Tech··4 min
Cybersecurity Month: a four-week plan for Luxembourg SMEs
Every October, the European Union holds a European Cybersecurity Month. Here is a four-week schedule for SME managers in Luxembourg, from the free diagnostic to the NIS2 check.
Translated from French · Lire l'original en français
Every October, ENISA and the European Commission coordinate the European Cybersecurity Month across the Union. For a Luxembourg SME with no dedicated IT team, this yearly fixture is above all a practical opportunity: four weeks to carry out the review that gets put off for the rest of the year.
One month, one framework, one national milestone
In Luxembourg, the European initiative is extended by a national campaign, the Cybersecurity Week Luxembourg (CSWL), coordinated by the Luxembourg House of Cybersecurity (LHC). An SME does not have to treat cybersecurity as a vague, never-ending project. It can schedule four specific actions across the four weeks of October, each with a clear contact and a clear deliverable. This schedule sets them out.
Week 1: measure your level with Fit4Cybersecurity
The first step is free and takes about fifteen minutes. According to SECURITYMADEIN.LU, which operates the scheme, the Fit4Cybersecurity self-assessment is available on startup.cases.lu and gives any company a score for its cyber maturity. A score of 65 out of 100 or higher qualifies the company for an in-depth CASES diagnostic, carried out free of charge by cybersecurity experts, so a simple questionnaire becomes the starting point of a real action plan. This is the box to tick before applying for any funding, since the schemes that follow assume you have already identified your weaknesses.
Week 2: check your eligibility for the SME Package Cybersecurity
Once the diagnostic is done, the next question is funding. According to Guichet.lu, the SME Package Cybersecurity, run by the Ministry of the Economy, covers 70% of a cyber upgrade project costing between €3,000 and €25,000 excl. VAT. The scheme is open only to SMEs established in Luxembourg that hold a business permit. Applications go through the House of Entrepreneurship, or through eHandwierk for craft businesses, and the LHC carries out the final assessment.
| Criterion | Details |
|---|---|
| Subsidy rate | 70% of eligible costs |
| Project amount | Between €3,000 and €25,000 excl. VAT |
| Point of entry | House of Entrepreneurship or eHandwierk |
| Final validation | Luxembourg House of Cybersecurity (LHC) |
| Reimbursement | After the project is invoiced |
Week 3: find out whether the NIS2 law applies to you
The third week is the most regulatory one, and the hardest to settle on your own. The law of 5 May 2026 transposing the NIS2 directive, published in Mémorial A n°225 according to Legilux, came into force on 10 May 2026. According to the ILR, the competent cybersecurity authority in Luxembourg, the law requires the essential and important entities it covers to self-register. A company that has not yet checked whether it falls within the scope of the NIS2 law should spend this week reviewing the criteria published by the ILR and, where needed, completing any missing self-registration. This article explains what the scheme is and what it contains; it does not replace legal advice on whether your company is actually subject to it. If in doubt, the text of the law on Legilux and direct contact with the ILR remain the only authoritative sources.
Week 4: Cybersecurity Week Luxembourg and its Gala
To close the month, the CSWL offers a shared highlight. According to Chronicle.lu, the 2026 edition ends with the Gala & Awards Night on Thursday 22 October 2026 at 6.30 pm at Kinepolis Luxembourg-Kirchberg, the tenth edition of this event organised by the LHC. Four award categories are presented: CISO of the Year 2026, DPO of the Year 2026, Cybersecurity Startup Award and Cyberfraud.lu Solution Award, which makes it a useful occasion to compare your own approach with the practices of other Luxembourg organisations. Attending, or simply following the nominations, as reported by Silicon Luxembourg, means the month ends with more than a box ticked in a spreadsheet.
A schedule, not a one-off obligation
Free diagnostic, 70% funding, regulatory check, networking: these four steps only work if they are taken in this order, each one building on the previous one. For an SME manager in Luxembourg, the European Cybersecurity Month is not an event to watch from a distance. It is a four-week window to turn an intention into a concrete file, from the Fit4Cybersecurity score through to the company's NIS2 status.
