Most organisations aim to meet NIS2. Imelda decided to raise the bar. Rather than wait for the requirements to tighten step by step, the hospital skipped CyFun “Basic” and went straight for “Important”. The gamble paid off. With Cingulum by its side, Imelda became the first hospital to reach that level.
On the wards, doctors and nurses diagnose, treat and care for patients around the clock. Behind the scenes, Florin, CISO at Imelda, protects something just as vital, if far less visible: the patient data and the systems that hold it.
Few people realise that hospitals have a dedicated team for this. Imelda’s IT department has 24 people, and Florin leads on information security. His remit is broad: security policy, risk management, incident response, staff awareness and liaising with suppliers and regulators.
When Belgium transposed NIS2 into national law in 2024, hospitals were classed as essential entities. That meant one big decision lay ahead: which CyFun level to aim for. For Florin, the answer was clear.
“As a hospital, we handle extremely sensitive data. If our systems are compromised, it’s not only data at risk. Patient safety could be on the line too. Settling for Basic simply didn’t reflect what’s at stake. We wanted a level that proves we take our responsibility seriously, towards our patients, our staff and our partners.”
Cingulum guided Imelda through the process towards CyFun level Important. According to Florin, Cingulum didn’t just help tick boxes. Above all, it helped everyone understand the purpose behind each measure. The external audit followed on 8 April. Imelda achieved CyFun level Important, the first hospital to do so. Looking back, Florin says: “The audit was strict, but fair.”
The process changed how the hospital views security: “Security has become less of an IT matter and more of an organisation-wide theme. Everyone is involved and everyone contributed.”
For Imelda, this isn’t the finish line. Under the CCB’s current timeline, essential entities must demonstrate at least level Important by April 2027, and everyone must reach level Essential by April 2028. That gives Imelda a solid head start. In the coming period, the focus will be on further embedding processes, ongoing staff awareness and closer monitoring of suppliers.
Florin has a message for fellow CISOs who are unsure whether they need external support: “Don’t underestimate the process. A good external partner brings expertise and, above all, an outside perspective that’s hard to get on your own.”
What is CyFun?
Cyber Fundamentals (CyFun) is the Belgian framework of the Centre for Cybersecurity Belgium, with three levels: Basic, Important and Essential. Under NIS2, essential entities such as hospitals must demonstrate an increasing minimum level: Basic in 2026, Important in 2027 and Essential from 2028.
Want to know where your organisation stands on CyFun and NIS2? Get in touch with Cingulum.
