Framework overlap

Does ISO 26262:2018 cover Belgium CyberFundamentals?

You hold ISO 26262:2018 and have been told to do Belgium CyberFundamentals. Here is how much overlaps, control by control.

43% of Belgium CyberFundamentals you already have

ISO 26262:2018 already covers about 43% of Belgium CyberFundamentals, leaving 25 of 44 controls as genuinely new work.

Already covered 0 Likely covered 19 New work 25

No control in ISO 26262:2018 maps directly to one in Belgium CyberFundamentals. Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in ISO 26262:2018 reaches these. This is the list to scope.

BE-CF-07
Boundary protection and segmentation
BE-CF-09
Denial-of-service protection
BE-CF-10
Transmission confidentiality and integrity
BE-CF-11
Session management controls
BE-CF-12
Network monitoring and defense
BE-CF-16
Threat intelligence integration
BE-CF-18
Incident response planning and testing
BE-CF-19
Incident handling and containment
BE-CF-28
Audit event logging and storage
BE-CF-29
Audit record review and analysis
BE-CF-30
Time synchronization
BE-CF-31
Audit log protection and retention
BE-CF-32
Accountability and non-repudiation
BE-CF-33
Asset management and data flow mapping
BE-CF-34
Business environment
BE-CF-35
Cybersecurity governance and policy
BE-CF-36
Supply chain risk management
BE-CF-37
Awareness and training
BE-CF-38
System maintenance
BE-CF-39
Data security lifecycle management
BE-CF-40
Recovery planning
BE-CF-41
Recovery improvements
BE-CF-42
Recovery communications
BE-CF-43
Assurance level selection and scoping
BE-CF-44
NIS2 alignment
Show the 19 you already have
BE-CF-01
Account management and provisioning
BE-CF-02
Access enforcement and least privilege
BE-CF-03
Multi-factor authentication requirements
BE-CF-04
Remote access controls
BE-CF-05
Wireless access restrictions
BE-CF-06
Identity proofing and verification
BE-CF-08
Cryptographic protection of data
BE-CF-13
Risk assessment procedures
BE-CF-14
Vulnerability scanning and management
BE-CF-15
Security categorization
BE-CF-17
Continuous monitoring strategy
BE-CF-20
Incident reporting and notification
BE-CF-21
Forensic analysis capabilities
BE-CF-22
Lessons learned and improvement
BE-CF-23
Baseline configuration establishment
BE-CF-24
Configuration change control
BE-CF-25
Security impact analysis
BE-CF-26
System component inventory
BE-CF-27
Software usage restrictions

How this is calculated

Already covered means a mapping runs from a control in ISO 26262:2018 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition