Guides

What actually drives the price, what an SME should expect to pay, and how the State scheme can cover 70% of it.

A 30-second answer, the side-by-side, and the precise rule most guidance gets wrong — including what it means for the ILR, the CSSF and threat-led penetration testing.

Registration was due by 10 July 2026. Not registering is a breach in its own right — but coming forward late is a very different position from being found out.

The fines are large; the part that surprises boards is that responsibility lands on them personally — and cannot be fully delegated to an IT provider.

Article 21 in plain terms — what each of the ten measures means, and the difference between claiming a control and proving it.

Two tests decide it — your sector and your size. A third route catches companies below both thresholds, and it is the one most often missed.