---
title: "Security rules and standards explained"
description: "Choose a rule or standard to understand its purpose, who may be concerned and which records or actions it involves. The text and drawing explain the same points."
url: https://www.alt-f1.be/en/frameworks/
organization: ALT-F1 SRL, Brussels (VAT BE 0830.560.718)
---

# Security rules and standards explained

Choose a rule or standard to understand its purpose, who may be concerned and which records or actions it involves. The text and drawing explain the same points.

## NIS2

*NIS2 — Directive (EU) 2022/2555*

Cybersecurity duties for organisations within the applicable scope, including management responsibility, risk measures and significant-incident reporting.

### Who is concerned

- Covered essential and important entities; sector, size and exceptions matter.
- Suppliers may face contract requirements without becoming directly covered on that basis alone.

### Main requirements

- Assign management responsibility and proportionate risk measures.
- For a significant incident, report without undue delay; an early warning is generally due within 24 hours of awareness and notification within 72 hours, with specific exceptions.
- Keep evidence, recovery plans and the required registration and reporting arrangements.

**Dates:** Belgian implementation applies from 18 October 2024. Check the relevant sector rules and incident conditions.

**Consequences:** Authorities can supervise measures and impose sanctions under the applicable national rules.

**Services:** [Device Shield](https://www.alt-f1.be/en/device-shield.md), [Web App Shield](https://www.alt-f1.be/en/web-shield.md), [Workshops](https://www.alt-f1.be/en/workshops.md)

[Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555)

## GDPR

*GDPR — Regulation (EU) 2016/679*

Rules for using and protecting information about identifiable people.

### Who is concerned

- Controllers decide the purposes and means of processing; processors act on their behalf.
- Customers, staff and website visitors can all have personal information in your systems.

### Main requirements

- Document why information is used, restrict access and set necessary retention.
- Apply security measures appropriate to risk and test recovery.
- Notify a breach where required; the 72-hour authority deadline runs from awareness, with the Article 33 risk exception. High-risk communication to people is a separate duty.

**Dates:** Applicable since 25 May 2018. Check the circumstances of each processing activity and breach.

**Consequences:** The authority can require corrective measures and impose fines; affected people may have a right to compensation.

**Services:** [Sovereign Storage](https://www.alt-f1.be/en/sovereign-storage.md), [Private AI](https://www.alt-f1.be/en/private-ai.md), [Web App Shield](https://www.alt-f1.be/en/web-shield.md)

[Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)

## DORA

*DORA — Regulation (EU) 2022/2554*

Digital operational resilience requirements for covered financial entities.

### Who is concerned

- Covered financial entities, such as banks, insurers and payment firms.
- Technology suppliers have contract obligations; designated critical providers also face a separate oversight regime.

### Main requirements

- Manage information and communication technology (ICT) risk and record responsibilities.
- Classify and report relevant incidents and test resilience.
- Manage supplier contracts, service records and exit arrangements.

**Dates:** Applicable since 17 January 2025. Requirements depend on entity type and the relevant provisions.

**Consequences:** Financial supervisors enforce the rules. Critical-provider oversight is distinct from a supplier’s ordinary contract duties.

**Services:** [Web App Shield](https://www.alt-f1.be/en/web-shield.md), [Device Shield](https://www.alt-f1.be/en/device-shield.md)

[Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554)

## CyberFundamentals

*CyberFundamentals — Centre for Cybersecurity Belgium*

A practical framework for selecting and assessing cybersecurity measures.

### Who is concerned

- Organisations seeking a structured security baseline or assurance level.
- The appropriate level depends on risk and scope, not simply company size.

### Main requirements

- Use the CCB selection method to identify an appropriate assurance level.
- Assess controls, document gaps and plan improvements.
- Use the relevant verification or certification process when assurance is required.

**Dates:** Check the current CCB framework, assurance scheme and selection tools before assessment.

**Consequences:** A chosen label does not replace every legal or contractual duty; its scope and assurance requirements must match the intended use.

**Services:** [Device Shield](https://www.alt-f1.be/en/device-shield.md), [Web App Shield](https://www.alt-f1.be/en/web-shield.md), [Sovereign Storage](https://www.alt-f1.be/en/sovereign-storage.md), [Workshops](https://www.alt-f1.be/en/workshops.md)

[Official source](https://atwork.safeonweb.be/tools-resources/cyberfundamentals-framework)

## ISO/IEC 27001 · 27002

*ISO/IEC 27001:2022 and ISO/IEC 27002:2022*

27001 sets requirements for managing information security. 27002 provides guidance on security controls.

### Who is concerned

- Organisations of any size or sector establishing a security management system.
- Suppliers whose contracts or customers require independent certification.

### Main requirements

- Assess risks and select controls with a statement of applicability.
- Assign responsibilities, review performance and improve the system.
- Certification is against 27001 within an agreed scope; using individual controls is not the same as certification.

**Dates:** 2022 editions; check applicable amendments and the certification scope.

**Consequences:** Certification is voluntary unless a contract or applicable requirement calls for it. An independent auditor assesses the management system.

**Services:** [Workshops](https://www.alt-f1.be/en/workshops.md), [Custom Software](https://www.alt-f1.be/en/custom-software.md), [Sovereign Code](https://www.alt-f1.be/en/sovereign-code.md), [Sovereign Storage](https://www.alt-f1.be/en/sovereign-storage.md)

[Official source](https://www.iso.org/standard/27001)

## AI Act

*AI Act — Regulation (EU) 2024/1689*

Risk-based duties for organisations that provide or use AI systems.

### Who is concerned

- A provider develops or supplies a system; a deployer uses it under its authority.
- Other roles, exceptions and risk categories affect the duties that apply.

### Main requirements

- Identify the role, intended use and risk category of the system.
- Build appropriate AI literacy among staff involved in the relevant use.
- Check prohibited practices, transparency and any high-risk requirements against the current rules.

**Dates:** Application is phased. Literacy and prohibited-practice rules apply from 2 February 2025; consult the current official timetable for other duties.

**Consequences:** Requirements and enforcement depend on the role, system and infringement. Local hosting does not remove them.

**Services:** [Private AI](https://www.alt-f1.be/en/private-ai.md), [Workshops](https://www.alt-f1.be/en/workshops.md)

[Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)

## Cyber Resilience Act

*Cyber Resilience Act — Regulation (EU) 2024/2847*

Cybersecurity duties for covered products with digital elements.

### Who is concerned

- Manufacturers of covered software or connected products.
- Importers, distributors and open-source stewards have distinct roles and conditions.

### Main requirements

- Design and maintain the product securely during the applicable support period.
- Keep component and vulnerability-handling records; an inventory requirement does not itself mean public release to every buyer.
- Assess conformity and reporting duties for relevant actively exploited vulnerabilities and severe incidents.

**Dates:** Article 14 reporting applies from 11 September 2026; most product obligations apply from 11 December 2027.

**Consequences:** Authorities can require corrective action and apply the relevant sanctions, including restrictions on non-compliant products.

**Services:** [Custom Software](https://www.alt-f1.be/en/custom-software.md), [Sovereign Code](https://www.alt-f1.be/en/sovereign-code.md), [Workshops](https://www.alt-f1.be/en/workshops.md)

[Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847)

Scope and obligations depend on the organisation, activity and current rules. Sources checked on 9 November 2026; consult the linked official text for your assessment.