October is the European cybersecurity month (ECSM, coordinated by ENISA), run in France under the name Cybermoi/s by Cybermalveillance.gouv.fr with ANSSI. It is the time of year when the most awareness material is available, and therefore the right starting point for structuring a programme. The real constraint in an SME is not the absence of a security representative (that role exists, even part time) but the time that person has available. This article describes a programme that holds together under those conditions: what the texts require, the free public resources, and a twelve-month organisation.
What the texts require
Awareness is not an optional good practice. The NIS2 directive requires the management bodies of the entities concerned to follow cybersecurity training and encourages them to offer equivalent training to their employees (Article 20), and lists cyber hygiene practices and cybersecurity training among the ten minimum measures (Article 21). The AI Act has required, since February 2025, a sufficient level of AI literacy among the people who use AI systems (Article 4). In NIST CSF 2.0, the PR.AT category (awareness and training) expects all personnel to be made aware and specialised roles (IT, management) to receive tailored training. An auditor or a customer assessing the arrangement will look for evidence: dates, content, participation.
The free public resources
Three schemes cover most of the need without a budget. SensCyber, the e-awareness programme from Cybermalveillance.gouv.fr, offers three modules of 25 to 45 minutes (understanding common attacks, adopting the right reflexes, passing them on) with a downloadable completion certificate: an individual, traceable path, which makes it a piece of evidence that can be used directly. The Cybermoi/s kit provides registered organisations each year with communication materials ready to circulate during October. The European month materials from ENISA complete the set in several languages. None of these schemes replaces a programme: they supply the content, not the calendar, nor the adaptation to the company, nor the record of delivery.
One theme per month, a short format
A credible programme on a few hours a month rests on three choices. A single theme at a time: phishing and social engineering, passwords and MFA, data handling and confidentiality, devices and remote work, incident reporting, physical security, AI tools and shadow IT, security culture. This rotation covers in one year the subjects a framework like the CSF expects to see addressed, and naturally places the AI theme as a response to Article 4 of the AI Act. A format proportionate to the subject: an e-learning or a SensCyber module for the fundamentals, a phishing simulation at key moments, a workshop for data handling, a tabletop exercise for incident reporting, a short briefing for physical security. A differentiated audience where relevant: all personnel for the foundation, remote staff for the mobile subjects, managers and IT for role-based practices, management for its own obligation under Article 20 of NIS2.
The calendar anchors on two fixed points: October for the Cybermoi/s campaign (the materials arrive ready to use) and December for an annual review that measures participation and adjusts the following year. The rest spreads over the other months, with a phishing refresher mid-year, since that subject decays the fastest.
The evidence matters as much as the session
What separates a defensible programme from a good intention is the record: a written calendar, an attendance sheet or a participation export per session, the SensCyber certificates, the results of the simulations and of the October quiz, and the minutes of the December review. These elements feed directly into a CSF assessment (PR.AT maturity is measured by regularity and coverage), an ISO 27001 audit (awareness falls under the clause 7 requirements and Annex A) and a customer security questionnaire, which almost always includes a line on staff training.
The kit generated by Komplyo
Komplyo generates an awareness kit personalised to the organisation: materials per theme (the eight subjects above, from phishing to AI tools) with one key message per sequence, and an annual training plan that distributes themes, audiences and formats over twelve months, October campaign and December review included. The kit is meant to be reviewed and adapted before circulation (reporting channel, approved tools, calendar), and the assessment measures the PR.AT category to establish the starting point. The free diagnostic (23 questions, around 5 minutes) gives a first reading.