Reminder: ICT Incident Reporting – Execution Is the Real Challenge
TechnologyThe CSSF has recently reiterated a key message for all supervised entities: if a major ICT-related incident occurs, it must be reported—promptly and without exception.
Luxembourg SMEs can benefit from up to 70% public funding for eligible cybersecurity projects.
Contents
Grant Thornton Luxembourg is now Cybersecurity SME Package Ready. We help businesses take advantage of government-backed digital transformation initiatives.
The new SME Packages, launched by the Luxembourg Ministry of the Economy, offer up to 70% financial support for projects in digitalisation, AI, and cybersecurity - a valuable opportunity for impactful transformation.
Why choose the Cybersecurity SME Package?
- Adopt digital tools and modernise your operations
- Strengthen your cybersecurity resilience
- Leverage AI and innovation to remain competitive
- Enhance your customer experience and business performance
Who is eligible?
- SMEs with a valid business permit from the Ministry of the Economy
- Companies meeting SME criteria (staff, turnover, balance sheet)
- Registered office in Luxembourg
This programme is relevant for Luxembourg-based SMEs seeking to strengthen their cybersecurity posture and address evolving regulatory requirements such as DORA and NIS2.
How Grant Thornton Luxembourg can help?
As a qualified provider, we design, implement, and deliver Cybersecurity SME Package-supported services.
Our experts guide you to assess your eligibility, identify relevant opportunities, and support you throughout the implementation of your projects.
Get in touch to discover how we can support your cybersecurity transformation journey.
Contact
In any case of questions, please contact our CISO & head of Cybersecurity Sabika Ishaq, or our Accounting Partner Gilles Godart.
Related Insights
Important Regulatory Update from the CSSF: Stay Informed and Supported
TechnologyThe Commission de Surveillance du Secteur Financier (CSSF) has issued two Circulars — CSSF 25/893 and CSSF 25/892 — that reinforce Luxembourg’s commitment to implementing the Digital Operational Resilience Act (DORA). These circulars provide a comprehensive regulatory framework for ICT-related incident classification and reporting, as well as for estimating the financial impact of such incidents. Branches in Luxembourg of financial entities whose head office is based in another EU Member State (EU branches) are expected to report major ICT-related incidents, significant cyber threats and their estimations to the competent authority of their home Member State under DORA. As such, they are excluded from the scope of these circulars.
European Supervisory Authorities Publish New Policy Products under DORA
TechnologyThe three European Supervisory Authorities (EBA, EIOPA, and ESMA, collectively known as the ESAs) have unveiled the second batch of policy products under the Digital Operational Resilience Act (DORA). This latest release comprises four final draft regulatory technical standards (RTS), one set of Implementing Technical Standards (ITS), and two guidelines, all designed to bolster the digital operational resilience of the European Union’s financial sector.