Does Belgium CyberFundamentals cover C2M2?

100% of C2M2 you already have

Belgium CyberFundamentals already covers about 100% of C2M2, leaving 0 of 22 controls as genuinely new work.

Already covered 0 Likely covered 22 New work 0

No control in Belgium CyberFundamentals maps directly to one in C2M2. Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in Belgium CyberFundamentals reaches these. This is the list to scope.

Nothing. Every control is reached.

Show the 22 you already have

ACCESS-1

Establish and Maintain Identities

ACCESS-2

Control Logical and Physical Access

ARCH-1

Establish a Cybersecurity Architecture Strategy

ARCH-2

Implement Network Protections

ARCH-3

Implement Data Security

ASSET-1

Manage IT and OT Asset Inventory

ASSET-2

Manage Asset Configuration and Changes

PROGRAM-1

Establish and Maintain the Cybersecurity Program

RESPONSE-1

Detect and Analyze Cybersecurity Events

RESPONSE-2

Respond to and Recover from Cybersecurity Incidents

RESPONSE-3

Plan for Continuity of Operations

RISK-1

Establish a Cyber Risk Management Strategy and Program

RISK-2

Identify and Analyze Cyber Risk

RISK-3

Manage and Respond to Cyber Risk

SITUATION-1

Perform Logging and Monitoring

SITUATION-2

Establish and Maintain a Common Operating Picture

THIRD-1

Identify and Manage Third-Party Risk

THIRD-2

Manage Supplier Relationships and Incident Notification

THREAT-1

Identify and Respond to Cyber Threats

THREAT-2

Reduce Cybersecurity Vulnerabilities

WORKFORCE-1

Establish Cybersecurity Responsibilities and Workforce

WORKFORCE-2

Develop Cybersecurity Workforce and Awareness

How this is calculated

Already covered means a mapping runs from a control in Belgium CyberFundamentals to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair · Today's edition