Clients asking about NIS2?
White-label NIS2/CyFun compliance platform for MSPs
Use our platform to get you and your clients audit-ready. Step by step, through CyFun (Cyber Fundamentals), the official framework for NIS2 compliance in Belgium, Cyprus, Ireland, Malta and Romania. You stay the expert; the busywork goes.
An MSP intern achieved 91% audit-ready in 11 weeks, working one day weekly
while also handling second-line helpdesk support
Why your clients (will) ask for NIS2 compliance
Since 2024, the EU law NIS2 requires about 4,000 Belgian companies (registered by January 2026) to prove protection against hackers. Your client doesn't need to be on that list to face the question.
- It comes down the supply chain. Those roughly 4,000 companies now have to ask the same of their own suppliers, and your client only needs to sell to one of them. The question arrives as a supplier questionnaire, and "we're fine" is not an answer to it.
- CyFun is the yardstick. An official, free checklist, written in Belgium and now shared by five EU countries. Not the only route to NIS2 (ISO 27001 is another), but the one most Belgian SMEs take.
- The requirement stops being your opinion. "You need MFA on every account" gets argued down every budget round. Backed by a control in CyFun, it is not up for debate. You stop selling security and start reporting against a standard.
- The clock is not theirs. Ignoring it can cost a company up to €10 million. Getting ready takes months, so the work starts long before anyone goes looking for an auditor.
You're already their IT provider. This isn't a new vendor for them to evaluate. It's the next step in what you already handle for them.
No extra hires. No new department.
Not a new department, but what you already handle for clients, presented differently.
What your clients pay for the platform, and what you resell
One fee per client, no base fee, no modules. Determined by the client's employee count. All CyFun levels, from Basic to Essential, are included, with no cost for switching.
Drag the total, or any row, to match your own book.
That is €2,435 per month of recurring revenue.
Recurring revenue you are not billing today, and the gaps it surfaces (MFA, backups, patching) become projects on top.
The requirement comes from the framework, not from you. You stop arguing for a security budget and start reporting against a standard.
| Band | Employees at that client | Clients | Per client / month | Subtotal |
|---|---|---|---|---|
| Nano | 1 – 4 | 0 | €49 | €0 |
| Micro | 5 – 12 | 1 | €99 | €99 |
| Core | 13 – 29 | 2 | €169 | €338 |
| Growth | 30 – 49 | 2 | €229 | €458 |
| Medium | 50 – 249 | 2 | €395 | €790 |
| Large | 250 – 999 | 1 | €750 | €750 |
| Enterprise | 1,000+ | 0 | — | — |
| Total | 8 | €2,435 | ||
Pre-pay monthly (MSRP), quarterly (−6%), six-monthly (−8%) or annually (−12%).
Plus €400 onboarding, once. That is for you, not per client: one guided session where we walk through the platform together. Adding a client is immediate, not a rollout. After that you move at your own pace, not ours. All amounts excluding VAT.
Connect a client's Microsoft 365 and stop chasing screenshots
Most of a CyFun Basic file is proving things that are already true inside the client's tenant: who has multi-factor switched on, which accounts are administrators, whether the old mail protocols are still open. ECP reads that straight from Microsoft 365 and files it against the right control, so the answer is waiting when the auditor asks for it.
Seventeen of the thirty-four Basic controls take their evidence straight from Microsoft 365. Three more if the client runs Defender for Endpoint.
Twelve separate checks look at identity
- ✓ whether the older mail protocols, which sign in with a password alone, are blocked
- ✓ whether administrators have actually set up a second factor, and were not merely asked to
- ✓ how many accounts hold full control of the tenant
- ✓ whether staff can approve third-party apps without an administrator
It reports what it finds, including when the answer is no. A failing check is evidence too. Some name the accounts involved, others report on a setting. Either way it reads as a task list rather than a score.
The platform identifies security gaps; remediation remains your responsibility.
It acts as a scoreboard, not a gym, showing you what is missing without doing the heavy lifting for you.
Platform vs. manual responsibilities
What the platform does
- Identifies missing controls so you know what is lacking.
- Provides remediation steps to guide your fixes.
- Drafts policy documents for your final review.
- Allows continuous re-checking to track progress.
What requires your involvement
- Enforcing technical controls (MFA, firewalls).
- Running backup drills to ensure resilience.
- Gathering auditor proof to verify compliance.
- Making policy decisions based on judgment calls.
Project breakdown & expectations
| Phase | Description & cost structure | Benchmark case study timeline |
|---|---|---|
| 1. Getting audit-ready | A dedicated project phase requiring manual setup and remediation. | 11 weeks total, averaging 1 day per week (based on a 5-person MSP: CyFun Basic with a sound baseline). |
| 2. Continuous compliance | A lighter, ongoing phase driven by automated integrations. | Tasks are limited to reviewing changes and re-approving documents. |
Expect to invest real time on both sides. The remediation tasks involve the same MFA, firewall, and backup work you already manage for clients, there is nothing new to learn.
How to resell this?
Reselling this to clients?
Partners buy below the rates above and invoice their own client under their own brand. It is a fixed percentage off the published card, the same for a partner with three clients as for one with fifty. We don't publish the number, because your clients read this page too. One rate card, the same for every partner, not negotiated. Ask for access and the card comes with my reply.
50 pages, free. Provide your work email, and the PDF is delivered immediately. Preview the opening chapters without obligation.
What MSP owners ask before they say yes
Is compliance expertise required?
The platform doesn't replace your judgment but eliminates the routine tasks. Automated features include control mapping, evidence collection, gap analysis, and audit packages. You handle scope, risk acceptance, and evidence quality. Solo CyFun consultants report this reduces their per-client hours by about 40-50%.
What do my clients see?
Your branding is featured on all reports, emails, and pages. Clients recognize you as the compliance expert.
Can I determine my own pricing?
Yes. We bill you per client. You set the price for your clients.
How do we begin?
Schedule a 20-minute call with Tom. He guides you through the platform, sets up your first client, and you launch the same week. No contract required.
What does "audit-ready" mean?
It means your client has documented evidence of security controls aligned with the CyFun framework. The actual audit is done by certified CAB auditors, not by us or you. Five bodies can verify CyFun at Basic and Important level today, and none is authorised for Essential yet, so those entities currently take the ISO 27001 route.
How is pricing structured?
A single fee per client, based on size, as shown in the table above. Plus a one-time €400 onboarding fee. No monthly base charge. Rates are billed monthly.
You select your term:
- Monthly
- Quarterly, 6% off
- Six-monthly, 8% off
- Annually prepaid (12% discount)
Larger volumes can be billed more frequently. Just let us know.
You set your own pricing. The table shows the end client's cost. Consider it a suggested retail price, guidance, not a requirement. Set rates based on your market. The difference between the partner rate and this price is designed to be favorable.
Every licence includes AI support. If you want a human involved, there is an optional ladder on top of it. Each rung includes the one below it:
- Guidance, €400 a quarter: unlimited AI support, five human-reviewed email questions a quarter, a one-hour onboarding session and a quarterly report
- Asynchronous advisory, €1,500 a month: email and WhatsApp, responded to within 24 hours
- Half a day a week, €4,500 a month: the above plus four hours of meetings a week
- One day a week, €7,000 a month: the above plus eight hours of meetings a week, on site or online
Guidance does not replace the one-time €400 onboarding.
Convert NIS2 into recurring revenue. No additional staff.
Request access, take the guide, or look at the demo first.
"I personally onboard every MSP partner to ensure we're the right fit."
Tom Janssens, Founder
20+ years across IT and innovation management, including Eurocontrol (the organisation behind European air traffic) and Belgian SMEs.