Filter Search for grants
Call Navigation
Call key data
Coordinated preparedness testing and other preparedness actions
Funding Program
Digital Europe
Call number
DIGITAL-ECCC-2025-DEPLOY-CYBER-09-COORDPREP
deadlines
Opening
28.10.2025
Deadline
31.03.2026 17:00
Funding rate
50%
Call budget
€ 10,000,000.00
Estimated EU contribution per project
€ 1,500,000.00
Link to the call
Link to the submission
Call content
short description
This topic covers actions from the Cyber Solidarity Act, dedicated to the Cybersecurity Emergency Mechanism, namely coordinated preparedness testing of entities operating in sectors of high criticality across the Union, specifically the health sector, and in particular hospitals, and the digital infrastructure sector, including electronic communication sector, and in particular fixed networks and submarine cable infrastructure.
Call objectives
These actions aim to complement and not duplicate efforts by Member States and those at Union level to increase the level of protection and resilience to cyber threats, in particular for critical industrial installations and infrastructures, by assisting Member States in their efforts to improve their preparedness for cyber threats and incidents by providing them with knowledge and expertise.
Proposals should contribute to achieving coordinated preparedness testing of entities operating in sectors of high criticality across the Union (including penetration testing and threat assessment) considering ICT as well as Operational Technology/Industrial Control Systems.
The provision of preparedness support services shall include the activities listed below, for entities in the sector or sub-sector as identified by the Commission in accordance with the Cyber Solidarity Act, from the Sectors of High Criticality listed in Annex I to Directive (EU) 2022/2555 and specified in the call for proposal document for each of the calls under this topic.
For 2025 the selected sectors are the health and in particular hospitals and the digital infrastructure sector, including electronic communications and in particular fixed networks and submarine cable infrastructures.
Applications may cover more than one sector. Selected proposals, at call level, will have to cover all selected sectors and sub-sectors.
The scope includes support for testing for potential vulnerabilities:
- Development of penetration testing scenarios. The proposed scenarios may cover Networks, Applications, Virtualisation solutions, Cloud solutions, Industrial Control systems, and IoT.
- Support for conducting testing of essential and important entities operating critical infrastructure for potential vulnerabilities (vulnerability scanning).
- Support for the deployment of digital tools and infrastructures enabling the execution of testing scenarios and for conducting exercises such as the development of standardised cyber-ranges or other testing facilities, able to mimic features of highly critical sectors (Annex I to Directive (EU) 2022/2555) to facilitate the execution of cyber-exercises, in particular within cross-border scenarios where relevant.
- Evaluation, including security audits, and/or testing of cybersecurity capabilities of MS entities and MS sectors (including capabilities to prevent, detect and respond to incidents and stress test of the entire sectors), evaluation and compliance activities aimed at increasing maturity, e.g. on the basis of established maturity models and/or relevant evaluation and compliance schemes.
- Evaluation, including security audits, and/or testing of cybersecurity capabilities of entities in scope (including for the evaluation and management of risks concerning the supply chain).
- Consulting services, providing recommendations on how to improve infrastructure security and capabilities.
Support for threat assessment and risk assessment, such as:
- Threat Assessment process implementation and life cycle
- Customised risk scenarios analysis
The support will target the competent authorities in the Member States, which play a central role in the implementation of the NIS 2 Directive, such as Computer Security Incident Response Teams (CSIRTs) and National Cybersecurity Authorities.
The Cyber Solidarity Act provides as well that the coordinated preparedness testing should be conducted using common risk scenarios and methodologies that should be developed by the NIS Cooperation Group in cooperation with the Commission, EEAS, ENISA and, within the remit of its mandate, EU-CyCLONe.
Risk scenarios are a key component for engaging in coordinated preparedness testing activities. Building on risks and vulnerabilities previously identified in sectorial, national and/or EU level risk assessments, risk scenarios support and guide coordinated preparedness testing by providing “what-if” situations where the effect of risks materialising is measured.
Risk scenario development typically incorporates features such as severity, likelihood and escalation levels over a baseline. Aggravation levels stages are key to realistically assessing resilience under increasing pressure. A gradual aggravation of severity can be delivered either by scaling the impact of a single scenario or layering either multiple sub-scenarios or attack vectors together for each variation.
The proposed risk scenarios for this call are in 3 different critical sectors:
- For health sector – risk scenarios affecting hospitals;
- For digital infrastructure sector – risk scenarios affecting submarine cable infrastructures;
- For digital infrastructure sector – risk scenarios affecting fixed networks.
Risk scenarios are detailed in chapter 4 of the annex 3. They adopt a multi-layer approach by using a baseline scenario and two additional scenarios (with aggravation levels), each compounding on the previous one.
Annex 3 proposes as well as a methodology that could be used in the coordinated preparedness testing in the three sub-sectors. The methodology could differ between the three sub-sectors.
Each applicant may choose among the proposed risk scenarios what they would use for the national action (included in the proposal). However, the proposal should include at least one baseline scenario (which is the first one for each three sub-sectors in annex 3). Applicants may adapt the scenarios and include elements based on their national context, on top of the general EU-wide risk scenarios. Member State may choose to include higher intensity scenarios proposed in annex 3. For the national action, applicants are encouraged to explore systemic risks by covering also the supply chain dimension and interdependencies.
Applicants may also consider expanding the risk scenarios to reflect the cumulative effects of multiple, possibly smaller, incidents. These may include incidents affecting individual organisations as well as supply chain disruptions occurring in parallel with the main scenario. Furthermore, applicants are encouraged to balance the focus across different types of incidents, including system failures, human error, malicious acts, and natural phenomena.
Results of the coordinated preparedness testing could be integrated in the remediation plan of the tested entity and shall be sent to the Member State authority to review the results of the action. These lessons learned should be shared, in an anonymised and aggregated form, with the Commission. A follow-up discussion could take place in the relevant workstreams of the NIS Cooperation Group.
Coordinated preparedness testing has 3 main phases:
- Systemic risk analysis phase - In this phase a more high-level systemic risk assessment:
- Identify key stakeholders
- Decide on scope
- Refine risk scenarios
- Testing phase - In this phase the testing takes place. This can take the form of:
- Vulnerability Scanning
- Security Audits
- Penetration Testing
- Exercises
- (Cyber Resilience) Stress Tests
- C. Gap analysis phase- In this phase the coordinated preparedness test results are converted to actionable recommendations:
- Identify gaps
- Recommendations
- Action plan
read more
Expected effects and impacts
KPIs to measure outcomes and deliverables
Applicants shall provide KPI’s and metrics relevant for the action to measure progress and performance.
Proposals may include the indicators listed below or those of their choice. When applicable, baseline and target values must be provided.
- number of penetration tests provided
- number of essential and important entities supported
- number of threat assessments / risk scenario analyses carried out
- number of risk monitoring services provided
- number of potential users covered per test/exercise
- number and nature of vulnerabilities discovered
- number of cross-border actions/exercises
Targeted stakeholders
Public bodies acting as cybersecurity competent authorities or CSIRTs. Public bodies subject to the NIS 2 Directive, CRA, CSA, CSoA, DORA etc.
Submissions from consortia, despite not mandatory, will positively contribute to the impact of the action.
read more
Expected results
- Enhanced cooperation, preparedness and cybersecurity resilience in the EU; preparedness support services
- Services such as: threat assessment, risk assessment services, security audits, scanning for vulnerabilities, exercises, stress tests of the entire or part of the sectors.
Eligibility Criteria
Regions / countries for funding
Iceland (Ísland), Liechtenstein, Norway (Norge)
eligible entities
Education and training institution, Non-Profit Organisation (NPO) / Non-Governmental Organisation (NGO), Other, Private institution, incl. private company (private for profit), Public Body (national, regional and local; incl. EGTCs), Research Institution incl. University, Small and medium-sized enterprise (SME)
Mandatory partnership
No
Project Partnership
In order to be eligible, the applicants (beneficiaries and affiliated entities) must:
- be legal entities (public or private bodies)
- be established in one of the eligible countries, i.e.:
- EU Member States (including overseas countries and territories (OCTs))
- EEA countries (Norway, Iceland, Liechtenstein)
Other entities may participate in other consortium roles, such as associated partners, subcontractors, third parties giving in-kind contributions, etc. Please note however that all topics of this call are subject to restrictions due to security reasons, therefore entities must not be directly or indirectly controlled from a country that is not an eligible country. All entities will have to fill in and submit a declaration on ownership and control.
Moreover:
- participation in any capacity (as beneficiary, affiliated entity, associated partner, subcontractor or recipient of financial support to third parties) is limited to entities established in and controlled from eligible countries
- project activities (included subcontracted work) must take place in eligible countries
- financial support to third parties is not allowed in any topic under this call
other eligibility criteria
Specific cases
Natural persons are NOT eligible (with the exception of self-employed persons, i.e. sole traders, where the company does not have legal personality separate from that of the natural person).
International organisations are NOT eligible, unless they are International organisations of European Interest within the meaning of Article 2 of the Digital Europe Regulation (i.e. international organisations the majority of whose members are Member States or whose headquarters are in a Member State).
Entities which do not have legal personality under their national law may exceptionally participate, provided that their representatives have the capacity to undertake legal obligations on their behalf, and offer guarantees for the protection of the EU financial interests equivalent to that offered by legal persons.
EU bodies (with the exception of the European Commission Joint Research Centre) can NOT be part of the consortium.
Entities composed of members may participate as ‘sole beneficiaries’ or ‘beneficiaries without legal personality’. Please note that if the action will be implemented by the members, they should also participate (either as beneficiaries or as affiliated entities, otherwise their costs will NOT be eligible).
Beneficiaries from countries with ongoing negotiations for participating in the programme (see list of participating countries above) may participate in the call and can sign grants if the negotiations are concluded before grant signature and if the association covers the call (i.e. is retroactive and covers both the part of the programme and the year when the call was launched).
Special rules apply for entities subject to EU restrictive measures under Article 29 of the Treaty on the European Union (TEU) and Article 215 of the Treaty on the Functioning of the EU (TFEU). Such entities are not eligible to participate in any capacity, including as beneficiaries, affiliated entities, associated partners, subcontractors or recipients of financial support to third parties (if any).
Special rules apply for entities subject to measures adopted on the basis of EU Regulation 2020/2092. Such entities are not eligible to participate in any funded role (beneficiaries, affiliated entities, subcontractors, recipients of financial support to third parties, etc). Currently such measures are in place for Hungarian public interest trusts established under the Hungarian Act IX of 2021 or any entity they maintain (see Council Implementing Decision (EU) 2022/2506, as of 16 December 2022).
Additional information
Topics
Relevance for EU Macro-Region
EUSAIR - EU Strategy for the Adriatic and Ionian Region, EUSALP - EU Strategy for the Alpine Space, EUSBSR - EU Strategy for the Baltic Sea Region, EUSDR - EU Strategy for the Danube Region
UN Sustainable Development Goals (UN-SDGs)
project duration
24 months
Additional Information
Applications must be submitted electronically via the Funders & Tenders Portal electronic submission system (accessible via the topic page in the Search Funding & Tenders section). Paper submissions are NOT possible.
Proposals must be complete and contain all the requested information and all required annexes and supporting documents:
- Application Form Part A — contains administrative information about the participants (future coordinator, beneficiaries and affiliated entities) and the summarised budget for the project (to be filled in directly online)
- Application Form Part B — contains the technical description of the project (template to be downloaded from the Portal Submission System, completed, assembled and re-uploaded)
- mandatory annexes and supporting documents (templates to be downloaded from the Portal Submission System, completed, assembled and re-uploaded):
- ownership control declarations (including for associated partners and subcontractors)
Proposals are limited to maximum 70 pages (Part B).
Call documents
DIGITAL-ECCC-2025-DEPLOY-CYBER-09DIGITAL-ECCC-2025-DEPLOY-CYBER-09(808kB)
Contact
Website
European Cybersecurity Competence Centre and Network (ECCC) - National Coordination Centres
applicants@eccc.europa.eu
Website
To see more information about this call, you can register for free here
or log in with an existing account.
Log in
Register now



