SECURE - OC#2
Supporting European SMEs in strengthening cybersecurity resilience and achieving compliance with the EU Cyber Resilience Act through targeted security improvements and assessments.
TYPE OF PROJECTS TO BE FUNDED: Projects aimed at strengthening the cybersecurity resilience of European micro, small and medium-sized enterprises (mSMEs) and achieving compliance with the EU Cyber Resilience Act (CRA). Eligible activities include cybersecurity audits, vulnerability assessments, penetration testing, source code analysis, application security improvements, product security upgrades, ICT, IT and operational technology infrastructure improvements, risk and impact assessments, incident detection and management procedures, supply chain security, regulatory compliance activities, cybersecurity training, and the procurement of relevant security goods and professional services. Activities must demonstrably contribute to CRA compliance and improve the security of the applicant's products, processes, technologies, infrastructures or services.
SECTORS / DOMAIN: Cybersecurity, information and communication technologies, digital product security, software and hardware security, ICT and operational technology infrastructure protection, cyber resilience and cybersecurity regulatory compliance. The call targets enterprises operating within the scope of the Cyber Resilience Act rather than specific industrial sectors.
INDIVIDUAL OR CONSORTIUM: Applications must be submitted by individual micro, small or medium-sized enterprises acting independently. Natural persons are generally excluded, except for eligible self-employed persons or sole traders undertaking economic activities.
SPECIFIC ELIGIBILITY REQUIREMENTS: Applicants must qualify as micro, small or medium-sized enterprises under the EU SME definition. Eligible companies must be legally established in an EU Member State or an eligible EEA country, including Norway, Iceland, Liechtenstein and Switzerland, as specified in the call guidelines. Their main business operations or headquarters must be located in an eligible country, their ultimate beneficial owner must be a citizen of an eligible country, and project activities must take place in an eligible country. Applicants must meet applicable ownership and control requirements and demonstrate that their current or future business activities fall, or are expected to fall, within the scope of the Cyber Resilience Act. Company eligibility is subject to verification by the relevant National Cybersecurity Coordination Centre (NCC).
SPECIFIC TOPICS OR CHALLENGES: The call focuses on addressing cybersecurity and compliance gaps associated with the Cyber Resilience Act, including security requirements for products with digital elements, secure product development and maintenance, vulnerability identification and remediation, conformity assessment, cybersecurity risk management, supply chain security, incident response and notification, and improvements to organisational cybersecurity governance. Projects must demonstrate a clear connection between the proposed activities and the applicant's CRA obligations, with measurable objectives, milestones and key performance indicators (KPIs).
PROJECTS DURATION: Maximum 180 calendar days (approximately 6 months) from the signature of the Sub-Grant Agreement.
BUDGET, FUNDING RATES AND PAYMENT CONDITIONS:
Funding rate: 50% of eligible project costs, provided as a lump-sum grant. Applicants must cover the remaining project costs.
Budget conditions / limitations: The total call budget is €11,500,000, with a maximum grant of €30,000 per project.
Payments: Applicants may request optional pre-financing of 40% of the awarded grant at proposal submission, payable following signature of the Sub-Grant Agreement. The remaining 60% is paid after successful project completion and approval of the final Technical Report. Applicants who do not request pre-financing receive the full approved grant following project completion and assessment. Payments depend on the achievement of agreed milestones, deliverables and KPIs. Partial implementation may result in reduced funding, while failure to achieve project objectives may result in non-payment and recovery of pre-financing already received.
Links
Closes
11/12/2026
Max funding per project
30.000€