Across the EU, October is European Cybersecurity Month (ECSM), an annual campaign coordinated by ENISA and the European Commission. It is a good moment to draw attention to cyber-secure behaviour, and to turn it into a programme that does not stop after October.
It is also a moment to ask yourself an honest question: is awareness in your organisation a campaign that starts in October and fades away in November, or a demonstrable part of your management system?
Why a campaign alone is not enough
Human action plays a role in the majority of security incidents. An employee clicks a phishing link, reuses a password or leaves a setting open that should have been closed. Technology catches a lot, but not everything. Behaviour is therefore a control, just like a firewall or multi-factor authentication.
The problem with a one-off campaign is not its content but the lack of follow-up. The posters come down, the quiz is done, and six months later nobody can say who took part, what was learned and whether behaviour actually changed. That last point is exactly what an auditor or regulator wants to know.
What standards and legislation ask of you
Awareness is no longer an optional topic. Three frameworks you will probably recognise:
ISO 27001:2022
Clause 7.2 requires you to determine the necessary competences, fulfil them and retain evidence. Clause 7.3 requires employees to be aware of the information security policy, their own contribution and the consequences of non-compliance. Control 6.3 in Annex A (information security awareness, education and training) makes this concrete: periodic awareness, appropriate to the role, and kept up to date.
Dutch Cybersecurity Act
The Dutch Cybersecurity Act, the national implementation of NIS2, obliges board members of essential and important entities to follow training and keep their knowledge up to date. The Act also encourages organisations to train employees periodically. Demonstrability is central: the board must be able to show that this has been organised.
NEN 7510
For healthcare, NEN 7510, the Dutch information security standard for the health sector, asks the same. Anyone working with patient data must know what is expected of them, and the organisation must be able to substantiate that.
The common denominator: the question is not whether you do awareness, but whether you can demonstrate who learned what, when, and what effect it had.
A programme for October: three steps
Cybersecurity Month is a good starting point for a compact programme you repeat every year. Give every step an owner, a deadline and evidence. A structure that works well in practice:
That way October is not a one-off campaign but the start of a cycle of measurement, registration and repetition. The challenge is rarely the first round; it is keeping it going.
Measuring and recording: how behaviour becomes demonstrable
Do you want to be able to show in December, or at the audit in spring, what October delivered? Then record the following for each activity:
Without these six points, awareness remains a feeling. With them, it becomes a managed control, with evidence.
How uComply helps
Besides advice and help with the three steps, uComply makes it easier to sustain the programme year after year, with the evidence in one place. In uComply you record October's awareness activities as tasks with an owner and a deadline, linked to the corresponding control for control 6.3 and clause 7.2 of ISO 27001, or to the training obligation in the Cbw/NIS2 control framework. Because you link one control to multiple standard requirements, the same campaign counts directly towards ISO 27001, NEN 7510 and the Dutch Cybersecurity Act. Attendance lists from the awareness sessions, the overview of the password manager roll-out and the phishing simulation report are attached to the control as evidence, so the substantiation no longer has to be hunted down at audit time.
With Reminders and scheduled tasks you plan the annual repetition once as a series; uComply automatically reminds the owner before the deadline and tasks simply appear in Outlook. The Flightdeck dashboard shows the implementation status of the controls and progress per standard, so management and the board can see that awareness is not a loose activity but a working control. For the content, the templates for communication plans and awareness activities in the content packs help you get started.
Summary
Cybersecurity Month starts on 1 October 2026 and is a good moment to put awareness on the agenda. Organise what a one-off campaign does not provide: awareness sessions, a password manager for everyone, a phishing simulation as the measurement, evidence linked to the standard and a fixed annual repetition. That way you satisfy ISO 27001, NEN 7510 and the Dutch Cybersecurity Act with the same effort, and you can show it. uComply makes it easy to give the programme continuity.
Ready to get started? Contact us for a no-obligation quote for a phishing campaign, a password manager or an awareness session. Curious how to embed awareness as a demonstrable control in your management system? Book a no-obligation demo.
