

An access policy is not enough: its implementation must be demonstrated

CyFun distinguishes between policy maturity and implementation maturity. This distinction is particularly relevant to identities and access: a leaver procedure may be perfectly documented without accounts actually being deactivated, and a least-privilege policy may exist without historical rights having been reviewed. The quality of control therefore depends on the gap between the intended rule and observable practices.

Well-governed IAM arrangements help bring these two dimensions together. They link decisions made by business and security teams to operations performed in systems, then retain the information needed to verify the result. This capability must be considered when processes are designed, rather than added at the time of an assessment.

  • A contractor leaves

    Situation
    a contractor leaves the organisation while holding accounts in several applications.
    Expected control
    the departure must trigger removal of access in accordance with the defined rules.
    Possible evidence
    leaver event, revocation decisions, deactivation records and handling of any discrepancies.

  • Sensitive administrative intervention

    Situation
    an administrator needs to carry out a one-off privileged operation.
    Expected control
    the access used must be consistent with the responsibilities, authorisations and conditions specified.
    Possible evidence
    identity of the person performing the operation, right assigned, duration and context of access, and logging of the operation where necessary.

  • Technical account with no identified owner

    Situation
    a service account has significant permissions, but no responsible owner is clearly identified.
    Expected control
    the account must be linked to a purpose and a responsible owner, with an explicit decision on the associated rights and authentication mechanisms.
    Possible evidence
    inventory, designated owner, justification of rights, review date and correction history.

IAM contributes to NIS2 without covering the entire regulatory framework

Identity and access governance is no substitute for overall risk analysis, incident management, supply chain security or the continuity and governance requirements under NIS2. IAM mechanisms must form part of broader cybersecurity arrangements, led by the appropriate responsible parties and adapted to the organisation's risks.

Similarly, an IGA platform does not replace an identity provider, an MFA mechanism or a PAM solution. Each component addresses a different need: governing rights, authenticating, controlling privileges, enforcing authorisations and retaining records. Their value comes from consistent responsibilities and processes, not simply from placing them alongside one another.

Build IAM controls suited to your organisation

The controls to implement depend on the existing information system, risks and responsibilities already defined. Ariovis works on process scoping as well as the integration and operation of technical mechanisms. The aim is to establish controls that are useful in day-to-day operations and whose results can be verified as part of a CyFun or ISO 27001 approach, or internal control.

Regulatory and technical sources

This analysis draws on official publications from the Centre for Cybersecurity Belgium, information from Safeonweb@Work and documents from the CyberFundamentals 2025 framework. The dates and procedures are those known as at 19 October 2026. Each entity's own obligations must be checked against its situation and the official communications applicable to it.

Make your IAM controls demonstrable within your CyFun approach

A CyFun assessment or an ISO 27001 programme requires evidence consistent with the selected measures, but producing evidence must not become an exercise disconnected from day-to-day operations. Ariovis supports identity and entitlement governance, the security of access journeys and the industrialisation of controls within its expertise. The work aims to make processes more reliable and their results verifiable within the assessment framework applicable to your organisation.

Discuss my IAM controls and CyFun evidence
Explore our identity governance approach