Your First 30 Days: Registration, Scope and Risk Assessment

More organisations than you would expect cannot answer this, because registration is a regulatory filing rather than an IT task and each side assumed the other did it.

• Ask whoever handles your regulatory filings, not your IT provider: the duty sits on the entity
• Look for a registration confirmation from the CCB in the mailbox of whoever signed it
• If nobody can produce a confirmation, work on the assumption that you are not registered
• Decide now who owns this filing from here on, by name

Article 13 paragraph 1 lists the information you have to supply. Collecting it is most of the work.

• Entity name and company number (KBO/BCE)
• Address and current contact details, including an email address and a phone number
• Your IP ranges: this one catches people out and usually needs your IT provider
• Your sector and subsector under Annex I or Annex II of the law
• The list of Member States where you provide services that fall in scope

The law does not name a platform. It says registration follows the practical arrangements the CCB determines, and the CCB runs this through its Safeonweb@work portal.

• Follow the CCB's own current instructions rather than any third-party write-up, this page included
• Register the entity, not the group, unless the CCB's guidance tells you otherwise
• Use a shared mailbox as the contact address, not a personal one
• Keep the confirmation somewhere your successor will find it

Your class follows from your sector and subsector together with your size. Write the answer down with the reasoning, because you will be asked for both.

• Find the Annex I or Annex II row that matches what you actually do, not what your VAT code says
• Apply the size thresholds to that row
• Write one page: the row you matched, the headcount and turnover you applied, the conclusion
• Have it read by someone who was not involved in writing it

Size is not the only route into scope.

• Under Article 11 the CCB can identify an entity as in scope regardless of size, for example where it is the sole provider of a service, where failure would carry systemic risk, or where it is critical for a region
• Under Article 12 you must hand over the information the CCB needs for that identification, on request
• The CCB maintains and revises its list of entities at least every two years
• If the CCB has identified you, your registration clock runs from that identification rather than from the general deadline

The dates live in the Royal Decree of 9 June 2024, not in the law itself.

• Essential entity: Article 22 paragraph 1 required a first verification by a CCB-authorised conformity assessment body, at CyberFundamentals level basic or important depending on your risk analysis, by 18 April 2026
• Essential entity: Article 22 paragraph 2 requires certification at the essential level by 18 April 2027, or a CAB verification at a lower level where Article 7 applies (the risk analysis justifies it)
• Essential entity on the inspection route instead: Article 23 sets a self-assessment on the same 18 April 2026 date, and a progress status by 18 April 2027
• Important entity: Article 41 of the law makes the assessment voluntary, and no date attaches to it
• Both classes: Article 23 paragraph 3 requires continuous improvement, which has no end date at all

Assets, systems, data, and the business processes that depend on them. This is the part people shortcut, and it is the part everything else is scored against.

• List the business processes that stop if a system is unavailable
• Map each process to the systems, data and suppliers it depends on
• Include software: CyberFundamentals Basic control ID.RA-01.1 asks for threats and vulnerabilities identified in all relevant assets, software included
• Note who owns each asset, because an asset with no owner gets no decision later

CyberFundamentals Basic control ID.RA-05.1 puts it plainly: risk is determined by threats, vulnerabilities and the impact on business processes and assets.

• Score all hazards, per Article 30 paragraph 5, not only the cyber ones: fire, flood, a key supplier failing and a key person leaving all count
• Use a scale you can defend out loud rather than a borrowed matrix nobody understands
• Record the reasoning next to the score, because the reasoning is what an assessor reads
• Let the result, not your preference, point at the CyberFundamentals level

An unapproved risk analysis is an unfinished one.

• Article 31 paragraph 1 puts approval of the risk-management measures on the management body, requires it to supervise implementation, and makes it liable for breaches of that obligation
• In a small company that is the director or the partners, not the IT provider
• Date the approval and record who gave it
• CyberFundamentals Basic control GV.RM-03.1 asks for an organisation-wide strategy to manage information and cybersecurity risk, updated when changes occur

Walk the controls at your target level and mark each one done, partly done, or not started.

• Basic is 34 controls, Important 133, Essential 218, cumulative: each level contains the one below it
• Mark honestly: a control that works but is undocumented is partly done, not done
• For an essential entity on the inspection route this is a real deliverable, not an exercise: Article 23 paragraph 1 of the Royal Decree put a self-assessment at basic or important level on the 18 April 2026 date
• Keep the evidence you already have as you go, rather than hunting for it twice

CyberFundamentals Basic control GV.PO-01.1 requires policies and procedures for managing information and cybersecurity to be established, documented, reviewed, approved, updated when changes occur, communicated and enforced.

• Put the review meetings in the diary now, with real dates, not "sometime this year"
• Have the person who will approve the outcome in the room, and name them in the invitation
• One meeting per policy area beats one meeting covering everything, because the second one overruns and gets cut short
• Record for each policy: the review date, the approver, and the outcome. That record is what you will be asked for

The gap list is the deliverable of the whole month, and it is the thing that makes the next stretch estimable.

• One row per gap, with an owner by name and a realistic date
• Separate the gaps your IT provider closes from the ones only you can close
• Put a rough cost against each one, so the list can be decided on rather than admired
• Agree when you will look at it again