Blog (NO-INDEX)

4 phases of an ISO27001 Information Security Management System implementation. - Toreon - Business driven cyber consulting

Laurent Dupont — Tue, 05 May 2026 22:00:00 GMT

More and more companies are seeing the value of obtaining an ISO27001 certificate. After all, there are continuously new cyber threats and attacks and more and more legislation and certain sectors require companies to implement specific security standards. A security certificate is therefore becoming a key business enabler.

The digital security coaches of Toreonsupport you in implementing an ISO27001 Information Security Management System (ISMS) in your organization. Such a process consists of 4 phases.

Shaping your ISMS
Implementing ISO27001
Monitoring and controlling your ISMS
Improvement and certification

Phase 1: Shaping your ISMS

With the help of our consultant, we will draw up the necessary documentation (security policy, processes, instructions) so that the requirements of the standard can be translated into a ‘security operating model‘ tailored to your organization.

This happens in practice in 2 steps.

The consultant draws up a first version of the documentation, based on the security risk assessment results and the Toreon document database. This database contains many examples of detailed ISMS documents, which the coach can use to create efficient and qualitative documentation for you.
Then the feedback from your stakeholders is processed, after which the coach sets up an ISMS, with documents tailored to your company. The 80/20 rule applies here. 80% of the documentation is sector-specific, as the same measures often recur, and 20% is organization-specific.

Phase 2: Implementing ISO27001

In phase 2, your consultant coaches you to technically and operationally implement technical controls that were determined in the first phase.

In this phase, you take charge of the ISO27001 implementation process, applying all processes and controls. Toreon’s high-tech security experts are available to support you. The goal is to make your security officer self-reliant so that he can maintain the system himself. In this phase, Toreon also provides ‘security awareness‘ sessions to communicate all new security requirements to all your employees.

Phase 3: Monitoring and controlling your ISMS

Toreon performs a first internal audit to check if you are ready to obtain the ISO27001 certificate. Such an internal audit is also a hard condition to obtain your certificate. This audit is done by consultants who were not involved in the implementation of your ISMS, to ensure sufficient objectivity and neutrality.

The consultants use the same method as external auditors, in accordance with the requirements of ISO19011. In this way, your organization is optimally prepared for an external certification audit.

Setting up an ISMS

Phase 4: Improvement and certification

The non-conformities that have come to light from the internal audit must be eliminated before your organization can be certified. Toreon coaches you on this and at the same time helps you to administratively plan the certification. Your consultant is also present during the external audit to talk to the auditors. Toreon’s consultants have experience in external audits and know very well what external auditors expect and can translate their expectations to the measures implemented by the organization.

Download our product sheet and learn more about our methodology!

Cyber Security Challenge - Toreon - Business driven cyber consulting

Less than a minute — Tue, 14 Apr 2026 22:00:00 GMT

The Cyber Security Challenge Belgium has been founded in 2015 and is co-organized by Toreon and Nviso and wants to demonstrate the potential of a career in cyber security and make students more “cyber security aware” in order to help build a more cyber secure economy and society.

In 2020 alone, the Challenge has attracted over 700 students – a number that has increased at each edition – and has become one of the essential cyber events for the industry and the academic world.

More about social responsability

KMO Portefeuille - Toreon - Business driven cyber consulting

Less than a minute — Tue, 07 Apr 2026 22:00:00 GMT

Toreon is een trotse partner van VLAIO, en maakt cyberbeveiliging toegankelijker voor kleine en middelgrote ondernemingen met subsidies tot 50%

Bent u een Vlaamse KMO? Dan komt u in aanmerking voor subsidies van de Vlaamse overheid wanneer u adviesdiensten of opleidingen van Toreon aankoopt. Toreon is een geregistreerde leverancier van adviesdiensten en opleidingen in het kader van de KMO-Portefeuille.

Wat is de KMO-Portefeuille?

De KMO-Portefeuille zijn subsidies die worden toegekend door het Vlaams Agentschap voor Innovatie & Ondernemen. Het doel van deze subsidie is om de groei van Vlaamse KMO’s te ondersteunen. Deze subsidies kunnen enkel worden toegekend wanneer u diensten afneemt bij KMO-Portefeuille geregistreerde dienstverleners.

Kom ik in aanmerking?

De volgende entiteiten komen in aanmerking voor KMO-Portefeuille subsidies. KMO’s & Vrije beroepen die:

Gevestigd zijn binnen Vlaanderen
Deel uitmaken van de privésector (minder dan 25% is in handen van een administratieve overheid)
Een aanvaardbare hoofdactiviteit hebben
Voldoen aan de regelgeving van het Vlaamse Gewest

Hoeveel subsidies kan ik krijgen?

Het bedrag van de subsidies die u kunt krijgen, hangt af van de grootte van uw organisatie.

Grootte van de organisatie

Criteria

Subsidies %

Max subsidies/jaar

Klein

Minder dan 50 werknemers

Minder dan 10 miljoen jaaromzet

Minder dan 10 miljoen op de balans

45%

€ 7.500

Middelgroot

Minder dan 250 werknemers

Minder dan 50 miljoen jaaromzet

Minder dan 43 miljoen op de balans

35%

€ 7.500

Hoe kan ik mijn KMO-Portefeuille subsidie aanvragen?

U kunt uw subsidies aanvragen via een gebruiksvriendelijke webapplicatie die toegankelijk is op de volgende website: http://kmo-portefeuille.be/. De volgende informatie is nodig om een aanvraag in te dienen voor KMO-Portefeuille steun.

Dienstverlener	Toreon BV
Registratienummer	DV.A219933
Offertenummer	8022386775

Wil je nog meer weten over de KMO-Portefeuille?

VLAIO KMO-Portefeuille

Break-Glass Access done right: Why YubiKeys are essential for secure emergency access - Toreon - Business driven cyber consulting

Jordan Hardy — Wed, 18 Mar 2026 23:00:00 GMT

Microsoft allows customers with complex environments or technical barriers to postpone the enforcement of Phase 2 for their tenants until July 1st, 2026. Toreon can configure break-glass accounts to be protected by YubiKeys. These keys are becoming a best practice for resilient, audit-ready organizations.

Get in touch with our experts for a no-obligation advisory conversation.

Contact an expert

Get in touch with our experts for a no-obligation advisory conversation.

Contact an expert

When security meets reality: The Break-Glass dilemma

Every organization plans for continuity. Yet when a real incident hits — ransomware, identity system failure, or privileged account lockout — theory meets reality fast.

Emergency or break-glass accounts are designed for exactly these moments. But here’s the uncomfortable truth:

many break-glass setups today are either too weak to be secure or too risky to ever use confidently.

Also, Microsoft has defined July 1st, 2026 as end date for customers to postpone the MFA enforcement of Phase 2 for their tenants. This implies that Brek the Glass accounts will have to be onboarded in MFA as well.

Why traditional Break-Glass Accounts fall short

Security vs. accessibility is a false trade-off

Legacy emergency access models were built around convenience, not threat reality. Common issues include:

Password-based access that can be stolen, reused, or leaked
Emergency accounts quietly becoming backdoors
No clear ownership, audit trail, or activation workflow
MFA being disabled “temporarily” — and never re-enabled

In modern threat landscapes, these weaknesses are no longer theoretical. They are actively exploited.

The shift to hardware-based emergency access

Security teams are increasingly aligning emergency access with the same zero-trust principles applied elsewhere — without sacrificing availability.

At the center of this shift: hardware-backed authentication.

By protecting break-glass accounts with dedicated YubiKeys, organizations eliminate entire classes of risk that passwords and software-based MFA simply can’t address.

Break the Glass with YubiKeys: A secure-by-design approach

Emergency Access without everyday risk

A YubiKey-based break-glass solution is designed around one principle:

privileged access must exist — but only when absolutely necessary.

Key characteristics include:

Dedicated emergency-only accounts, fully isolated from daily operations
One YubiKey per account, enforcing phishing-resistant authentication
Offline, tamper-evident storage to prevent silent misuse
Clear activation procedures that remove ambiguity during incidents

This ensures emergency access is available, controlled, and auditable — all at once.

Phishing resistance where it matters most

Why FIDO2 changes the game

Break-glass accounts are high-value targets. That’s why protecting them with FIDO2-based YubiKeys matters:

No passwords to steal
No credentials to phish
No replay attacks
Physical presence required

Even during chaos, access can only be activated by authorized individuals holding the actual hardware key.

That’s not just stronger authentication — it’s enforced intent.

Governance, compliance, and audit readiness built in

Security teams need Proof, not promises

Emergency access must stand up to audits, regulators, and internal governance — especially after an incident.

A well-designed YubiKey break-glass setup supports this by default:

Every activation is logged and reviewable
Dual custody and approval workflows are clearly defined
Regular validation ensures readiness without exposure
Optional monitoring and alerting integrate with existing security tooling

The result: confidence before, during, and after an incident.

From Theory to Practice: How Secure Break-Glass Works

A Structured, Tested, and Documented Process

A mature approach to break-glass access includes:

Provisioning Hardened emergency accounts, each protected by a dedicated YubiKey.
Secure custody Clear guidance on offline storage, sealing, and audit procedures.
Ongoing assurance Periodic testing and validation without increasing risk exposure.
Incident response A defined workflow for activation, alerting, and post-incident review.

This turns emergency access from an uncomfortable necessity into a controlled security capability.

The Toreon fixed price offering

Break‑glass account credentials package
One YubiKey per account
Operational runbook for emergency activation

€ 1950,00

About the Author:

Lorem Ipsum …

Ready to see how your company can benefit?

Get in touch with our experts for a no-obligation advisory conversation.

Contact an expert

Upcoming Events/Webinars

Connect-IT

You can find us at Connect-IT in May. Our HR team will help you explore new career opportunities and show you what working at Toreon is like.

2026: The Year Cyber Compliance Becomes Mandatory - Toreon - Business driven cyber consulting

Jordan Hardy — Thu, 19 Feb 2026 23:00:00 GMT

For many Belgian organizations, 2026 is the year where cybersecurity compliance moves from “important topic” to “non‑negotiable business requirement.” NIS2 and the Cyber Resilience Act (CRA) sit at the center of this shift, with other EU regulations tightening the pressure around them.

This article zooms in on NIS2 and CRA—their deadlines, scope, and impact on Belgian companies—while briefly highlighting DORA, the AI Act and GDPR where they intersect. Where we see unclear or conflicting information in public sources, we call it out explicitly so you can plan with eyes wide open.

Get in touch with our experts for a no-obligation advisory conversation.

Contact an expert

Get in touch with our experts for a no-obligation advisory conversation.

Contact an expert

1. NIS2 in Belgium: 2026 is the first big test

Belgium is one of the few EU countries that fully transposed NIS2 on time. The Belgian NIS2 law (Law of 26 April 2024) entered into force on 18 October 2024 and replaces the former NIS1 Act. From that date, in‑scope entities must implement minimum security measures and report significant incidents to the Centre for Cybersecurity Belgium (CCB).

1.1 Key NIS2 dates in Belgium

Milestone	Date	What it means for you
Law in force	18 Oct 2024	NIS2 obligations apply; incident reporting to CCB becomes mandatory.
Registration (most entities)	18 Mar 2025	Essential and important entities registered via Safeonweb@Work.
Registration (digital providers)	18 Dec 2024	Cloud, data centres, MSP/MSSP, online platforms register earlier.
First verification deadline	18 Apr 2026	Basic/Important CyFun verification or equivalent ISO 27001 progress.
Certification for essential entities	18 Apr 2027	Essential entities must hold full certification (in case of CyFun Essential assurance level or ISO 27001).

1.2 Who falls under NIS2 in Belgium?

NIS2 applies to companies active in “highly critical” and “critical” sectors. Whether you are an “important” or “essential” entity depends on a combination of the sector you’re in and the size of the company, from a headcount or financial perspective.

Sector & size logic (Belgium)

Large company: Staff headcount of at least 250 FTEs OR (> € 50 m annual turnover AND > €43 m annual balance sheet total).

Medium-sized company: Staff headcount of at least 50 FTEs OR (> € 10 m annual turnover AND > € 10 m annual balance sheet total).

Sector	Size	Category
Highly Critical Energy, healthcare, drinking/waste water, digital infrastructure, public admin, transport infrastructure, banking & FMIs, space.	Large company	ESSENTIAL
Medium-sized company	IMPORTANT
Critical Postal/courier, waste management, chemicals, food production, manufacturing (incl. medical devices & electronics), digital providers, research.	Large company	IMPORTANT
Medium-sized company	IMPORTANT

Directly named sectors in the Belgian law include energy, banking, healthcare, water treatment, digital infrastructure, public administrations and operators of transport infrastructure such as ports, airports and rail infrastructure—not every individual transporter.

Remark: Micro and small entities can still be scoped in if they are the sole provider of an essential service in each Member State or play a key role in critical supply chains.

1.3 What NIS2 actually expects by April 2026

By 18 April 2026, Belgian NIS2 Essential entities must be able to prove that they have implemented a baseline of security controls and governance. The CCB recognizes several routes: whether you choose the ISO- or CyFun route, companies need to demonstrate they have taken the CyFun Controls into account.

The CyFun controls you must implement are based on the CyFun assurance level you need to reach and this is determined based on a risk assessment. The CCB has prepared a risk assessment tool which contains the initial risk analysis per sector, based on relevant incident and threat information. This spreadsheet can be downloaded from the Safeonweb at work portal. In case you alter the default values and receive a lower CyFun assurance level, you must provide substantial evidence validated by management to support your case. It is the assurance level based on this risk assessment that determines the next steps.

The CyberFundamentals levels referred to in the table below reference the target CyFun, not the NIS2 entity level. As an example: you may be a NIS2 Essential entity, but have a CyFun assurance level of important. As an essential entity, you must submit evidence by April 18th 2026 and 2027, but the assurance level is considered to determine whether you need a CyFun “verification” or “certification”. NIS2 important entities do not need to provide evidence by these two dates, but do need to comply with the law, of course. Verification or certification is voluntary for these entities.

Route	2026 requirement	2027 requirement
CyberFundamentals – Basic	Basic verification by 18 Apr 2026.	Maintain verification; may need to step up to Important/Essential later.
CyberFundamentals – Important	Basic or Important verification by 18 Apr 2026.	Important verification by 18 Apr 2027 if not already obtained.
CyberFundamentals – Essential	At least Basic/Important verification by 18 Apr 2026.	Essential certification by 18 Apr 2027.
ISO 27001	Submit scope (must be entire company) + Statement of Applicability (SoA) of future certification + internal audit report to show compliance with at least CyFun Basic to CCB by 18 Apr 2026.	Achieve full ISO 27001 certification by 18 Apr 2027.
CCB / sector inspection	Demonstrate compliance during inspection (more bespoke approach).	Follow inspection findings and possible follow‑up audits.

All verifications and certifications need to be executed by a CAB (Conformity Assessment Body) accredited by the CCB. The list of accredited CABs can also be found on the Safeonweb at work portal.

Core obligations behind the badges (simplified):

Governance: board accountability, risk management, security policy, cyber KPIs.
Protection: access control, network segmentation, secure configuration, awareness.
Detection & response: incident detection, playbooks, crisis management, reporting within 24h/72h/30 days using CCB templates.
Supply chain security: demonstrable security expectations for suppliers and MSPs.

The CyFun® framework is now explicitly embedded in Belgian law as a way to “assume, until proven otherwise,” NIS2 compliance when the required level is achieved. Directors are personally liable in case of serious failures and can face significant fines.[4][6][5]

1.4 Penalties and management liability

The Belgian NIS2 regime foresees serious sanctions for persistent non‑compliance:[6][28]

Essential entities: up to €10 million or 2% of global annual turnover, whichever is higher.
Important entities: up to €7 million or 1.4% of global annual turnover.
Management can be temporarily banned from exercising managerial functions in serious cases.[28][4][6]

For many boards, NIS2 is the first time cyber risk has been translated directly into personal legal exposure.

2. The Cyber Resilience Act: product security becomes a legal obligation

Where NIS2 focuses on organizational resilience, the Cyber Resilience Act (CRA) targets the security of products with digital elements—from software and IoT to connected industrial systems.

2.1 CRA timeline: 2026 is about reporting

The CRA entered into force in December 2024 but applies in phases.

CRA milestone	Date	What changes
Entry into force	10–11 Dec 2024	CRA is on the books; transitional period starts.
Reporting obligations (Article 14) apply	11 Sep 2026	Mandatory vulnerability & incident reporting for manufacturers.
Full CRA applicability	11 Dec 2027	All CRA obligations enforceable; non‑compliant products cannot be placed on EU market.

2.2 Who must care about CRA?

The CRA applies to manufacturers, importers and distributors that place “products with digital elements” on the EU market. This includes:

Software vendors that create mobile or desktop applications .
Manufacturers or vendors of embedded devices, such as consumer IoT, toys with bluetooth connectivity, industrial control systems or sensors or network appliances. ).
Unlike NIS2, CRA does not use size thresholds—small vendors are still in scope if their products fall under the definition.

2.3 CRA reporting from September 2026: new operational pressure

From 11 September 2026, CRA introduces strict, non‑negotiable reporting timelines once a manufacturer becomes aware of an actively exploited vulnerability or serious incident affecting their product.

CRA reporting obligation	Timeline after awareness	Scope
Early warning to ENISA & national CSIRT	Within 24 hours	Actively exploited vulnerability or severe incident affecting product security.
Detailed notification	Within 72 hours	Technical details, affected products, mitigation measures, impact assessment.
Final report – vulnerabilities	Within 14 days after fix/mitigation	Root cause, remediation, deployed updates, lessons learned.
Final report – severe incidents	Within 1 month after resolution	Broader impact analysis and improvements.

Importantly, this obligation covers all in‑market products, including legacy solutions. There is no “grandfathering” of older software or devices.

2.4 CRA: security by design, SBOMs and documentation

Beyond reporting, CRA pushes three major long‑term shifts in how products are built and maintained:

Security by design & by default across the full product lifecycle (from design through updates and end‑of‑life).
Vulnerability handling process: proactive discovery, timely fixes, secure updates, and clear communication to users.
Technical documentation: including risk assessments, update policies, and often a Software Bill of Materials (SBOM) to support transparency and vulnerability management.

For many Belgian software and hardware vendors, CRA is the first regulation that explicitly connects engineering practices, product management, and legal compliance.

3. NIS2 vs CRA: complementary, not competing

NIS2 and CRA are often mentioned in the same breath. They are indeed part of the same EU strategy but solve different problems.

Aspect	NIS2 (Belgium)	Cyber Resilience Act (CRA)
Primary focus	Organizational cybersecurity & service continuity.	Security of products with digital elements.
Main addressees	Operators of essential and important services (entities).	Manufacturers, importers, distributors of digital products.
Scope logic	Sector + size thresholds; some exceptions for critical players.	Product classification (criticality, use, connectivity).
Key 2026 trigger	18 Apr 2026: CyFun/ISO verification deadline.	11 Jun 2026 + 11 Sep 2026: CAB notification & reporting duties.
Reporting destination	National CCB (Safeonweb@Work).	ENISA + national CSIRTs.
Typical Belgian examples	Hospitals, utilities, banks, public administrations, large logistics hubs, cloud-providers.	Software vendors, IoT manufacturers, industrial equipment makers, connected consumer products.

For many mid‑sized Belgian tech companies, both will apply. Example:

A SaaS vendor operating a cloud platform that processes data from products with digital elements may be in scope under NIS2 (digital provider + supply chain) and CRA (product with digital elements).

In that case, NIS2 shapes how you secure your organization, while CRA shapes how you design, maintain and support your product.

4. Other 2026 regulations in the background

While NIS2 and CRA take center stage for most Belgian organizations, three other regulations deserve a place on your 2026 radar.

4.1 DORA – for financial services and their ICT suppliers

The Digital Operational Resilience Act (DORA) has applied since 17 January 2025 and sets uniform rules for ICT risk management, incident reporting, resilience testing and third‑party risk in financial services.

Scope includes banks, insurers, payment institutions, investment firms, funds and critical ICT third‑party providers.
Belgian entities are supervised mainly by the NBB and FSMA.
DORA penalties in several EU countries go up to the higher of €5–10 million or a percentage of turnover; Belgium sits mid‑pack with significant, but proportionate, fines.

For Belgian FinTech’s and ICT providers with financial clients, DORA and NIS2 will increasingly be discussed in the same RFPs and audits.

4.2 AI Act – 2026 is go‑live for high‑risk AI

The AI Act entered into force in 2024; most obligations for high‑risk AI systems (e.g. credit scoring, certain HR tools, remote biometric identification) will apply from August 2026.

High‑risk systems must meet requirements on risk management, data governance, transparency, human oversight, and robustness.
Fines can reach up to €35 million or 7% of global turnover for prohibited practices.
For Belgian organizations, the DPA and sector regulators are expected to share enforcement, but the exact institutional set‑up is still emerging.

4.3 GDPR – faster procedures, focused actions

GDPR itself doesn’t change in 2026, but enforcement dynamics do:

A new GDPR Procedural Regulation streamlines cross‑border enforcement with indicative 15‑month resolution timelines (extendable for complex cases).
The 2026 coordinated enforcement action at EU level focuses on transparency obligations (Articles 12–14), which will impact how Belgian organizations draft notices and communicate with data subjects.

In practice, this means GDPR investigations should become faster and more predictable—while still potentially costly.

4.4 CER-Law

On 18 December 2025, Belgium adopted the CER Law, implementing the European CER Directive to strengthen the resilience of critical entities and essential services. The law establishes a harmonized framework to protect against natural, accidental, and intentional threats. It requires

risk assessments at both sectoral and entity level;
identification of critical entities and infrastructure;
resilience planning;
and information-sharing procedures.

The National Crisis Center coordinates its implementation. The NIS2 Directive stipulates that all critical entities falling under the CER Directive are automatically designated as essential entities under NIS2. This means that if you are currently classified as an important entity under NIS2, you could still become an essential entity if you meet the criteria of the CER framework.

However, CER excludes obligations that are already covered under NIS2 and does not apply to the digital infrastructure or the financial sector.

It is expected that the list of companies which need to comply with the CER law will be drawn up by July 2026.

5. How Belgian organizations can move from “reaction” to “strategy”

Given the overlapping timelines, the key is to avoid treating each regulation as a separate project. The most effective Belgian organizations are doing three things:

Scope once, use many times

Map your business against NIS2, CRA, DORA, AI Act and GDPR in a single exercise. Identify which entities, products and processes sit at the intersection (e.g. a SaaS product used by a bank and classified as high‑risk AI).
Build on a strong backbone (CyFun & ISO 27001)

Use CyberFundamentals and/or ISO 27001 as your common governance backbone. Both align closely with NIS2, support DORA and CRA preparation, and give you a consistent way to show your board and regulators that you’re in control. But if you are working in an international context, the ISO-route is certainly preferrable.
Integrate product security early

For CRA‑relevant companies, assess your development practices using OWASP SAMM and build a roadmap towards a secure development lifecycle. This will allow you to gradually bring threat modeling, SBOMs and secure development practices into the SDLC now, not in late 2026, making CRA compliance a natural outcome of your engineering processes rather than a bolt‑on.
Use available support

In Flanders, VLAIO subsidies—and specific programs developed with partners like Toreon—can cover a significant portion of the cost of your NIS2‑driven security improvement trajectory. Sectoral initiatives like the CYSSDE EU pentesting program further help critical entities strengthen their posture at reduced cost.

If you’re unsure whether NIS2, CRA—or both—apply to your organization, the worst option in 2026 is to wait. Determining your scope, mapping your gaps and building a realistic roadmap now will cost far less than rushing to catch up under regulatory pressure later. Toreon is a selected partner of VLAIO to support these trajectories and has already accumulated over 100 projects subsidized by VLAIO.

Learn more about the VLAIO-subidies

Get in touch with our experts for a no-obligation advisory conversation.

Contact an expert

Upcoming Events/Webinars

Connect-IT

You can find us at Connect-IT in May. Our HR team will help you explore new career opportunities and show you what working at Toreon is like.

Grid Congestion, Risk Assessment & Resilience: How Governance Secures Business Continuity

Jordan Hardy — Tue, 27 Jan 2026 23:00:00 GMT

The recent meeting with Flux50 members on grid congestion, risk assessment, and building resilient energy systems shows that these themes are inextricably linked. The challenges in the Flemish (and broader European) energy landscape are no longer hypothetical: grid congestion is no longer a question of “if,” but of “when.” Companies are facing a rapidly changing grid, growing electrification, an increase in renewable energy, and aging infrastructure. The consequences of these developments affect not only business continuity, but also economic growth and the competitiveness of entire regions. Our Business Area Lead Consultant, Vincent Haerinck, represented Toreon at the meeting.

The Link Between Grid Congestion and Risk

Grid congestion means that, at peak times, the electricity grid can no longer cope with demand or supply. This leads to waiting times for new connections, limitations on expansions, and potential production losses. As the speakers pointed out, this has a direct economic impact: companies that cannot expand or produce lose revenue and competitive strength. Examples from the Netherlands clearly show that Flanders is not immune to this issue.

Building Resilience: Practical Solutions

The use of batteries, smart control systems, and hybrid solutions was discussed as a way to protect business processes against grid outages or peak loads. However, technology is only one side of the story. Properly sizing backup systems, identifying critical assets, and anticipating future energy needs require a well-thought-out approach. This is where governance comes into play.

The Importance of Governance in Risk Assessment

The core message from the risk assessment segment is that solid governance is essential not only to identify risks, but also to manage them structurally. This means:

Working with formal or semi-formal risk management systems (for example, in line with ISO standards)
Periodically evaluating risks and adjusting plans to changing circumstances
Risks are not limited to cybersecurity alone; due to the increasing digitalization of platforms and control systems across all components of production equipment, this can no longer be overlooked when safeguarding production capacity and overall business operations
Involving all stakeholders: from CEO to plant manager, each with their own risk profile and priorities
Assigning clear roles, responsibilities, and resources
Striving not only for compliance, but also for trust and resilience

Risk management is not a one-off exercise, but a continuous, iterative process that enables companies to remain flexible and resilient. Without this governance, even the best technology is insufficient to guarantee business continuity.

Conclusion: From Reactive to Proactive

The common thread throughout the meeting? Successful companies do not wait for things to go wrong; they invest in governance, risk management, and resilience before it becomes necessary. By addressing grid congestion, risk, and resilience in an integrated way and embedding them in business operations, organizations can not only absorb disruptions, but also gain strategic advantage from the energy transition.

Want to know how to concretely embed governance and risk assessment in your organization?

Get in touch with our experts for a no-obligation advisory conversation.

Contact an expert

About the Speaker: Vincent Haerinck

Vincent Haerinck is a Principal Consultant at Toreon, an Antwerp-based cyberconsulting firm. With a deep focus on industrial cybersecurity, Vincent specializes in bridging the gap between Operational Technology (OT) and Information Technology (IT). He helps organizations navigate complex security challenges, ranging from supply chain security to compliance with emerging European regulations like NIS2 and the Cyber Resilience Act (CRA).

Artes Group Boosts Cyber Resilience with Red Teaming | Toreon

Jordan Hardy — Sun, 18 Jan 2026 23:00:00 GMT

Artes Group is a construction consortium that includes various sister companies covering all key domains, from civil engineering, hydraulic engineering to petrochemistry, buildings and restoration. The group prides itself on challenging construction assignments and unique construction sites, requiring both creativity and ingenuity. Its many realizations and yards include the famous Brussels Palace of Justice, The Oosterweel Link, landmark bridges, train stations and many more.

Heavily relying on IT to support its complex projects, Artes Group wanted an assessment to validate its investments in cyber security and identify any significant gaps in its security posture. Feeling that traditional security audits no longer shed enough light on their risks, the company chose to have its systems ethically tested and selected Toreon for a red team engagement.

Check out the latest Toreon Cyber Insights articles

Get in touch with our experts for a no-obligation advisory conversation.

Contact an expert

Get in touch with our experts for a no-obligation advisory conversation.

Contact an expert

IT as a backbone for a diverse construction group

Artes Group’s internal IT department supports all group entities and sister companies, respecting their unique needs and identities. From workstation provisioning and support for tender calculation to financial systems and technology for logistics coordination and yard collaboration, the IT team is responsible for a wide range of services.

Bjorn Lagace, IT manager at Artes Group: “Each construction yard is like a small company… sometimes up to more than 100 people need to work together seamlessly on one project. And it’s our job to provide and support technology that enables them to do their job.”

Despite being a relatively small team, the IT department led by Bjorn combines system engineering, application expertise, and service desk operations. The team is forward-looking, investing in training and exploring the practical use of modern technology like AI to improve business effectiveness. Their work over the past years has significantly strengthened the company’s IT foundation.

From best-practice security to resilience testing

After years of building and refining their IT landscape, Artes Group reached a point where deeper insights were needed to steer their long-term cybersecurity roadmap. Traditional audits had helped but felt incomplete. “Although you learn from audits, you’re left with the feeling that they’ve overlooked something. That’s why we decided to put ourselves really to the test by having ourselves ethically hacked,” Bjorn Lagace explained.

Artes Group wanted to simulate realistic attack scenarios that would challenge both their cloud and on-premise environments. The goal: identify blind spots, validate strengths, and gain tangible input for strategic planning. In short, they wanted to measure their resilience, not just check compliance boxes.

A red teaming partner offering expertise, transparency and cultural fit

Artes Group approached several specialized companies to propose this red team engagement, leading to a shortlist of three. The final choice fell on Toreon, which ultimately stood out because of their transparent communication, demonstrated expertise, well-substantiated and correctly priced proposal, and a detailed explanation of the work they would perform.

Bjorn Lagace: “The maturity of Toreon’s consultants played a decisive role. Their professionalism convinced us we had found the right partner. Toreon’s approach resonated with our own mindset: ambitious, practical, and grounded. This cultural fit helped guide our choice.”

Purpose-built testing backed by structured, transparent communication

Toreon kicked off the assignment by thoroughly reviewing Artes Group’s environment and tailoring the test scenarios accordingly. They focused efforts only where meaningful improvements could be uncovered, adjusting the scope based on Artes Group’s infrastructure and business realities.

Communication and planning proved to be key strengths in the approach. Every step was prepared, communicated, and executed with discipline while remaining flexible to Artes Group’s availability. Agreements were clear, timelines were respected, and expectations were consistently managed.

“All findings were documented in reports that were both detailed and accessible. Toreon explained how each incident was discovered, why it mattered, and how it could be remediated. During follow-up sessions, Toreon consultants explored the reports in depth. This transparent dialogue contributed strongly to a positive collaboration and outcome,” Bjorn Lagace clarified.

Actionable results with rapid follow-through

Toreon’s method categorizes incidents and risks based on severity. Artes Group and Toreon agreed in advance that any critical incident would trigger immediate contact. During the exercise, two critical findings were uncovered in connection with one of Artes Group’s external partners. These were escalated right away and swiftly resolved, issues Artes Group acknowledges would have been difficult to detect themselves. Beyond the few critical issues, all other observations were neatly categorized, documented, and explained.

Strategic value through insight, planning and partner alignment

The ethical hacking exercise yielded a level of visibility far exceeding that of traditional audits. It provided Artes Group with a facts-based foundation to refine both short- and long-term security plans. It also surfaced lessons about supplier management. With some incidents tied to partners, Artes Group initiated constructive conversations with two of them – supported by the documentation Toreon had provided.“The exercise helped us engage in dialogue with our partners and support them. If a supplier has a problem, we also have a problem,” Bjorn Lagace added.

Ethical hacking as an essential complement to traditional audits

For Artes Group, the read teaming engagement led by Toreon demonstrated the tangible value of testing, not just implementing, security measures. It reinforced the idea that resilience requires putting systems, processes, as well as people to the test.

As Bjorn Lagace put it: “To measure is to know. You can only be sure by testing, and what better way to do that than through ethical hacking? A cybersecurity audit alone is not waterproof. Therefore, I advise every company to do a red teaming exercise at some point.”

By deliberately allowing themselves to be attacked under controlled conditions, Artes Group achieved a realistic assessment of their readiness and gained insights that traditional audits could not provide. The collaboration with Toreon resulted in improved plans, better partner engagement, and a stronger overall security posture.

Contact us!

Get in touch with our experts for a no-obligation advisory conversation.

Contact an expert

Upcoming Events/Webinars

Connect-IT

You can find us at Connect-IT in May. Our HR team will help you explore new career opportunities and show you what working at Toreon is like.

VLAIO Cybersecurity: 50% Subsidie & Expertbegeleiding Toreon

8 minutes — Mon, 22 Dec 2025 23:00:00 GMT

Tot 50% gesubsidieerd via VLAIO

Bent u een Vlaamse KMO en wilt u uw bedrijf beter beschermen tegen cyberdreigingen?

Dankzij het VLAIO Cybersecurity verbetertraject kunt u als KMO tot 50% financiële steun krijgen voor professionele begeleiding. Grotere bedrijven die moeten voldoen aan de NIS2-regelgeving kunnen tot 35% financiële steun krijgen. Als door VLAIO erkend dienstverlener voor het 5e jaar op rij, helpt Toreon u niet alleen uw cybermaturiteit te verhogen, maar nemen we ook de volledige subsidieaanvraag uit handen.

Ontdek onze op maat gemaakte trajecten en beveilig uw organisatie zonder administratieve rompslomp.

Vraag een gratis adviesgesprek aan

13+ jaar expertise

90+ VLAIO trajecten afgewerkt

Meer dan 60 experten tot uw dienst

Vlaio helpt KMO's met 50% subsidies

Waarom is een VLAIO Cybersecurity traject essentieel voor uw KMO?

Veel Vlaamse KMO’s erkennen het belang van een sterke digitale beveiliging, maar worstelen met beperkte tijd, budget of interne expertise. Het VLAIO Cybersecurity subsidieprogramma is speciaal ontworpen om deze drempels weg te nemen en professionele begeleiding toegankelijk te maken.

Iedere KMO moet zich beschermen.

Niet alleen als je onderheving bent aan NIS2 of CRA is dit van belang. Wij helpen uw algemene weerbaarheid te verhogen.

Cyberaanvallen op KMO’s stijgen het snelst

KMO’s zijn vaak de makkelijkste prooi. Bereid u voor op ransomware-attacks en andere cyberrisico’s.

Maak Cybersecurity Betaalbaar met 50% VLAIO Subsidie

Dit maakt cybersecurity plots zeer betaalbaar. Laat de administratie maar aan ons, we kunnen direct van start.

* 50% geldt voor alle KMO's. Grotere bedrijven die aan NIS2 moeten voldoen, krijgen 35% subsidie binnen dit programma

Onze VLAIO-erkende Cybersecurity Diensten op Maat

Iedere KMO is uniek, en daarom is een standaardaanpak voor cyberveiligheid niet effectief. Onze VLAIO verbetertrajecten zijn modulair opgebouwd. We starten met een grondige analyse en stellen vervolgens, op basis van uw specifieke noden en prioriteiten, een actieplan op maat samen. Hieronder vindt u de meest voorkomende uitdagingen waarvoor KMO’s onze hulp inschakelen

Organisatie beter beschermen tegen cyberaanvallen

Dit is een kritieke zorg voor veel KMO’s. Onze START en MEDIUM pakketten focussen o.a. op:

Backupbescherming en disaster recovery planning
Incidentresponscapaciteit opbouwen
Endpoint protection en firewall-versterking
Awareness training tegen phishing

Voorbereiden op o.a. NIS2, CRA of andere regelgeving

Als u leverancier bent van een NIS2-plichtig bedrijf of zelf onder de NIS2 of CRA reglementering valt, moet u voldoen aan strikte vereisten. Onze aanpak:

CYFUN-gebaseerde assessments en roadmaps
Compliance inbouwen in alle activiteiten
Documentatie en beleid opzetten
Regelmatige audits en verbetertrajecten

Data bescherming & privacy verbeteren

Databeveiliging is cruciaal in uw cloud-omgeving. Wij helpen met:

Dataclassificatie en labeling (GDPR/NIS2)
Data Loss Prevention (DLP) implementatie
Azure en M365 beveiligingshardening
Zero Trust architectuurontwerp

Incidentrespons & continuïteit versterken

Bent u voorbereid op cyberincidenten? Wij zorgen ervoor dat u snel kunt reageren:

Incident response plans opstellen en testen
Business continuity en disaster recovery planning
Table-top exercises en crisis-simulaties
Medewerkerstraining voor calamiteiten

Microsoft 365 & cloud-omgeving veiliger maken

95% van onze klanten gebruiken Microsoft Cloud (M365/Azure). Speciale focus:

Microsoft 365 hardening volgens CIS benchmarks
Azure infrastructure beveiging (Zero Trust)
Conditional Access en MFA implementatie
Cloud security scanning en monitoring

Toegangsbeheer & identiteiten verbeteren

Ongecontroleerde toegang leidt tot hacking. Wij beveiligen uw identiteitssystemen:

Multi-factor authentication (MFA) opzetten
Role-based access control (RBAC) implementeren
Paswoordloze verificatie introduceren
Logging en monitoring van toegang

Wil u alvast meer te weten komen?

Ontdek zelf hoe de VLAIO trajecten u kunnen helpen. Lees er meer over in onze gratis te downloaden ebooks.

Of u nu eigenaar bent van een KMO en uw weerbaarheid wil verhogen, of maker bent van producten en u beter wil voorbereiden op de CRA. Onze ebooks leggen u uit hoe u best te werk kan gaan.

Meer hierover

Kies uw gesubsidieerd VLAIO Cybersecurity traject

Wij bieden drie door VLAIO goedgekeurde cybersecurity verbetertrajecten aan, elk ontworpen voor een ander maturiteitsniveau. Alle pakketten starten met een verplicht assessment en bieden de flexibiliteit om de focus te leggen op wat voor uw bedrijf het belangrijkst is. De vermelde prijzen zijn na aftrek van 50% VLAIO-subsidie.

Start

Voor bedrijven die een eerste risicobeeld willen

€ 5.950 na VLAIO-subsidie

Volledig cybersecurity assessment
Op basis van de CyberFundamentals zoals voorgeschreven door de federale overheid.
Technische veiligheidstests
Security roadmap met prioriteiten

Vraag meer informatie aan

Looptijd: max. 3 maanden

Medium

Het complete pakket voor groeiende bedrijven

€ 14.275 na VLAIO-subsidie

Volledige cybersecurity assessment
Voorgeschreven opstart-fase
+ ruim pakket vrij besteedbare credits*
Praktische beveilingsverbeteringen
NIS2-compliance voorbereiding

Vraag meer informatie aan

Looptijd: max. 6 maanden

Populairst

Plus

Voor bedrijven met strenge beveiligingsvoorwaarden

€ 19.950 na VLAIO-subsidie

Volledig cybersecurity assessment
Voorgeschreven opstart-fase
+ een ruimere keuze om nog meer credits* te gebruiken
Diepgaande beveilingsverbeteringen
Volledige CYFUN-compliance

Vraag meer informatie aan

Looptijd: max. 9 maanden

Kies uit 30+ concrete bouwstenen
voor cybersecurity-verbeteringen

In elk Medium- of Plus-traject krijgt u, naast een verplicht assessment, toegang tot een extra aantal dagen (uitgedrukt in credits). Deze credits gebruikt u om exact die verbeteringen te kiezen uit ons uitgebreid menu diensten die voor uw KMO het meest waardevol zijn.

Hier zijn enkele voorbeelden van uw bouwstenen naar een hogere cybersecurity maturiteit.

Continue kwetsbaarheidsscans

Implementatie van Data Loss Prevention (DLP) en dataklassificatie (GDPR/NIS2)

Access control

Multi-factor authentication en voorwaardelijke toegang implementeren in M365/Azure

Cloud security

Microsoft Cloud infrastructure beveiligen volgens CIS Benchmarks

Data-protection

Voortdurende externe vulnerability-scanning en 3rd-party riskmanagement

Incident response

Incidentplan opstellen, simulatie-oefeningen tests en table-top exercises

Awareness & anti-phishing training

Grondige awareness- en anti-phishing-training voor uw medewerkers

Backup & disaster recovery

Gevalideerde backup plans en disaster recovery procedures

Security policies & governance

Beveiligingsbeleid, ISMS opzetten, rollen & verantwoordelijkheden definiëren

Ethisch Hacken (Pentesting)

Penetratietesten voor infrastructuur, netwerk en eigen-ontwikkelde applicaties

Er zijn nog meer dan 20 andere verbeteringsopties.

Bij Medium en Plus pakketten kan u naast upgraden naar een hoger pakket, ook kiezen voor uitbreidingspakketten waardoor u, met VLAIO-steun, nog verder kunt gaan. Deze opties kunnen max. tot 6 maanden na afronding aangevraagd worden.

Wat onze klanten zeggen

Ontdek hoe wij Vlaamse bedrijven hebben geholpen

Toreon was de logische keuze omdat zij een gerenommeerd cybersecuritybedrijf zijn met diepgaande technische kennis. Dankzij onze samenwerking met Toreon werden mijn aannames bevestigd. We kregen waardevolle inzichten en een roadmap om van start te gaan.

Jan Tanghe

IT Team Lead @ Dewaele

De professionals van Toreon waren echt bereid om ons te leren kennen en deel te worden van het verhaal van Tobania, en dat hebben we enorm gewaardeerd.

Maya Vanderhaegen

Quality, Risk & CSR Manager @ Tobania

Het doel was om te voldoen aan de strengste beveiligingseisen van de medische sector. Die inspanningen hebben ertoe geleid dat het bedrijf ISO 27001-certificering heeft ontvangen voor zijn volledige beveiligingsbeheer.

Georges De Feu

CEO @ Lynxcare

Samen met bijna100 anderen vertrouwden deze KMO’s Toreon om ze te begeleiden voor hun Cybersecurity-traject.

FAQ

Wat is het Vlaio Cybersecurity traject?

Een VLAIO Cybersecurity verbetertraject is een subsidieprogramma van de Vlaamse overheid, ontworpen om KMO’s financieel te ondersteunen bij het verhogen van hun digitale weerbaarheid. U kunt tot 50% subsidie krijgen voor advies en begeleiding van een door VLAIO erkende dienstverlener, zoals Toreon. Het doel is om, op basis van een bewezen framework zoals CYFUN, een concreet actieplan op te stellen en uit te voeren om uw cyberveiligheid te verbeteren.

Kom ik in aanmerking voor een VLAIO cybersecurity subsidie?

Als u voldoet aan de EU-definitie van KMO (Max. 250 FTE, 50M€ omzet, 43M€ balanstotaal), komt u in aanmerking en krijgt u 50% subsidie op de pakketten zoals hier gedefinieerd.

Grotere bedrijven die aan NIS2 moeten voldoen komen uitzonderlijk ook in aanmerking, maar krijgen slechts 35% subsidie op hun traject.

Hoe lang duurt een VLAIO cybersecurity traject gemiddeld?

De doorlooptijd varieert per pakket: het Start-pakket duurt maximaal 3 maanden, Medium maximaal 6 maanden en Plus maximaal 9 maanden.

Dat is een doorlooptijd die wordt vooropgesteld om het gekozen traject te doorlopen, excl. de implementaties binnen de uitbreidingspakketten.

Wat is CRA, NIS2 en CYFUN?

CRA en NIS2 zijn EU regelgevingen waaraan bepaalde bedrijven moeten voldoen.

CYFUN is een manier voor bedrijven om hun cybersecurity maturiteit te verhogen. CYFUN werd ontwikkeld door de CCB (Cybersecurity Center België) i.s.m. professionele experten uit de sector en diverse vakspecialisten in hun adviesraad, waaronder ook die van Toreon.

Moet ik zelf de subsidieaanvraag indienen bij VLAIO?

Nee, Toreon neemt de volledige administratie voor de subsidieaanvraag voor zijn rekening. Zo kunt u snel starten zonder extra paperwork, waarbij zij reeds tientallen KMO’s succesvol begeleid hebben.

Kan ik mijn VLAIO cybersecurity traject later upgraden naar een uitgebreider pakket?

Uiteraard. De meeste bedrijven starten direct met een MEDIUM (of zelfs een PLUS) pakket. Maar indien dat niet voldoende is en u een nog hoger maturiteitsniveau wil bereiken, kan u uw pakket upgraden, of op deze pakketten één van de uitbreidingspakketten nemen. Op deze pakketten geldt eveneens de 35% of 50% subsidie-regeling. Let er wel op dat een upgrade of uitbreiding binnen 6 maanden na afloop moet opgenomen worden.

Hoe werkt het ‘credit’-systeem van Toreon?

Elk bedrijf is uniek. Daarom zitten in onze pakketten, naast de door VLAIO verplichte elementen die worden afgedekt door de initiële implementatiedagen, ook een pakket Toreon-credits.

Daarnaast biedt Toreon een menu van wel 30 opties om deze te gebruiken, puur in functie van uw unieke behoeften.

Na de initiële fase zullen we samen bekijken hoe we de resterende credits het best inzetten om het meeste rendement uit uw investering te halen.

Welke concrete verbeteringen kunnen KMO’s verwachten met VLAIO subsidie trajecten?

Verbeteringen omvatten onder meer vulnerability scans, multi-factor authenticatie, cloud security, data-protection, incident response planning, awareness-training, backup & disaster recovery en beveiligingsbeleid op maat.

Waarom is investeren in cybersecurity met VLAIO subsidie belangrijk voor KMO’s?

Cyberaanvallen op KMO’s stijgen snel en deze bedrijven missen vaak tijd, expertise of budget. Met VLAIO subsidie tot 50% wordt cybersecurity betaalbaar en helpt het uw digitale weerbaarheid tegen ransomware en andere risico’s te verhogen.

Hoe helpt Toreon KMO’s bij de voorbereiding op NIS2 en CRA regelgeving?

Toreon voert CYFUN-gebaseerde assessments uit, bouwt compliance in activiteiten in, zet documentatie en beleid op en verzorgt regelmatige audits en verbetertrajecten om te voldoen aan NIS2 en CRA verplichtingen.

Waar moet ik op letten als ik aan NIS2 moet voldoen?

Grotere bedrijven die aan NIS2 moeten voldoen kunnen ook genieten van 35% subsidie, als ze nog moeten starten aan het versterken van hun cybersecuritybeleid of nog niet beschikken over een CS-roadmap. Let er wel op dat deze bedrijven enkel beroep kunnen doen op een MEDIUM of PLUS pakket.

Start vandaag met het verbeteren van uw cybersecurity

Neem vandaag contact op voor een gratis adviesgesprek. Wij leggen uit hoe u kunt starten met VLAIO-subsidie.

Lander Reynvoet
Resp. VLAIO Project-Sales

Margot Van Overtveldt
VLAIO Project Coördinator

Plan een gratis gesprek in

Designing Cyber Governance: Board Structures and Practices for Effective Oversight

Jordan Hardy — Tue, 16 Dec 2025 23:00:00 GMT

Since the adoption of NIS2, which introduces potential personal liability for individual board members, we’ve observed a growing awareness among boards of the need to address cybersecurity more structurally—as a core governance responsibility.

At the same time, many organisations are asking the same fundamental question:

How should we organise for cybersecurity governance at board level?

To help provide guidance, we’re pleased to share the article below, developed within the Cyber Sounding Board at Guberna, which our CEO Alex Driesen has the privilege of chairing.

The article outlines key considerations and practical recommendations for boards looking to strengthen their oversight of cybersecurity—not just to meet regulatory expectations, but to build long-term digital resilience.

Check out the latest Toreon Cyber Insights articles

Get in touch with our experts for a no-obligation advisory conversation.

Contact an expert

Six Governance Models for Cybersecurity Oversight

Model

Description

Best Fit

1. Fully integrated

Cybersecurity is embedded into every board-level decision. Strategic plans, M&A, and risk reviews explicitly address cyber.

Digital-native or digitally mature companies with high board literacy on cyber. Organisations for whom cyber is a strategic differentiator.

2. Dedicated committee

A board-level cybersecurity or technology risk committee oversees all cyber matters.

Large, complex, or regulated firms; companies with prior breach experience.

3. Audit/Risk committee extension

Cyber risk is formally included in the audit or risk committee’s remit. Often supported by regular CISO briefings.

Mid-sized companies or those starting formal cyber governance.

4. Distributed governance

Different aspects of cyber (e.g. compliance, HR, innovation, data ethics,…) are assigned to different committees

Boards with strong governance culture and multiple specialist committees.

5. Cyber champion model

One director is designated to lead on cybersecurity and acts as liaison with CISO and/or experts.

Smaller boards or organisations with limited resources

6. Minimalist/reactive

No formal oversight; cyber is addressed only during crises or audits.

Increasingly unacceptable. Transitional at best, negligent at worst.

Choosing the Right Model

Boards often begin with model 3 or 5. (as a proactive step moving out of 6)
Larger or regulated companies evolve toward models 1 or 2.
Models 4 and 1 work best where cybersecurity cuts across multiple boardthemes. In 4, watch out for silos, reintegrate.

Six Plug-Ins to Strengthen Oversight

Plug-In

Description

Use Case

a. Board cyber training

Structured learning sessions for directors on cybersecurity threats, regulation, and trends.

All boards; especially important in early stages of maturity AND when imposed by regulation

b. Expert briefings (ad hoc)

External experts update the board on threat landscape or review major incidents.

Enhances situational awareness and challenge capability.

c. Standing advisor or cyber council

Ongoing access to independent experts who support board or committee work.

Ideal for boards without internal cyber expertise.

d. CISO–board engagement

Regular, direct reporting from the CISO to the board or designated committee.

Essential for translating operational risk into strategic insight.

e. Board-executive taskforce

Time-bound group of directors and senior leaders working on a specific cyber initiative (e.g., post-breach reform).

Agile response to high-stakes issues.

f. Simulations and tabletop exercises

Structured crisis scenarios that (or rather exec team with board oversight) and decision-making.[1]

Useful annually or pre-emptively in high-risk sectors.

How Plug-Ins Interact with Models

Plug-ins boost board capacity without altering structure.
For example, model 3 (Audit/Risk) plus plug-ins a, d, and f can be highly effective.
Model 1 (Fully integrated) typically uses plug-ins a through e.
Boards with limited structure should start with training (a) and championing CISO access (d).

Summary Recommendation

Boards should:

Select a base governance model aligned with company context.
Deploy plug-ins to build expertise, engagement, and responsiveness.
Review structure annually as threats, expectations, and maturity evolve.

More on the Cyber Sounding Board at Guberna can be found here:

References

INSEAD (2022). Designing Sustainability Governance
ecoDa (2020-2024). Cyber-Risk Oversight Handbook
European Union (2023). Directive (EU) 2022/2555 (NIS2 Directive)
National Institute of Standards and Technology (NIST). Cybersecurity Framework
Center for Internet Security (CIS). Top 18 Controls

About the Author:

Lorem Ipsum …

Contact us!

Get in touch with our experts for a no-obligation advisory conversation.

Contact an expert

Upcoming Events/Webinars

Connect-IT

You can find us at Connect-IT in May. Our HR team will help you explore new career opportunities and show you what working at Toreon is like.

Toreon geselecteerd als VLAIO-partner: Toegankelijke cybersecurity voor Vlaamse KMO’s

Jordan Hardy — Thu, 11 Dec 2025 23:00:00 GMT

We zijn verheugd te kunnen melden dat Toreon is geselecteerd als één van de weinige cybersecuritypartners binnen het prestigieuze VLAIO-subsidieprogramma. Deze erkenning stelt ons in staat om Vlaamse kleine en middelgrote ondernemingen (KMO’s) te ondersteunen bij het versterken van hun cybersecurity—met 50% substantiële financiële steun van de Vlaamse overheid.

Meer info over VLAIO cybersecurity

Ik wil ondersteuning

Verder bouwen op meer dan 90 eerdere VLAIO-trajecten

Als één van de zeer weinige gespecialiseerde cybersecurity bedrijven die zijn goedgekeurd voor dit programma, bevestigt deze selectie Toreon’s expertise en trackrecord in meer dan 90 trajecten in het begeleiden van KMO’s naar een hoger beveiligingsniveau. Het VLAIO-kader stelt ons in staat om onze bewezen methodologieën en praktische aanpak toegankelijker te maken voor Vlaamse bedrijven die hun digitale weerbaarheid willen versterken.

In een tijdperk waarin cyberaanvallen steeds geavanceerder worden en regelgeving zoals de Cyber Resilience Act (CRA) en NIS2 strengere eisen stellen, is deze samenwerking met VLAIO een gamechanger voor KMO’s die cybersecurity serieus willen nemen zonder hun budget te overschrijden. Ook het voorbereiden op het behalen van een ISO27001 certificering in een meer internationale omgeving kan hierdoor worden ondersteund.

De programma’s en pakketten die door VLAIO worden gesubsidieerd zijn geselecteerd met een focus op het Cyber Fundamentals framework dat door stakeholders zoals o.a. het Centre for Cybersecurity belgium (CCB), de KU Leuven, Agoria, Beltug en Cybersecurity Initiative Flanders, werd uitgewerkt. Toreon heeft via meerdere van deze stakeholders als actief lid bijgedragen bij de definitie van dit framework.

Hoe uw KMO kan profiteren van het VLAIO-programma

Het VLAIO-subsidieprogramma maakt professionele cybersecuritydiensten financieel toegankelijk voor Vlaamse ondernemingen. Door gebruik te maken van dit programma, kunnen KMO’s:

Substantiële kostenbesparingen realiseren door overheidssubsidies die een aanzienlijk deel van de investering dekken

Toegang krijgen tot expertise van topniveau die anders buiten bereik zou zijn

Voldoen aan actuele compliance-eisen zoals CRA, EU AI Act, ISO27001, NIS2 en het CyberFundamentals Framework

Hun concurrentiepositie versterken door cybersecurity om te zetten in een strategisch voordeel

Daardoor meer enterprise customers sneller binnenhalen omwille van aangetoonde professionaliteit en compliance

Risico’s beheersbaar maken met een duidelijk stappenplan en praktische implementatie
Internationale geloofwaardigheid opbouwen met erkende certificeringen zoals ISO27001

Welke bedrijven komen in aanmerking?

Het VLAIO-programma richt zich specifiek op Vlaamse KMO’s die hun cybersecuritymaturiteit willen verhogen. Ons aanbod is bijzonder relevant voor diverse bedrijfsprofielen:

- Software- en productontwikkelaars:

Bedrijven die software ontwikkelen (embedded, SaaS, of standalone producten) voor intern en extern gebruik

Organisaties die digitale producten op de markt brengen

Bedrijven die moeten voldoen aan de Cyber Resilience Act (CRA)

Softwareleveranciers dieoplossingen voor connecteerbare toestellen produceren

Organisaties die ISO27001-certificering nastreven ter ondersteuning van internationale geloofwaardigheid

Productie- en technologiebedrijven:

Bedrijven met max. 250 medewerkers

Ondernemingen met een productiefaciliteit (lokaal of in het buitenland)

Ondernemingen waarbij software een cruciaalonderdeel vormt van of gekoppeld is met hun product(en)

Bedrijven met operational technology (OT) en industriële systemen

Algemene KMO’s met digitale ambities:

Organisaties die werken met Microsoft 365 en hun cloud-configuratie willen optimaliseren

Bedrijven die het CyberFundamentals (CYFUN) Framework willen implementeren (voor alle KMO’s, niet alleen NIS2- of CRA-plichtig)

KMO’s met een lage tot gemiddelde cybersecuritymaturiteit die een structurele aanpak zoeken, of die met een hoge cybersecurity maturiteit die een kostenoptimalisatie willen doorvoeren.

Bedrijven die compliance moeten aantonen aan klanten en partners waarbij de voor hen relevante regelgeving vraagt om ook hun business-partners daarop te screenen.

Belangrijk: Het CyberFundamentals Framework is relevant voor alle KMO’s die hun cybersecurity willen professionaliseren, ongeacht of ze onder NIS2-regelgeving vallen.

Wil u alvast meer te weten komen?

Ontdek zelf hoe de VLAIO trajecten u kunnen helpen. Lees er meer over in onze gratis te downloaden ebooks.

Of u nu eigenaar bent van een KMO en uw weerbaarheid wil verhogen, of maker bent van producten en u beter wil voorbereiden op de CRA. Onze ebooks leggen u uit hoe u best te werk kan gaan.

Meer hierover

Waarom kiezen voor Toreon binnen het VLAIO-programma?

1. Business-first benadering

We spreken uw taal. Geen technisch jargon, maar focus op ROI, business impact en meetbare resultaten die relevant zijn voor uw bedrijf.

2. Productie- en OT-expertise

Diepgaande kennis van productieomgevingen en operationaltechnology—cruciaal voor KMO’s met productiefaciliteiten en industriële systemen.

3. Product Security wereldfaam

4. Cloud Security specialisatie

Ons Product Security-team heeft internationale erkenning, met name op het gebied van ThreatModeling en secure software development—essentieel voor CRA-compliance.

Ons CloudSec-team kan uw Microsoft 365-configuraties optimaliseren en andere cloud-platforms beveiligen, zodat u maximaal profiteert van cloud-technologie zonder extra risico’s.

5. Praktische implementatie

We blijven niet bij advies. We rollen onze mouwen op en helpen u met hands-on implementatie die écht werkt in uw context.

6. KMO-specialisatie

Onze VLAIO-oplossingen zijn op maat gemaakt voor bedrijven tot 250 medewerkers. Niet te complex, niet te simpel—precies goed. En dit voor startups, voor allerlei bedrijven in de maakindustrie waarbij ontwikkelde digitale componenten of software deel uitmaken van het product of de dagelijkse bedrijfsvoering

7. Internationale compliance-kennis

We begeleiden u naar ISO27001-certificering, CRA-compliance, en andere internationale standaarden die uw geloofwaardigheid versterken.

8. Framework-agnostisch

Of u nu werkt met CyberFundamentals, ISO27001, NIST, CIS Controls, of OWASP—we beheersen ze allemaal tot in de puntjes (sommigen hebben we zelf mee uitgetekend) en passen ze toe op uw situatie.

Klaar om te starten?

De selectie voor het VLAIO-programma biedt een unieke kans om uw cybersecurity naar een hoger niveau te tillen met substantiële overheidssteun. Of u nu:

Software of digitale producten ontwikkelt en CRA-compliant moet worden

Internationaal actief bent en ISO27001-certificering nastreeft

Uw Microsoft 365-omgeving wil beveiligen

Een productiefaciliteit heeft met OT-uitdagingen

Gewoon uw algemene cybersecuritymaturiteit wilt verhogen

…we hebben een pakket dat bij uw situatie past.

Onze VLAIO-pakketten: Van assessment tot volledige implementatie

We hebben vijf gestructureerde pakketten ontwikkeld die KMO’s begeleiden van eerste analyse tot volledige implementatie van cybersecuritymaatregelen. De budgetten zijn bruto en daarop wordt dus de 50% subsidie van VLAIO berekend.

Het START Pakket ligt vast, maar de items binnen de MEDIUM, PLUS en UITBREIDINGSPAKKETTEN zullen we in overleg samen kiezen in functie van hun relevantie in uw situatie. We hebben een menu van meer dan 30 specifieke service-items, elk met hun eigen tegenwaarde, en zo maken we voor u een traject op maat om een maximale ROI te bereiken.

VLAIO-pakketten

START Pakket: ‘Security Discovery’ (€11.900, voor 50% VLAIO-subsidie)

Perfect voor: Bedrijven die direct willen starten met verbeteringen

Wat u krijgt:

Alle elementen van het START pakket (assessment + roadmap)

Ruim, flexibel implementatiebudget voor het uitvoeren van prioritaire maatregelen

Hands-on begeleiding bij het implementeren van security controls

Microsoft 365 configuratie-optimalisatie indien relevant

Opvolging en coaching tijdens het implementatietraject

Implementatie over mensen, processen én technologie

Focus: Van analyse naar actie—we helpen u het stappenplan daadwerkelijk uit te voeren

Dit pakket combineert strategie met praktijk: we brengen uw security-status in kaart én helpen u de belangrijkste verbeteringen door te voeren, inclusief cloud security waar nodig.

MEDIUM Pakket: ‘Security Journey’ (€28.550, voor 50% VLAIO-subsidie)

Perfect voor: Bedrijven die een duidelijk startpunt zoeken

Wat u krijgt:

Algemeen security assessment van uw organisatie

Technisch assessment van uw infrastructuur en systemen. Er zijn 2 alternatieven:

Microsoft 365 security review door ons gespecialiseerd CloudSec-team (indien relevant) – Uitgebreide security roadmap met geprioriteerde acties

Externe penetratietest die kwetsbaarheden zal vaststellen in de publieke en/of extern bereikbare onderdelen van het bedrijf.

Eliminatie van blinde vlekken door gecombineerde assessments – Afstemming op het CyberFundamentals Framework (CCB) – Gap-analyse voor ISO27001, CRA of andere relevante frameworks

Beide alternatieven zijn onderdeel van het altijd inbegrepen START pakket en hebben dezelfde waarde. De keuze hangt af van wat het meest relevant is voor de klant – een klassieke externe pentest of een cloud security assessment.

Focus: 100% analyse en planning, geen implementatie

Dit pakket geeft u een helder, beheersbaar actieplan waarbij de meest kritieke security-tekortkomingen worden geprioriteerd, zodat u weet waar u het best uw budget besteedt—of u nu compliance nastreeft of gewoon uw digitale weerbaarheid wilt versterken.

PLUS Pakket: ‘Security Transformation’ (€39.900, voor 50% VLAIO-subsidie)

Perfect voor: Bedrijven die een grondige security-transformatie willen doorvoeren

Wat u krijgt:

Alle elementen van het START pakket (assessment + roadmap)

Nog ruimer en flexibel implementatiebudget voor uitgebreide security-verbeteringen

Volledige implementatie over mensen, processen én technologie

Cloud security optimalisatie (Microsoft 365, Azure, of andere platforms)

Training en awareness-programma’s

Incident response-oefeningen en playbook-ontwikkeling

Duurzame verankering van security in uw organisatie

Voorbereiding op ISO27001-certificering (indien gewenst)

Focus: Volledige transformatie naar een security-bewuste organisatie

Dit pakket biedt de meest complete aanpak: van assessment tot volledige implementatie van een robuust security-programma dat uw organisatie structureel weerbaarder maakt en klaar voor internationale compliance-eisen.

Uitbreidingspakketten

Uitbreidingspakket 1: Productveiligheid - Secure Software Development Lifecycle Coaching (€19.950, voor 50% VLAIO-subsidie)

Perfect voor: Software- en productontwikkelaars

Wat u krijgt:

Gespecialiseerde begeleiding van ons internationaal erkende Product Security-team

Threat Modeling expertise (wereldfaam op dit gebied)

Coaching voor het opschalen van uw ontwikkelprocessen

Cyber Resilience Act (CRA) compliance-voorbereiding

Security-by-design integratie in uw SDLC

OWASP SAMM framework implementatie – Secure coding practices en code review-processen

Focus: 100% implementatie—specifiek voor productveiligheid

Essentieel voor:

Softwarebedrijven die hun ontwikkelprocessen security-proof willen maken

Bedrijven die moeten voldoen aan de CRA (verplicht voor veel digitale producten)

Organisaties die software als hoofdactiviteit hebben of SaaS-oplossingen uitbaten

Producenten van aan het internet connecteerbare toestellen

Dit pakket is cruciaal in het licht van de nieuwe Europese wetgeving die strikte security-eisen stelt aan softwareleveranciers en producenten van digitale producten.

Uitbreidingspakket 2: Extra Implementatiedagen (€19.950, voor 50% VLAIO-subsidie)

Perfect voor: Bedrijven die hun Security Journey extra willen versnellen

Wat u krijgt:

18 extra implementatiedagen

Flexibel in te zetten voor security-verbeteringen

Kan gebruikt worden voor cloud security, OT security, of andere specialisaties

Focus: 100% implementatie—extra capaciteit voor ambitieuze KMO’s.

Dit pakket biedt extra implementatiecapaciteit voor bedrijven die verder willen gaan dan de standaardpakketten en hun security-transformatie willen versnellen.

Neem contact met ons op om te samen te kijken welk pakket het beste aansluit bij uw noden en hoe u optimaal gebruik kan maken van het VLAIO-subsidieprogramma.

Laten we samen van cybersecurity een strategisch voordeel maken voor uw onderneming.

om te samen te kijken welk pakket het beste aansluit bij uw noden en hoe u optimaal gebruik kan maken van het VLAIO-subsidieprogramma.

Laten we samen van cybersecurity een strategisch voordeel maken voor uw onderneming.

Toreon is een gespecialiseerde cybersecurityconsultant met focus op Vlaamse KMO’s. Als een van de weinige geselecteerde partners binnen het VLAIO-programma helpen we bedrijven hun digitale weerbaarheid te versterken met praktische, business-gedreven oplossingen—van cloud security tot productveiligheid, certificatie-klaar.

Blog (NO-INDEX)

4 phases of an ISO27001 Information Security Management System implementation. - Toreon - Business driven cyber consulting

Phase 1: Shaping your ISMS

Phase 2: Implementing ISO27001

Phase 3: Monitoring and controlling your ISMS

Setting up an ISMS

Phase 4: Improvement and certification

Download our product sheet and learn more about our methodology!

Cyber Security Challenge - Toreon - Business driven cyber consulting

KMO Portefeuille - Toreon - Business driven cyber consulting

Wat is de KMO-Portefeuille?

Kom ik in aanmerking?

Hoeveel subsidies kan ik krijgen?

Hoe kan ik mijn KMO-Portefeuille subsidie aanvragen?

Wil je nog meer weten over de KMO-Portefeuille?

Break-Glass Access done right: Why YubiKeys are essential for secure emergency access - Toreon - Business driven cyber consulting

When security meets reality: The Break-Glass dilemma

Why traditional Break-Glass Accounts fall short

The shift to hardware-based emergency access

Break the Glass with YubiKeys: A secure-by-design approach

Phishing resistance where it matters most

Governance, compliance, and audit readiness built in

From Theory to Practice: How Secure Break-Glass Works

About the Author:

Ready to see how your company can benefit?

Upcoming Events/Webinars

2026: The Year Cyber Compliance Becomes Mandatory - Toreon - Business driven cyber consulting

Table of Contents

1. NIS2 in Belgium: 2026 is the first big test

1.1 Key NIS2 dates in Belgium

1.2 Who falls under NIS2 in Belgium?

1.3 What NIS2 actually expects by April 2026

1.4 Penalties and management liability

2. The Cyber Resilience Act: product security becomes a legal obligation

2.1 CRA timeline: 2026 is about reporting

2.2 Who must care about CRA?

2.3 CRA reporting from September 2026: new operational pressure

2.4 CRA: security by design, SBOMs and documentation

3. NIS2 vs CRA: complementary, not competing

4. Other 2026 regulations in the background

4.1 DORA – for financial services and their ICT suppliers

4.2 AI Act – 2026 is go‑live for high‑risk AI

4.3 GDPR – faster procedures, focused actions

4.4 CER-Law

5. How Belgian organizations can move from “reaction” to “strategy”

Learn more about the VLAIO-subidies

Upcoming Events/Webinars

Grid Congestion, Risk Assessment & Resilience: How Governance Secures Business Continuity

The Link Between Grid Congestion and Risk

Building Resilience: Practical Solutions

The Importance of Governance in Risk Assessment

Conclusion: From Reactive to Proactive

Want to know how to concretely embed governance and risk assessment in your organization?

About the Speaker: Vincent Haerinck

Artes Group Boosts Cyber Resilience with Red Teaming | Toreon

Check out the latest Toreon Cyber Insights articles

IT as a backbone for a diverse construction group

From best-practice security to resilience testing

A red teaming partner offering expertise, transparency and cultural fit

Purpose-built testing backed by structured, transparent communication

Actionable results with rapid follow-through

Strategic value through insight, planning and partner alignment

Ethical hacking as an essential complement to traditional audits

Contact us!

Upcoming Events/Webinars

VLAIO Cybersecurity: 50% Subsidie & Expertbegeleiding Toreon

Waarom is een VLAIO Cybersecurity traject essentieel voor uw KMO?

Iedere KMO moet zich beschermen.

Cyberaanvallen op KMO’s stijgen het snelst

Maak Cybersecurity Betaalbaar met 50% VLAIO Subsidie

* 50% geldt voor alle KMO's. Grotere bedrijven die aan NIS2 moeten voldoen, krijgen 35% subsidie binnen dit programma

Onze VLAIO-erkende Cybersecurity Diensten op Maat

Organisatie beter beschermen tegen cyberaanvallen

Voorbereiden op o.a. NIS2, CRA of andere regelgeving

Data bescherming & privacy verbeteren

Incidentrespons & continuïteit versterken

Microsoft 365 & cloud-omgeving veiliger maken

Toegangsbeheer & identiteiten verbeteren

Wil u alvast meer te weten komen?

Kies uw gesubsidieerd VLAIO Cybersecurity traject

Kies uit 30+ concrete bouwstenen
voor cybersecurity-verbeteringen

START Pakket: ‘Security Discovery’ (€11.900, voor 50% VLAIO-subsidie)

MEDIUM Pakket: ‘Security Journey’ (€28.550, voor 50% VLAIO-subsidie)

PLUS Pakket: ‘Security Transformation’ (€39.900, voor 50% VLAIO-subsidie)

Uitbreidingspakket 1: Productveiligheid - Secure Software Development Lifecycle Coaching (€19.950, voor 50% VLAIO-subsidie)

Uitbreidingspakket 2: Extra Implementatiedagen (€19.950, voor 50% VLAIO-subsidie)