Fit 4 Cybersecurity programme

Fit 4 Cybersecurity: up to 70% of your cyber assessment funded

A Ministry of the Economy programme run by Luxinnovation and the LHC (often written "Fit4"). Luxgap drafts your quote and guides you at every step, from your application to Luxinnovation until the aid is paid.

Start my file → Am I eligible?

Programme run by Luxinnovation and the LHC, funded by the Ministry of the Economy.

  • Up to 70%of the assessment fees covered (60% for a medium-sized company, 50% for a large one)
  • €1,000 to €100,000of aid per project, on the consultant's fees only, travel costs excluded
  • 6 monthsat most for the mission: vulnerability assessment and costed action plan

Example: small enterprise, assessment at €10,000 excl. VAT in fees: €7,000 in aid, you pay €3,000. Programme caps: €4,500 excl. VAT for phase 1, €1,300 excl. VAT per day. Luxgap charges €850 excl. VAT per day.

How it works

You do two things to get started. We then support you at every step.

  1. You take the Light Cybercheck

    The online self-assessment of the Luxembourg House of Cybersecurity. Its report shows your priority areas. Already done with the L-DIH? Go to step 2.

    Take the Light Cybercheck

  2. You give us your information

    A few minutes, so that we can draft your quote: your company, your contact details, your size. We complete the rest together. We go through your Cybercheck report with you: nothing to send us.

    Start my file

  3. Luxgap then supports you

    At every step, until the aid is paid:

    • the quote, compliant with the programme specifications, unsigned at this stage;
    • your application to Luxinnovation: you submit it yourself on its online form, aides.luxinnovation.lu, with the quote and the documents; we tell you what to gather;
    • the aid application: Luxinnovation submits it on MyGuichet.lu on your behalf and sends you the filing receipt;
    • the mission, 6 months at most, on your premises, then the report and the costed action plan;
    • the payment request: we prepare it with you, you submit it on MyGuichet.lu.

What you do yourself: submit your application to Luxinnovation on its online form, with the documents, sign the power of attorney for Luxinnovation, sign the quote once the filing receipt arrives, pay the invoice and submit the payment request. Nothing is due before the quote is signed.

Useful links

And after the assessment?

  1. Assessment Fit 4: up to 70% covered.
  2. Remediation Other aid possible, for example SME Packages Cyber.
  3. Ongoing security Luxgap services, outside the programme: managed SOC, outsourced CISO, awareness training.

Always apply for aid before starting the work.

Am I eligible?

The programme is open to companies of all sizes that meet all three conditions:

  • hold a valid business permit (autorisation d'établissement) issued by the Ministry of the Economy;
  • have their registered office in Luxembourg;
  • carry out an economic activity as their main activity.

Before anything else, we check with you that the programme matches your real needs. If it does not, we tell you, even if that means no mission for us.

Check in one minute

Five questions, an immediate answer. Your answers are only used to display the result, and none of them identifies you.

Does your company hold a valid business permit (autorisation d'établissement) issued by the Ministry of the Economy?
Is its registered office in Luxembourg?
Is its main activity an economic one, for example selling goods or services?
Have you already signed a quote or started this assessment with a consultant?
Has it received other de minimis aid over the last three years?

Start my file

Three short steps. Only the company, the contact, the size and the Cybercheck are required: we complete the rest together. No document to attach.

Your company
Its size
Size of your company

European definition, companies linked at 25% or more included. When in doubt, choose "I don't know": we check it together with your accounts.

Optional: we complete it together

Figures of the last closed financial year.

Is your company linked to other companies by a shareholding of 25% or more?
Have you received other de minimis aid over the last three years?

For example B123456.

As shown on the autorisation d'établissement.

Your cyber situation
Have you already taken the Light Cybercheck?

Not yet? That is not a blocker: complete it online, then we discuss it together.

Optional: we complete it together
NIS 2 status

Essential or important entity: the assessment will not cover the measures NIS 2 makes mandatory for you.

Priority areas, if you already know them

Activity, number of sites, main systems, deadlines. No passwords or vulnerability details here.

No Google captcha, just a math check.

A question before you start? Contact us or call +352 621 583 116.

The documents of your application

You attach them to your application on the Luxinnovation portal, not to us:

  • an organisation chart showing every company, upstream or downstream, linked by a shareholding of 25% or more, with for each one its FTE, balance sheet total and turnover for the last financial year;
  • the closed annual accounts (balance sheet and profit and loss account) for the last two financial years, and those of the group where applicable;
  • the consultant's unsigned quote (Luxgap drafts it);
  • the Light Cybercheck report;
  • a bank details statement;
  • a power of attorney allowing Luxinnovation to file the application on MyGuichet.lu on your behalf;
  • a sworn statement, which guichet.lu also lists.

This form accepts no files, and no document should be sent to us by email. We go through your Light Cybercheck report with you during our first conversation and keep only your priority areas.

The official steps in detail, and who does what

The official order of the programme. Nothing is signed before step 5.

  1. Take the Light Cybercheck

    You
    You take the LHC online self-assessment and receive a summary report with your priority areas. A Cybercheck already carried out with the L-DIH can stand in for it.
    Luxgap
    We tell you how to access it and answer your questions. The self-assessment is yours: we do not fill it in for you.

  2. Luxgap's quote

    You
    You fill in the form on this page: company, size, priorities. We go through your Light Cybercheck report together during our first conversation: you do not need to send it to us.
    Luxgap
    We check with you that the programme fits your needs and set the scope of the assessment. We then draft a quote that complies with the specifications, unsigned: scope, timeline, team, deliverables, number of days and daily rate (€850 excl. VAT at Luxgap).

  3. Your application on the Luxinnovation portal

    You
    You complete Luxinnovation's application form yourself, at aides.luxinnovation.lu, and attach the documents: the unsigned quote, the Light Cybercheck report, your annual accounts, the chart of linked companies, your bank details and the power of attorney that lets Luxinnovation file the application on MyGuichet.lu.
    Luxgap
    We answer your questions about the form and the quote. The application is yours: we do not fill it in for you.

  4. Luxinnovation files the application

    Luxinnovation and the Ministry
    Based on the information you sent, Luxinnovation checks your eligibility and certifies that the quote complies, then submits the aid application on MyGuichet.lu on your behalf. The digital filing receipt (bordereau) is the proof of filing; Luxinnovation sends you a copy.
    Luxgap
    We answer Luxinnovation's questions about the quote.

  5. Filing receipt: the mission starts

    You
    Once you receive the receipt, you can sign the quote: the mission starts. You can also wait for the Ministry's decision, issued within 2 months of the complete file (extendable by 3 months). During the mission, you appoint a project lead and an available contact.
    Luxgap
    We only start when the quote is signed, never before the receipt. The mission lasts 6 months at most, on your premises, in two phases. Phase 1, In-depth Cybercheck: we complete it with you, then hold at least one workshop to explain the results and agree on priorities. Phase 2, in-depth analysis of one or more priority areas: audits (architecture, backups, physical security, configuration, source code, organisation, GDPR, ISO 27001 or NIS 2 compliance) or penetration test.

  6. Report, then payment of the aid

    Luxgap
    A report written for management: vulnerabilities ranked by severity and impact, corrective measures by priority with an estimated budget, action plan with timeline and resources. Presentation to management and teams; Luxinnovation and the LHC may attend. Then the invoice, in line with the quote, and the payment request, which we prepare with you.
    You
    You complete Luxinnovation's evaluation questionnaire, which is mandatory, and pay the invoice. You then submit the payment request on MyGuichet.lu with the report, the invoice and the proofs of payment, no later than 6 months after the project end date set in the decision.
    Luxinnovation and the Ministry
    The Ministry of the Economy pays the grant.

Frequently asked questions

Do I have to pay anything upfront?

Nothing is due before the quote is signed, which comes after the filing receipt. After that, yes: you pay the consultant's invoice, then the Ministry of the Economy pays the aid on your payment request.

How long does it take?

The Ministry decides within 2 months of receiving the complete file, extendable by 3 months. The mission itself lasts 6 months at most.

Do I need to send you documents?

No. Your annual accounts, bank details and power of attorney go directly to Luxinnovation: you attach them to your application on its portal, aides.luxinnovation.lu. We go through the Light Cybercheck report, which describes your weaknesses, with you during our first conversation: you do not need to send it to us.

My company falls under NIS 2: is it excluded?

No, but the assessment cannot fund the measures NIS 2 makes mandatory for you (for example drafting your risk management policies). The scope then covers other areas, which we set with you. The ILR publishes these measures on its NIS 2 page.

Does the programme fund the implementation of the recommendations?

No: Fit 4 Cybersecurity funds the assessment and the action plan. Luxinnovation then analyses the recommendations to identify other possible aid; always apply for state aid before starting the work.

Sources: guichet.lu, Fit 4 programmes (updated 12 October 2026) and Luxinnovation. The programme may change: only the decisions of Luxinnovation and the Ministry of the Economy are binding.

Start my file →