Filter Search for grants
Call Navigation
Call key data
Uptake of innovative cybersecurity solutions for SMEs
Funding Program
Digital Europe
Call number
DIGITAL-ECCC-2025-DEPLOY-CYBER-09-UPTAKE
deadlines
Opening
28.10.2025
Deadline
31.03.2026 17:00
Funding rate
50% (SME:75%)
Call budget
€ 15,000,000.00
Estimated EU contribution per project
€ 3,000,000.00
Link to the call
Link to the submission
Call content
short description
The action aims at improving industrial and market readiness for the cybersecurity requirements for SMEs as specified in relevant EU cybersecurity legislation, for instance, as set in the Cyber Resilience Act ensuring more secure hardware and software products.
Call objectives
Proposals should contribute to achieving at least one of these objectives:
- Availability of innovative tools and services that support SMEs in complying with the EU cybersecurity legislation.
- Availability of innovative tools and services that support SMEs in reporting incidents and in assisting with recovery if possible, and in exchanging with competent authorities (i.e. cooperation with Cyber Hubs, CSIRTs (including in relation to the CSIRT Network) and/or ISACs, for e.g. highly critical and other critical sectors entities).
- Improved security and notification processes and means in the EU.
- Improved security of network and information systems in the EU.
- Industrial and market readiness for the proposed Cyber Resilience Act.
- Support for Cybersecurity certification in line with the Cybersecurity Act.
- Support for supply chain partners in standardised self-assessments and certifications. Helping downstream supply chain partners in a step-by-step approach to increase cyber resilience.
- Overcome the challenge of finding the technical skills required to deal with a complex technology landscape that relies heavily on extensive configurations and capabilities.
- Cyber toolkit as a service to support for SMEs managing cyber risks, defining, and implementing their cybersecurity strategy, including several functions dedicated to risk assessment, vulnerabilities and threats detection, etc.
- Support and incident response capabilities to SMEs.
read more
Expected effects and impacts
KPIs to measure outcomes and deliverables
Applicants shall provide KPI’s and metrics relevant for the action to measure progress and performance. Proposals may include the indicators listed below or those of their choice. When applicable, baseline and target values must be provided.
- Number of entities benefitting from project activities.
- Number of cybersecurity new technologies deployed in operational environments.
- Number of innovative tools and services that support SMEs in reporting incidents, assisting with recovery and in exchanging with competent authorities.
- Number of cybersecurity tools and services that support SMEs in managing cyber risks, defining, and implementing their cybersecurity strategy, including risk assessment, vulnerabilities and threats detection.
Targeted stakeholders
This topic targets in particular SMEs but other applicants, such as private and public entities implementing NIS 2 Directive, Cyber Resilience Act, research and academia and end-users can be also considered.
Submissions from consortia, despite not mandatory, will positively contribute to the impact of the action.
read more
Expected results
The development of a cyber toolkit as a service to support SMEs managing cyber risks, defining, and implementing their cybersecurity strategy. The toolkit could include at least one of the following:
- Interfaces that will connect to existing SaaS applications such as HR, invoice and financial management, CRM and accounting systems, etc., which are often used by SMEs for increasing their cybersecurity.
- A functionality that enables the mapping and maintenance of an SME’s digital assets and possible vulnerabilities by interfacing with other SaaS applications that manage an asset inventory and data repositories.
- A function that supports the assessment and management of an SME’s cybersecurity risks and of supply chain risk management. This function should perform a risk assessment, provide recommendations for risk mitigation, and identify options.
- An interface to existing tools that support the analysis and assessment of the extent of an SME’s cyber risk based on information gathered from digital infrastructure scanning and data provided by authorised users.
- A function that issues alerts on vulnerabilities and threats based on the information collected by the risk management function.
- A function that connects SMEs to a CSIRT or a Cyber Hub to report an incident and assist with recovery if possible.
- A mapping and one-stop window/portal to existing tools and solutions targeting cybersecurity support to SMEs.
- Tools supporting detection, prevention and response in Operational Technology infrastructures using open standards or technologies.
Support and incident response capabilities to SMEs:
- Non-commercial cybersecurity hotline with a standardised framework and guidelines for response times, escalation procedures, and the scope of assistance provided.
- A fully operational, multilingual helpline that provides timely and accurate cybersecurity assistance to SMEs, leading to reduced successful cyber scams and improved digital hygiene.
- A National Cyber Response Platform for first cyber responders to exchange their experiences, share relevant news and engage discussions regarding challenges and emerging cyber threats complementary to existing cyber crisis management structures.
- Specialised training modules for first (public and private) responders’ services targeting different sectors such as healthcare, finance, energy, and transportation.
Support tools and platforms:
- Control Centre and Panel on Incident Reporting and dispatching of incident responders.
- SME user interface for Incident reporting associated with the cyber toolkit. Users can report an incident, get instructions on how to react and obtain information on how to receive support for the response. An AI assistant connected to a Control Centre could also be included.
- Interfaces with the National Authorities and Cross-Border Platforms (CBPs) for incident notification and information sharing.
read more
Eligibility Criteria
Regions / countries for funding
Iceland (Ísland), Liechtenstein, Norway (Norge)
eligible entities
Education and training institution, Non-Profit Organisation (NPO) / Non-Governmental Organisation (NGO), Other, Private institution, incl. private company (private for profit), Public Body (national, regional and local; incl. EGTCs), Research Institution incl. University, Small and medium-sized enterprise (SME)
Mandatory partnership
No
Project Partnership
In order to be eligible, the applicants (beneficiaries and affiliated entities) must:
- be legal entities (public or private bodies)
- be established in one of the eligible countries, i.e.:
- EU Member States (including overseas countries and territories (OCTs))
- EEA countries (Norway, Iceland, Liechtenstein)
Other entities may participate in other consortium roles, such as associated partners, subcontractors, third parties giving in-kind contributions, etc. Please note however that all topics of this call are subject to restrictions due to security reasons, therefore entities must not be directly or indirectly controlled from a country that is not an eligible country. All entities will have to fill in and submit a declaration on ownership and control.
Moreover:
- participation in any capacity (as beneficiary, affiliated entity, associated partner, subcontractor or recipient of financial support to third parties) is limited to entities established in and controlled from eligible countries
- project activities (included subcontracted work) must take place in eligible countries
- financial support to third parties is not allowed in any topic under this call
other eligibility criteria
Specific cases
Natural persons are NOT eligible (with the exception of self-employed persons, i.e. sole traders, where the company does not have legal personality separate from that of the natural person).
International organisations are NOT eligible, unless they are International organisations of European Interest within the meaning of Article 2 of the Digital Europe Regulation (i.e. international organisations the majority of whose members are Member States or whose headquarters are in a Member State).
Entities which do not have legal personality under their national law may exceptionally participate, provided that their representatives have the capacity to undertake legal obligations on their behalf, and offer guarantees for the protection of the EU financial interests equivalent to that offered by legal persons.
EU bodies (with the exception of the European Commission Joint Research Centre) can NOT be part of the consortium.
Entities composed of members may participate as ‘sole beneficiaries’ or ‘beneficiaries without legal personality’. Please note that if the action will be implemented by the members, they should also participate (either as beneficiaries or as affiliated entities, otherwise their costs will NOT be eligible).
Beneficiaries from countries with ongoing negotiations for participating in the programme (see list of participating countries above) may participate in the call and can sign grants if the negotiations are concluded before grant signature and if the association covers the call (i.e. is retroactive and covers both the part of the programme and the year when the call was launched).
Special rules apply for entities subject to EU restrictive measures under Article 29 of the Treaty on the European Union (TEU) and Article 215 of the Treaty on the Functioning of the EU (TFEU). Such entities are not eligible to participate in any capacity, including as beneficiaries, affiliated entities, associated partners, subcontractors or recipients of financial support to third parties (if any).
Special rules apply for entities subject to measures adopted on the basis of EU Regulation 2020/2092. Such entities are not eligible to participate in any funded role (beneficiaries, affiliated entities, subcontractors, recipients of financial support to third parties, etc). Currently such measures are in place for Hungarian public interest trusts established under the Hungarian Act IX of 2021 or any entity they maintain (see Council Implementing Decision (EU) 2022/2506, as of 16 December 2022).
Additional information
Topics
Relevance for EU Macro-Region
EUSAIR - EU Strategy for the Adriatic and Ionian Region, EUSALP - EU Strategy for the Alpine Space, EUSBSR - EU Strategy for the Baltic Sea Region, EUSDR - EU Strategy for the Danube Region
UN Sustainable Development Goals (UN-SDGs)
project duration
36 months
Additional Information
Applications must be submitted electronically via the Funders & Tenders Portal electronic submission system (accessible via the topic page in the Search Funding & Tenders section). Paper submissions are NOT possible.
Proposals must be complete and contain all the requested information and all required annexes and supporting documents:
- Application Form Part A — contains administrative information about the participants (future coordinator, beneficiaries and affiliated entities) and the summarised budget for the project (to be filled in directly online)
- Application Form Part B — contains the technical description of the project (template to be downloaded from the Portal Submission System, completed, assembled and re-uploaded)
- mandatory annexes and supporting documents (templates to be downloaded from the Portal Submission System, completed, assembled and re-uploaded):
- ownership control declarations (including for associated partners and subcontractors)
Proposals are limited to maximum 70 pages (Part B).
Call documents
DIGITAL-ECCC-2025-DEPLOY-CYBER-09DIGITAL-ECCC-2025-DEPLOY-CYBER-09(808kB)
Contact
Website
European Cybersecurity Competence Centre and Network (ECCC) - National Coordination Centres
applicants@eccc.europa.eu
Website
To see more information about this call, you can register for free here
or log in with an existing account.
Log in
Register now


