CyFun® Preliminary Assessment: Prepare for Your Audit with Greater Clarity
Prior to an official CyFun® audit, many organizations ask themselves the same questions: Have we understood the key performance indicators correctly? Is our supporting documentation sufficient? Is our self-assessment comprehensive? Which nonconformities should we address first?
The CyFun® preliminary review makes it possible to answer these questions even before the official audit. It provides a concrete overview of the expectations, the interpretation of the key indicators, and the expected improvements.
Why consider a CyFun® preliminary assessment?
The preliminary assessment is a preparatory step. It does not replace the official assessment, but it does enable you to approach it with greater clarity.
It helps your organization to:
- understand the expectations associated with the “CyFun® Basic” or “Important” levels;
- clarify the interpretation of the key figures;
- verify whether the available evidence is sufficiently substantiated;
- identify weaknesses before the official audit;
- prioritize corrective actions;
- better engage the relevant internal staff.
The preliminary review helps reduce uncertainties. It aids in understanding the interpretation of the requirements, testing the preparations, and prioritizing corrective actions.
How does the CyFun® preliminary audit work?
Depending on your needs and the desired level of support, Normec CertUp offers a half-day or full-day preliminary assessment.
During this session, an experienced auditor will present the CyberFundamentals Framework, the logic behind the audit, and the key expected measures. Your questions will then be discussed in the specific context of your organization.
Half a day is sufficient to familiarize yourself with the framework, clarify key expectations, and get answers to your most important questions.
A full day allows for an in-depth analysis. The auditor can simulate certain steps of an actual audit, review additional supporting documentation, and explain the results. This gives you a more accurate picture of your level of preparedness and the actions that still need to be completed before the official audit.
Preliminary audit and Qfor software: two complementary approaches
The preliminary audit can be combined with the use of the Qfor Cybersecurity Assessment software. You can first conduct a preliminary audit to better understand the framework and then use the software to structure your self-assessment.
You can also start with the software, gather your results and supporting evidence, and then organize a preliminary assessment to test your level of preparedness before the official assessment.
In both cases, the goal remains the same: to eliminate uncertainties and prepare your organization more efficiently.
Why choose Normec CertUp?
Normec CertUp has extensive experience in audit and assessment procedures. Our auditors explain the requirements of the CyFun® framework in clear and practical terms. This makes the CyFun® preliminary assessment a useful preparatory phase rather than a purely theoretical exercise.
Are you preparing for a CyFun® audit?
Schedule a preliminary assessment
Frequently Asked Questions – CyFun® Preliminary Assessment
-
No. It is optional, but it can be very helpful in better understanding the requirements before the official audit.
-
The pre-audit provides you with a clear picture of your current status. It highlights areas that are sufficiently prepared, items that need to be completed, and priorities for action. It also helps internal teams better understand what will be expected during the official audit.
-
No. The pre-check does not guarantee the final result, but it helps identify gaps and improve your level of preparation.
-
A half-day session is suitable for an initial assessment. A full day is more appropriate if you want a more practical simulation and a more in-depth analysis.
-
Not necessarily. The pre-inspection focuses on the most relevant items based on your specific situation.
-
Yes. It’s actually a good idea to test your self-assessment and supporting evidence before the official stage.