Unicis Platform October 2026 Release: CyFun for Belgium and Romania, NIS2 IR, Auditor Access & ENISA Videos

October brings two minor releases of the Unicis Platform: v2026-10-09 and v2026-10-16. Together they make Unicis a practical tool for organisations preparing for NIS2 in Belgium and Romania, give auditors a proper read-only seat in the platform, and open up free, EU-published awareness training content through PeerTube.

Why we added CyFun

NIS2 tells organisations what they need to achieve. It deliberately leaves the how to member states and to the frameworks they recognise. In Belgium, that framework is the CCB CyberFundamentals (CyFun®), developed by the Centre for Cybersecurity Belgium and the reference for NIS2 conformity there. CyFun has also been adopted in Romania, and other EU member states draw on it.

That makes CyFun a recognisable baseline for any company that operates in, or sells to, these markets. Instead of translating NIS2 into a spreadsheet of your own, you work through a structured, risk-based set of measures that scales with your risk profile through assurance levels, and you can use it for self-assessment or prepare for conformity assessment by an accredited body.

In Unicis you get:

• CyFun® 2023-03-01 (v2026-10-09) and CyFun® 2025 (v2026-10-16), both in English and French
• Control-level implementation guidance and examples of evidence
• Cross-framework mappings, with NIST CSF 2.0 as the mapping pivot for the 2025 edition, surfaced in Controls Mapping and the Mapping Matrix, so one piece of evidence can count towards CyFun, NIS2, ISO 27001 and more
• Maturity levels that map directly to Unicis control statuses, so your CyFun score follows from the work you track on tasks

What changes in CyFun 2025

The 2025 edition follows NIST CSF 2.0 and adds a Govern function to Identify, Protect, Detect, Respond and Recover, plus a Small assurance level next to Basic, Important and Essential. Unicis keeps both versions side by side, so existing 2023 assessments stay untouched while you plan your move. See the side-by-side comparison on the CyFun framework page.

NIS2 Implementing Regulation with ENISA guidance

We also added Commission Implementing Regulation (EU) 2024/2690 with ENISA Technical Implementation Guidance as its own framework next to the EU NIS2 Directive, in English, German, Spanish, French and Italian. It covers the detailed technical and methodological requirements for digital infrastructure and ICT service providers, with guidance and evidence examples for every control. Read more on the NIS2 IR framework page.

Combined with CyFun, you can cover the directive, the technical requirements and the national reference framework from a single control matrix.

Built for audits: read-only auditor access

NIS2 readiness ends in an audit, and auditors need to see the evidence without being able to change it. In v2026-10-16 the Auditor role gets read-only access to:

• The Cybersecurity Management System: controls, control mappings and linked tasks
• Risk Management, including risk exports
• Enrolled assets, without add, delete or log-deletion actions

Configuration pages, team, framework and member changes stay off limits, and CSC status updates now require task-update permission at the API level. Evidence stays tamper-evident while the auditor reviews it. See Settings for roles.

Free awareness training from ENISA, via PeerTube

NIS2 expects regular cybersecurity awareness and training, and the Awareness Training module now supports PeerTube in addition to YouTube. ENISA publishes cybersecurity awareness videos on videos.enisa.europa.eu, The library is actively maintained: recent uploads include the ENISA Threat Landscape 2026, a tutorial for the Cyber Resilience Act Single Reporting Platform, and ECSF game instructions. You can paste any PeerTube watch, short or embed link into a course, including an optional start time. Unicis converts it to the matching embed automatically.

For organisations this means:

• Free online training content from an EU agency, ready to use in your courses
• Always current material: security updates published in the ENISA library can be added to your courses as part of ongoing maintenance, rather than rebuilding training from scratch
• Course completion and reporting handled in Unicis, so training evidence lands next to your controls
• Clear validation messages in the course form when a link is not a supported YouTube or PeerTube URL

Security and dependency updates

Both releases include security work:

• Fleet enrollment now requires an authenticated session and team membership checks, an unauthenticated debug endpoint was removed, and plan endpoints require authentication. Thanks to security researcher kta1kri for responsibly reporting these issues.
• Updated dependencies including Next.js 16.3.8 and Prisma 7.10.1, and regenerated SPDX and CycloneDX SBOMs from both lockfiles.
• Fixes for activity-log validation, profile headers and CSC linked-task links.

The full details are in the changelog.

What’s next

We’ll keep expanding framework coverage and the mappings between frameworks, so evidence collected once keeps counting everywhere. Share your ideas on the public roadmap.

If you have questions about CyFun, NIS2 or auditor access, reach out via Discord or contact us.

Sign up for a DEMO