Independent guide · NIS2 context 2026

SME Package Cybersecurity Luxembourg: 70% of your cybersecurity project funded, up to €17,500.

Direct answer

The SME Package Cybersecurity funds 70% of the eligible costs of a cybersecurity project worth between €3,000 and €25,000 excluding VAT, i.e. up to €17,500. It funds cybersecurity technologies and procedures and supports NIS2 compliance work, without amounting to compliance in itself. Distinctive feature: a pre-analysis by the Luxembourg House of Cybersecurity is mandatory, in addition to going through the House of Entrepreneurship or eHandwierk.

This guide details the eight-step process specific to the Cyber package, typical projects, the link with the Luxembourg law of 5 May 2026 transposing NIS2, and the mistakes that get an application rejected.

Check my eligibility for free See the Cyber-specific process

Written reply within 48 hours No commitment Licensed accountant

Published on 17 October 2026 · verified and updated on 17 October 2026 by Mickaël LOC, licensed accountant Financial Services Luxembourg SARL-S · RCS B213987 · Business permit 10077274

Our updates on the scheme will appear first in Google's "Top stories" results.

Official framework Ministry of the Economy Luxembourg House of Cybersecurity House of Entrepreneurship eHandwierk Cybersecurity Service NIS2 Directive ILR

SME Package Cybersecurity: key figures
Criterion	Rule
Aid rate	70% of eligible costs
Quote	€3,000 to €25,000 excl. VAT
Maximum grant	€17,500
Purpose	Protection against cyberattacks, cybersecurity technologies and procedures, support towards NIS2 compliance
Examples	Audit and risk analysis, hardening, tested backups, incident response plan, awareness training
Pre-analysis	House of Entrepreneurship (Chamber of Commerce) or eHandwierk (Chamber of Skilled Trades), then Luxembourg House of Cybersecurity (mandatory)
Payment	After completion and the evaluation meeting; the company pre-finances
Process duration	Generally 4 to 8 months, as an indication
Do not	Order or pay before approval by the Ministry of the Economy

01 · Official scope By the end of this section, you will know what the Cyber package really funds

What exactly does the SME Package Cybersecurity fund?

The official fact sheet describes a scheme that facilitates the implementation of cybersecurity technologies and procedures, and that supports companies in their compliance with the NIS2 Directive. The scope is therefore twofold: technical protection and organisational procedures.

Strand 01

Diagnostic and exposure

Establish where the company really stands before buying anything. This is the strand that the Luxembourg House of Cybersecurity pre-analysis structures.

Vulnerability audit and asset mapping
Risk analysis and prioritisation
Penetration test depending on maturity
Assessment of supplier exposure

Strand 02

Technical protection

Reduce the attack surface and make an incident survivable. A tested backup is what separates an SME that restarts from an SME that closes down.

Hardening of workstations, servers and remote access
Multi-factor authentication and identity management
Backup following the 3-2-1 principle, with tested restore
Ransomware protection and monitoring

Strand 03

Procedures and compliance

The strand most often forgotten, and yet central to NIS2, which requires risk management measures and documented governance.

Security policy and governance
Incident response and business continuity plan
Staff awareness, simulated phishing campaigns
Documented NIS2 compliance roadmap

GDPR compliance work is not in itself a Cybersecurity project. The administration emphasises protection against cyberattacks, NIS2 and the implementation of cybersecurity technologies and procedures. GDPR measures are retained when they concern data security and fall within the cyber scope validated during the pre-analysis. An application built solely around the record of processing activities and GDPR documentation risks rejection or referral to another framework.

Likely treatment of expenses: the firm's reading, to be confirmed in the pre-analysis
Type of expense	Treatment	Status
Audit and risk analysis	Assessment service carried out by the provider	To be confirmed
Technical implementation	Configuration, hardening, deployment, testing	Listed in the fact sheet
Drafting of procedures	Security policy, incident response plan, continuity	Listed in the fact sheet
Awareness and training	Sessions, simulated campaigns, skills transfer	To be confirmed
Security hardware	Physical firewall, backup NAS, network equipment	Not retained
Licences and subscriptions alone	Antivirus, EDR, cloud backup without an associated service	Not retained
Recurring monitoring	Managed service billed monthly after the project	Not retained
Expenses incurred before approval	Order or payment prior to the notification	Not retained

Key. Listed in the fact sheet: item corresponding to an element cited in the official fact sheet. To be confirmed: potentially eligible, to be validated during the pre-analysis. Not retained: in principle excluded under the applicable conditions and our reading. The official fact sheet does not publish an exhaustive grid of expenses: this table is the firm's reading, not an administrative decision.

Consequence for how the project is built. In cybersecurity, the temptation is to buy tools. The scheme, however, funds the work: auditing, configuring, documenting, training. A well-built application puts the service at the centre and leaves licences outside the cost base, without trying to bring them in.

Source: official fact sheet SME Packages – Cybersecurity, guichet.public.lu. The fact sheet does not publish a detailed list of eligible expenses: the treatment of the items above is the firm's reading, to be confirmed in the pre-analysis. Verified on 10 August 2026.

02 · Specific process By the end of this section, you will know the double pre-analysis specific to the Cyber package

How does the Cybersecurity process differ from the other packages?

The difference most pages overlook

For the Digital, AI and Service packages, a single pre-analysis is required. For the Cybersecurity package, the company first contacts the House of Entrepreneurship or the eHandwierk Cybersecurity Service, and must then go through a mandatory pre-analysis by the Luxembourg House of Cybersecurity. The final evaluation meeting is also held with this body. An application that skips this step does not succeed.

Week 1

First contact

The company contacts the House of Entrepreneurship of the Chamber of Commerce or the eHandwierk Cybersecurity Service of the Chamber of Skilled Trades.

Entry point to the scheme

Weeks 1 to 3

Luxembourg House of Cybersecurity pre-analysis

A mandatory step specific to the Cyber package. It assesses the company's level of exposure and maturity, and frames the project scope before any quote.

Step specific to the Cybersecurity package

Weeks 3 to 4

Choice of package and provider

Selection of the provider and preparation of the quote, within the range of €3,000 to €25,000 excluding VAT, consistent with the priorities identified in the pre-analysis.

Quote aligned with the pre-analysis

Week 4

Submission of the application

The House of Entrepreneurship and eHandwierk Cybersecurity Service teams support the preparation of the application, which is filed with the Ministry of the Economy.

Application prepared with the chamber's adviser

Weeks 5 to 10

Ministerial review and approval

The Ministry of the Economy reviews the application and decides whether to grant the aid.

Do not buy anything. In cybersecurity, urgency pushes companies to act fast. Any order or payment made before the approval notification exposes the expense to exclusion from funding. If a threat requires immediate action, it must be handled outside the application, and the subsidised project built alongside it.

Months 3 to 6

Implementation by the provider

The provider deploys the cybersecurity tool and procedures, with testing and staff training.

Quote and invoice consistency

Months 5 to 7

Evaluation meeting with the Luxembourg House of Cybersecurity

The final evaluation meeting is held with the Luxembourg House of Cybersecurity. This is the second mandatory point of contact with this body in the process.

Step specific to the Cybersecurity package

Months 6 to 8

Reimbursement

The company is reimbursed 70% of the eligible costs after the package has been implemented, on presentation of proof of completion and payment.

Payment of the 70%

Source: SME Packages – Cybersecurity fact sheet, guichet.public.lu, which states that the company must go through a pre-analysis by the Luxembourg House of Cybersecurity and that an evaluation meeting with this body takes place. The time ranges are the firm's estimates.

03 · Regulatory context By the end of this section, you will know whether NIS2 affects you directly or indirectly

NIS2 in Luxembourg: what can the Cybersecurity package help you prepare for?

The package's official fact sheet explicitly states that it supports companies in their compliance with the NIS2 Directive. The Luxembourg context changed in 2026, which shifts the subject from comfort to obligation for some companies.

The state of Luxembourg law

NIS2 was transposed in Luxembourg by the law of 5 May 2026 on measures for a high common level of cybersecurity. The Institut Luxembourgeois de Régulation (ILR) is the competent authority for most sectors, with the CSSF competent for the banking sector and financial market infrastructures, and entities concerned are required to register. Entities within scope are divided into essential and important categories, based on a sector test and a size criterion.

This page does not provide legal advice. Whether a company falls under NIS2, its classification as an essential or important entity and its reporting obligations require a legal analysis specific to each situation, to be carried out with a specialist adviser or directly with the competent authority.

Support is not compliance. The package funds assistance with compliance work: gap analysis, technical measures, procedures, training. It does not by itself make the company NIS2-compliant and is neither an attestation nor a certification. Actual regulatory compliance depends on the lasting implementation of the measures, the applicable registration and notification obligations, and the assessment of the competent authority.

Why it also concerns SMEs outside the scope

Supply chain effect. Entities subject to NIS2 must manage the risk linked to their suppliers. An SME subcontractor is asked for guarantees it never had to provide before.
Contractual requirements. Security clauses, assessment questionnaires and incident notification commitments are appearing in calls for tender.
Insurability. Cyber insurers increasingly make cover conditional on minimum measures, including tested backups and multi-factor authentication.
Cost of an incident. For an SME, business interruption and data loss structurally cost more than the prevention project.

The most useful financial reading. A €15,000 cybersecurity project excl. VAT, if all expenses are retained, costs €4,500 net after the grant. An SME with twenty employees brought to a standstill for three days loses far more in margin and wages, even before counting data restoration, legal fees and the effect on client relationships. The package does not make cybersecurity free; it brings its cost below the threshold at which the decision becomes a trade-off.

Frame your Cyber project before the pre-analysis

We check your eligibility, your remaining de minimis headroom and the consistency of the scope with the Luxembourg House of Cybersecurity process. Written reply within 48 hours.

Free · no commitment

Frame my Cyber project

04 · Projects and budgets

Which cybersecurity projects are funded, and with what budget?

The budgets below correspond to services observed at Luxembourg SMEs with ten to fifty employees. They exclude hardware and licences, which are in principle not retained. These are indicative ranges, not guaranteed prices.

Security audit and risk analysis

Diagnostic

Asset mapping, vulnerability analysis, review of access rights and configurations, remediation plan prioritised by risk level.

Typical budget excl. VAT€8,000

Grant€5,600

Hardening, MFA and identity management

Protection

Multi-factor authentication, review and segregation of rights, securing remote access, removal of dormant accounts and shared access.

Typical budget excl. VAT€12,000

Grant€8,400

3-2-1 backup and tested restore

Resilience

Overhaul of the backup strategy, offline copy, documented restore procedure and, above all, one tested in real conditions. The point that decides survival after ransomware.

Typical budget excl. VAT€11,000

Grant€7,700

Incident response and continuity plan

Procedures

Detection and escalation procedure, roles and contacts, decision chain, continuity and recovery plan, simulation exercise with management.

Typical budget excl. VAT€10,000

Grant€7,000

Awareness and simulated phishing

Human factor

Awareness programme, simulated phishing campaigns, click-rate measurement, targeted sessions for the most exposed functions such as accounting and management.

Typical budget excl. VAT€7,000

Grant€4,900

NIS2 compliance pathway

Governance

Gap analysis against NIS2 requirements, security policy, governance and management responsibilities, documented compliance roadmap.

Typical budget excl. VAT€18,000

Grant€12,600

Theoretical scale, if all costs in the quote are retained
Service excl. VAT	Grant at 70%	Actual net cost
€3,000 (scheme floor)	€2,100	€900
€8,000	€5,600	€2,400
€15,000	€10,500	€4,500
€20,000	€14,000	€6,000
€25,000 (scheme ceiling)	€17,500	€7,500

Recommended sequencing when the need exceeds the ceiling: start with the audit and priority remediation in a first Cyber project, then address governance and compliance in a second one, or move the tooling part to the Digital package when it relates to the management system. Each project must be genuinely separate, without double funding, validated separately, and the whole must remain below the ceiling of €300,000 of de minimis aid per single undertaking over any rolling three-year period. None of these patterns is guaranteed in advance.

05 · Grounds for rejection

Why is an SME Package Cybersecurity application refused?

The mistakes that block an application

Skipping the Luxembourg House of Cybersecurity pre-analysis. A mistake specific to this package, and a blocking one.
Buying in a hurry before approval, a frequent reflex after an incident.
A quote made up mainly of licences and hardware, with little service.
A project presented as GDPR compliance work with no cybersecurity dimension.
A recurring managed service presented as a one-off project.
A scope disconnected from the priorities identified in the pre-analysis.
An incomplete de minimis declaration over the rolling three-year period, linked undertakings included.

What gets an application through

A scope derived from the pre-analysis and not from a supplier catalogue.
A quote centred on the service: audit, implementation, procedures, training.
Named deliverables: audit report, tested restore procedure, incident response plan.
An explicit link with NIS2 where the company is affected directly or through its subcontracting chain.
A timetable with no early start.
A complete application at first submission.

We check the completeness and consistency of each document before submission. The decision to grant the aid rests exclusively with the Ministry of the Economy.

Frequently asked questions

SME Package Cybersecurity: answers to the most common questions

How much is the SME Package Cybersecurity worth?

The SME Package Cybersecurity funds 70% of the eligible costs of a service worth between €3,000 and €25,000 excluding VAT, i.e. a maximum grant of €17,500. The reimbursement is paid after the package has been implemented.

Is the Luxembourg House of Cybersecurity pre-analysis mandatory?

Yes, the Luxembourg House of Cybersecurity pre-analysis is mandatory for the SME Package Cybersecurity. This is what sets the Cyber package apart. The company first contacts the House of Entrepreneurship or the eHandwierk Cybersecurity Service, and must then go through a pre-analysis by the Luxembourg House of Cybersecurity. The final evaluation meeting is also held with this body. The Digital, AI and Service packages do not include this two-step process.

Is a firewall or antivirus funded?

In principle, no: a firewall, an antivirus or a licence purchased on its own is not retained by the SME Package Cybersecurity, according to our reading of the conditions. What is covered is the service: audit, configuration, hardening, drafting of procedures, testing and training. A balanced quote keeps licences outside the cost base rather than trying to include them. The treatment of each item is confirmed during the pre-analysis.

Is GDPR compliance work covered by the Cyber package?

Not as such: GDPR compliance work is not, in itself, an SME Package Cybersecurity project. The package targets protection against cyberattacks, the implementation of cybersecurity technologies and procedures, and NIS2 compliance. GDPR measures are retained when they concern data security and fall within the cyber scope validated during the pre-analysis.

Is my company covered by NIS2?

Whether a company is covered by NIS2 depends on its sector of activity and its size, under the Luxembourg law of 5 May 2026 transposing the directive. The Institut Luxembourgeois de Régulation is the competent authority for most sectors, and the CSSF for the banking sector and financial market infrastructures. This page does not provide legal advice: the analysis must be carried out case by case, with a specialist adviser or with the ILR. Many SMEs are also affected indirectly, through the requirements passed on to them by their clients that are subject to NIS2.

Can a penetration test be funded?

Yes, a penetration test can be funded by the SME Package Cybersecurity, subject to validation in the pre-analysis: it is a service, in line with the logic of the scheme. Its relevance, however, depends on the company's maturity: for an SME without tested backups or multi-factor authentication, a configuration audit and a remediation plan deliver more value. The pre-analysis settles this prioritisation.

Can we start before approval if the company has just been attacked?

No, not for the subsidised part: even after a cyberattack, an expense incurred before the approval notification can in principle not be funded by the SME Package Cybersecurity. The practical answer is to handle the emergency outside the application, then build the structural strengthening project within the package, on a scope separate from the emergency remediation.

Can Cybersecurity be combined with another package?

Yes, the Cybersecurity package can be combined with another package, but not automatically. Several packages can be requested for separate projects, without double funding of the same expenses, with each application approved before work starts and within the ceiling of €300,000 of de minimis aid per single undertaking (linked undertakings included) over any rolling three-year period set by Regulation (EU) 2023/2831. A common pattern combines a Cyber project with a Digital or AI project.

How long does the Cyber process take?

The SME Package Cybersecurity process generally takes four to eight months, as an indication, i.e. slightly longer than the other packages, as the double pre-analysis and the evaluation meeting with the Luxembourg House of Cybersecurity add coordination points. These durations are observed on our own files and do not constitute a commitment by the administration.

What about the accounting side? Accounting and tax treatment of the grant, pre-financing the project, tracking your de minimis ceiling: the firm behind this guide covers the accounting angle of the SME Packages.

SME Packages accounting guide Accountant in Luxembourg

Verification

Where can you check this information in the official sources?

This guide is an independent private document. It does not come from the Luxembourg administration, does not constitute a decision to grant aid and does not provide legal advice on NIS2 compliance.

Make smepackages.lu a preferred source on Google to see our regulatory updates on the SME Packages first.

Take action

Your free eligibility diagnostic, within 48 hours

We check your SME status, your business permit, your remaining de minimis headroom and whether the project fits the right package. You leave with a written answer, whether or not we work together.

Or directly: +352 661 198 544 · Data processed by Financial Services Luxembourg SARL-S to answer your request, via our e-mail delivery providers (Resend, or failing that FormSubmit), never resold. Privacy policy (in French).