Belgium's NIS2 law has applied since 18 October 2024, and essential entities face their next fixed deadline on 18 April 2027. The law does not name penetration testing as a mandatory control, but proving that your security measures actually work is very hard without it.
Belgium was one of the first member states to put NIS2 into national law, with the Law of 26 April 2024. Most of Europe missed the October 2024 transposition deadline. Belgium did not, and Belgian organisations have been living with the obligations for two years while their counterparts in other countries were still waiting for a text.
That head start has a consequence. Belgian deadlines are arriving first. Essential entities had to show they were on a conformity pathway by 18 April 2026. The next step, demonstrating measures equivalent to the Essential level of the CyberFundamentals framework, is due by 18 April 2027.
This summer the Centre for Cybersecurity Belgium's inspection service wrote to essential entities about that 2027 assessment, and cited developments in frontier AI as part of its reason for doing so. Regulators do not usually connect their deadlines to the attacker side of the picture that directly. It is worth taking the hint.
This piece sets out what the Belgian law asks for, how CyberFundamentals works, and where penetration testing fits in. I have worked in Belgian offensive security for more than a decade, and this is the version of the explanation I would want if I were a security lead at a Belgian mid-market company.
What does NIS2 require in Belgium?
The Belgian NIS2 law, completed by a Royal Decree of 9 June 2024, makes the Centre for Cybersecurity Belgium (CCB) the national cybersecurity authority. Registration closed on 18 March 2025 for most sectors. The CCB supervises both categories of entity, working with sectoral authorities where they are designated, such as the National Bank of Belgium for banking or the BIPT for digital infrastructure.
Essential and important entities carry the same security obligations. Article 30 of the law requires appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach. Incident reporting, management accountability and training apply to both.
The difference is supervision. Essential entities are subject to mandatory, regular conformity assessment against a reference framework. Important entities are supervised after the fact. They had no formal submission due in April 2026, but the CCB can ask for evidence at any time, for example after an incident.
That last point is easy to underestimate. An important entity that has never been asked for evidence still needs to be able to produce it, quickly, at a moment it did not choose.
What are CyberFundamentals, and what are the NIS2 deadlines in Belgium?
CyberFundamentals, or CyFun, is the CCB’s own reference framework, built on the NIST Cybersecurity Framework. It is not legally mandatory, but it is the route most Belgian entities take, because a conformity statement under it gives a presumption of conformity with NIS2. ISO/IEC 27001 is the other accepted framework, but it only counts if the certification’s scope covers the entity’s NIS2 activities and the CCB has validated that scope. Essential entities can also choose direct inspection by the CCB.
CyFun has four assurance levels: Small, Basic, Important and Essential. Basic and Important are confirmed by independent verification. Essential requires full certification by a conformity assessment body accredited by BELAC and authorised by the CCB.
- 18 October 2024: the Belgian NIS2 law comes into force for all entities in scope.
- 18 March 2025: registration deadline for most essential and important entities.
- 18 April 2026: essential entities must show an active conformity pathway, such as a Basic or Important verification.
- 18 April 2027: essential entities must demonstrate measures equivalent to CyFun Essential, or submit a remediation plan.
- 18 April 2028: latest date for entities on a remediation plan to reach the Essential level.
The CCB has been explicit that the 2026 step was a binding regulatory checkpoint, not a formality. There is no reason to expect it to treat 2027 differently.
Does NIS2 require penetration testing in Belgium?
Not by name. Neither the Belgian law nor the directive lists penetration testing as a mandatory control. But two requirements make it very hard to do without.
The directive requires you to assess whether your measures work. Among the minimum measures in NIS2 Article 21, which the Belgian law transposes, are policies and procedures to assess the effectiveness of your cybersecurity risk-management measures. A policy document does not show that a control works. A test that tries to get past it does.
CyFun requires vulnerability scanning that leads somewhere. Its control ID.RA-01 requires organisations to identify, validate and record vulnerabilities, with continuous scanning from the Important level and penetration testing at the Essential level. It also suggests considering a continuous scanning programme.
Scanning tells you what might be wrong. It does not tell you whether an attacker could actually use it, or what they would reach if they did. That is the gap penetration testing fills, and it is the evidence an assessor finds most convincing, because it shows a control holding up under an attempt to defeat it.
What should a Belgian company test before its NIS2 assessment?
The question an assessor will ask is not whether you tested, but whether you tested the things that matter. In my experience, Belgian mid-market companies tend to test the perimeter they know about and miss the rest. Four areas are worth checking against last year's scope.
- Everything customers and partners log into. Portals, web applications, APIs and mobile apps. Many NIS2 entities in logistics, manufacturing and energy now run customer or field apps that were never in a test scope because they were seen as a channel, not a system.
- The authenticated application, not just the login page. A test that cannot hold a session reports on the small public part of an application and calls it coverage. Ask your provider what they could reach after logging in.
- What changed since the last test. New services, migrations, integrations and old systems that were never switched off. NIS2 measures have to be proportionate to the risk you actually run today, not the risk you ran when the scope was written.
- Whether fixes held. A finding closed in a ticket is not the same as a vulnerability that is gone. Retesting is the evidence that remediation happened, and it is worth having before anyone asks for it.
None of this needs to wait for the assessment window. The organisations that will find 2027 easiest are the ones whose testing evidence is already current when the assessor asks.
What this does and does not settle
This is a testing view, not legal advice. Whether you are essential or important, which framework you choose and what your risk assessment supports are decisions for your own compliance and legal teams, and the CCB's guidance is the authority on all of them.
Testing is a small part of NIS2. Governance, incident reporting, supply chain security, training and business continuity all sit alongside it. Good testing evidence helps an assessment. It does not pass one.
No single test gives you the Essential level. CyFun Essential is a certification of an organisation's whole set of measures. Anyone selling a product as a shortcut to it is overselling.
Where Deus Rex sits
Deus Rex runs penetration testing across web, APIs, iOS and Android, with findings confirmed by exploitation and the evidence attached. Because it can run on each release rather than once a year, the testing evidence in your NIS2 file reflects the systems you are running now, and retesting a fix is a rerun rather than a new engagement.
Its roots are Belgian. Cyrex was founded in Belgium and spent twelve years doing offensive security work from here for studios and enterprises across Europe and beyond. Deus Rex grew out of that work, and we know the Belgian market, its regulator and its pace from the inside.
If your 2027 assessment is on the calendar and your last test is more than a release cycle old, that is a good moment to talk.
deusrex.ai
Written by
Tim De Wachter
CTO Deus Rex
