Approved for Phase B of the Cyber PME program: how does it work and what do we get out of it?

The most valuable takeaway from this program is the official audit trail. Down the line, when corporate clients or insurance brokers send you cybersecurity questionnaires for a policy, proving you completed a state-accredited process directly improves your premiums and customer trust.

We finished the same phase last year. We paid around 11,500 EUR, matched by a similar amount in state support. The whole thing took about four months. The most time-consuming part was isolating our internal backups on a separate network and running phishing simulations on the staff.

Get your current IT support provider in the room right away. Since the expert assigned for Phase B won't be doing hands-on deployments, your IT provider will be the one executing the specs. Run your meetings jointly from day one to avoid technical friction between them.

Keep an eye on the consultant's neutrality. Some experts try to steer you toward specific commercial security packages during Phase B. Make sure the specs are written neutrally and don't bundle in unnecessarily expensive subscriptions.

Were there any critical, urgent vulnerabilities in the phase one report? The Phase B grant approval can sometimes take a few weeks, so if it's an obvious internet-facing vulnerability, you might need to patch it urgently without waiting for the subsidy.

don't be intimidated at all, it's one of the most straightforward grants for small businesses in France but the only thing you need to watch out for is uploading the invoice and technical closing report to the portal on time, the rest runs like clockwork.

edit: I wrote something wrong above, sorry about that.

the paperwork might seem overwhelming at first but the accredited consultant shows you step by step how to submit the file anyway. definitely dont give up imo the budget contribution is great.

Let me summarize the topic, since several different answers were given. Don't hesitate to ask; those who don't ask always pay more.

Good luck with that.

Timely topic. Hasty decisions become decisions you have to fix six months later.

Good luck with that.

To get into the details: If 2FA is on, a stolen password alone is useless.

I'm also curious if anyone does it differently.

I'd appreciate it if you shared the outcome.

The opposite happened to me that's why I'm writing. Just because everyone does it doesn't mean it's right.

Proven by experience.

I went through the same thing two years ago. The harder it is to reverse a decision, the slower you should make it.

If you don't write this down from the start, it leads to arguments later. Good luck with that.

We've heard this a lot, but it never happened like that for us. Taking measures without an inventory leaves doors you haven't seen open.

That's all, sorry if I went on too long.

Im a small business, let me explain from my side. The answer varies greatly by industry; there is no one-size-fits-all rule.

Everything goes well for the first three months; problems arise in the fourth... Proven by experience.

Great work. Your time to detect an issue directly determines its cost.

Most incidents start with a leaked password, not a vulnerability.

I went through the same thing two years ago. The real issue isn't the number, but what it's based on.

Proven by experience.

I think it's hard to be that definitive about cyber pme phase b. Most time waste accumulates in tasks waiting for approval.

If you have questions, write them; I'll answer as best I can.