NIS2 Scope & Baseline Report intake

Under the Network and Information Security Directive (NIS2), a customer is "essential" or "important" if they are in one of the Annex I or Annex II sectors AND they meet the size test (typically 50+ full-time-equivalent staff or 10 million euros turnover, with sector-specific exceptions). The Centre for Cybersecurity Belgium (CCB) owns the official mapping.

Concrete examples. Essential: a regional Belgian hospital; a municipal IT department; a bank; an electricity grid operator; a drinking water utility. Important: a regional food producer; a chemical wholesaler; a postal operator. Not in scope: a bakery; a marketing agency; a small law firm; a typical retailer.

If you are unsure but more than a few of your customers are in healthcare, public administration, banking, energy, water, transport, or digital infrastructure: select Yes. Our supply-chain analysis covers this in the report.

"Yes" means Multi-Factor Authentication (MFA) is enforced for every employee account on every sensitive system: Microsoft 365 (M365) or Google Workspace; Virtual Private Network (VPN); production access; admin panels; remote desktop. No silent exceptions.

"Partial" means MFA is enforced on some systems but not others (for example, M365 only), or for some users but not others (for example, admins only but not regular staff), or a mix of both.

"No" means MFA is optional, opt-in, or not enforced anywhere.

Answer honestly. This single question shows up on every vendor security questionnaire you will ever receive, and on every CyberFundamentals (CyFun) self-assessment the Centre for Cybersecurity Belgium (CCB) issues. The report will not penalise honesty, but it will flag any gap the auditor would also find.

Endpoint Detection and Response (EDR) and traditional antivirus are sometimes different products. Modern EDR examples: Bitdefender GravityZone, SentinelOne, Microsoft Defender for Endpoint (the licensed version, not the free one), CrowdStrike Falcon, Sophos Intercept X. If you have any of these centrally managed across your laptops and servers (with a console an admin or your Managed Service Provider logs into): answer Yes.

If you only have the built-in Windows Defender that ships with Windows, with no central management console, no policies pushed from a server, and no visibility for your IT team: that is closer to "partial" in practice. This form only accepts Yes or No here, so answer No and our report will flag the gap with a clear remediation step. The Centre for Cybersecurity Belgium (CCB) treats centrally managed EDR as the CyberFundamentals (CyFun) BASIC bar.

A "written" incident response plan is a document (one to ten pages is enough at the CyberFundamentals (CyFun) BASIC level). It names who is responsible for what during a security incident, who to call (internal team; customers if customer data is affected; the regulator if required), the timeline (Network and Information Security Directive (NIS2) essential entities have 24 hours for the early warning and 72 hours for the incident notification, sent to the Centre for Cybersecurity Belgium (CCB)), and the post-incident review step.

"Written" means in any durable format: a Word document, a wiki page, a Confluence page, a Notion page, a printed binder. If your plan is "in our heads" but not written down, or it lives only in someone's email signature, answer No. Honesty beats a false Yes here; the report's remediation step takes a few hours to close.