CIPHER Open Call 1

CIPHER Open Call 1 is a cascade-funding opportunity under the Digital Europe Programme (Grant Agreement 101249732) to validate and integrate cybersecurity solutions into the CIPHER testing ecosystem. The reported total open-call budget is approximately €4.32 million and selected beneficiaries are expected to receive support for about nine months through a milestone-driven programme. The call covers five specialised challenges across Knowledge, Testing and Range/Enablement modes (K1, K2, T1, T2, R1, P1) including NIS2 compliance audits, industrial pentest benchmarking, S3 WORM pipeline validation, XDR telemetry ingestion, sector-emulation cyber ranges and Infrastructure as Code automation. Electronic submission deadline is 6 January 2027 at 22:00 UTC and applicants must consult the official call documents and the F6S/European Commission portals for eligibility, funding ceilings and application templates.

Scope — what is funded

Focused technical challenges

Cascade funding for short, applied cybersecurity projects that plug into the CIPHER platform. Supported activities include testbed experiments, automated threat-detection refinement, vulnerability assessments, telemetry ingestion validation for an XDR SaaS, NIS2 Article 21(2) compliance audits, industrial pentest benchmarking, sector-emulation cyber ranges, and Infrastructure as Code automation for range deployment.

Footnotes

1. 1Official open-call documentation, templates and application link available at cipher-eu.com and the EU portal listing: CIPHER Open Call 1

Summary

CIPHER Open Call 1 is a cascade funding multi-topic call launched under the CIPHER project (Cybersecurity Intelligence, Protection, and Holistic Enterprise Resilience), grant agreement number 101249732. The call funds short 9-month activities across five specialised challenges grouped in three operational modes: Knowledge, Testing, and Range/Enablement. The total funding envelope for this open call is €4,320,000. Selected beneficiaries join a structured, milestone-driven programme consisting of three Sprints. The call is single-stage with electronic submission through the F6S platform and a mandatory administrative and technical screening followed by remote evaluation and interviews. Official documentation and application templates are available online CIPHER Open Call 1 1.

Scope, Tasks and Supported Activities

The call supports activities to strengthen preparedness and mutual assistance targeting larger industrial operations and installations. Supported activities include running testbed experiments, refining automated threat detection, performing vulnerability assessments, establishing secure information sharing systems, and deploying cross-border simulation exercises. The technical task catalogue is organised into five specialised challenges across three operational modes: Knowledge, Testing, Range/Enablement.

Eligibility and Applicants

The call is cascade funding managed by the CIPHER consortium. Applicants must comply with the administrative and technical eligibility criteria defined in the call documentation. Proposals are submitted via the F6S portal. The call targets organisations capable of delivering cybersecurity experimentation, assessments, software/tool integration, and cyber range or IaC artefacts.

Funding, Financial Model and Requirements

This open call uses cascade funding where the CIPHER consortium distributes sub-grants to successful applicants. The primary financial mechanism is grant-based sub-awards paid to individual beneficiaries after onboarding and milestone achievement. The initial tranche is 20% on Month 1 after onboarding, followed by milestone-driven payments across the 9-month programme.

Application and Evaluation Process

Applications must be submitted electronically through the F6S platform before the deadline (06 January 2027, 17:00 CET per F6S instructions). The process comprises an administrative eligibility check and a binary technical scope screening by the CIPHER consortium, then remote evaluation by independent experts, scoring across Excellence, Relevance, Impact, and Implementation, followed by interviews for shortlisted candidates, KYC checks, and Sub-grant Agreement signature.

Target Sectors and Project Maturity

The call targets cybersecurity applications focused on industrial operations, critical infrastructure, and large installations. Technical focus areas include NIS2 compliance, industrial penetration testing, vulnerability pipelines (including object store WORM vulnerabilities), XDR telemetry ingestion, cyber ranges, and Infrastructure as Code automation for emulation and orchestration.

Application Content and Templates

Applicants must use the templates and documentation provided by the CIPHER consortium on the call webpage. The scraped content mentions availability of official documentation packages, guidelines, and application templates at cipher-eu.com and implies structured application fields aligned with evaluation criteria (Excellence, Relevance, Impact, Implementation).

Practical Notes and Submission Requirements

Explicitly Mentioned Countries and Programme Context

The scraped call text does not enumerate specific eligible countries. The call is published on the European Commission Funding & Tenders Portal under the DIGITAL programme DIGITAL-ECCC and sits within the Horizon 2021-2027 context, implying relevance to EU Member States and Horizon-associated countries. Applicants should verify country eligibility in the call documentation.

How This Opportunity Should Be Interpreted

CIPHER Open Call 1 is a targeted cascade funding opportunity to accelerate practical cybersecurity solutions for large industrial operations, combining compliance auditing, penetration-testing benchmarking, vulnerability pipeline validation, telemetry ingestion testing for XDR platforms, and cyber range and IaC enablement. The funding is distributed as sub-grants after a structured evaluation and KYC onboarding process. The programme emphasises short, milestone-driven activity with early partial payment and expects technically mature proposals that can integrate with the CIPHER automated toolchain or provide operational emulation assets. Applicants should use the F6S platform, follow provided templates, and consult the official open call documentation for precise financial ceilings, eligibility rules, and submission forms 1.

Footnotes

1. 1Official CIPHER Open Call 1 documentation, templates, and guidance available at cipher-eu.com and the EU Funding & Tenders Portal opportunity page: ec.europa.eu

Opportunity overview

CIPHER Open Call 1 is a cascade-funding opportunity under the Digital Europe Programme that supports external organisations in validating and integrating cybersecurity solutions into the CIPHER ecosystem. CIPHER is developing a collaborative, standardised and available-as-a-service testing facility for security strategies and enablers used in critical infrastructure and essential service environments. The project is funded under Grant Agreement 101249732 and is coordinated for open-call implementation by F6S Network Ireland Limited. Official EU Funding and Tenders Portal CIPHER project

The call is associated with the Digital Europe topic DIGITAL-ECCC, concerning preparedness support and mutual assistance for larger industrial operations and installations. The wider CIPHER project runs for 36 months from 1 December 2025 to 30 November 2028. Project information

Key facts

The reported total open-call budget of approximately €4.3 million and the reported nine-month support period come from public project and funding-call listings. The official call documents should be treated as controlling for the final budget allocation, maximum amount per beneficiary, payment schedule and contractual duration. Call listing CIPHER project information

Scope and challenge structure

The opportunity is organised around five specialised challenge areas delivered through three operational modes. Applicants are expected to provide a concrete cybersecurity capability, service, test activity or automation component that can be evaluated in a CIPHER environment and produce usable results for critical-sector resilience.

The metadata describes five specialised challenge labels but lists six individual activities because the range and enablement mode contains both R1 and P1. Applicants should therefore verify whether R1 and P1 are separate submission tracks, alternative tasks within one track, or separate work packages in the official guide.

Who should apply

The publicly available CIPHER project information identifies innovative small and medium-sized enterprises as the principal target of the open calls. The programme is intended to bring external cybersecurity tools and capabilities into the CIPHER ecosystem, with particular relevance for solution providers serving essential service operators, industrial organisations, auditors and critical-infrastructure stakeholders. CIPHER project announcement

Potentially relevant applicant profiles include the following:

The available public material does not establish whether applicants must apply as single legal entities, whether consortia are allowed, or which exact countries and legal-entity categories are eligible. These points must be checked in the official call conditions before submission. Applicants should also confirm whether eligibility is restricted to SMEs, whether universities, research organisations or larger companies may participate, and whether subcontracting is permitted.

Expected activities and outputs

Selected applicants are likely to undertake a defined validation or integration assignment rather than a conventional research project. The work should demonstrate that the proposed capability can operate with CIPHER components, address a specified cybersecurity challenge, and generate evidence useful to the project and its critical-sector use cases.

Funding and financial conditions

Public listings indicate an overall open-call budget of approximately €4.3 million. No reliable public result available for this analysis confirms the maximum grant per applicant, the number of beneficiaries, the exact funding rate, eligible-cost categories, payment instalments, pre-financing arrangements or whether support is provided as a fixed amount, lump sum or reimbursement of actual costs.

Applicants should not assume that the total budget represents the amount available to each applicant. The official call guide and financial annex should be checked for the following items:

Duration and implementation

The public opportunity listing describes the selected support as a nine-month programme. The precise start date is not confirmed in the available material and may differ between challenges or beneficiaries. Applicants should plan for rapid mobilisation after selection, including technical onboarding, access approvals, integration work, testing, reporting and final demonstration.

The nine-month period appears to concern the cascade-funded beneficiary activity and should not be confused with the 36-month duration of the overall CIPHER project. The beneficiary agreement should be checked for start-date conditions, extension rules, milestones, deliverables, review points and consequences of delayed implementation.

Likely eligibility and compliance considerations

The precise legal, financial and country eligibility criteria are not present in the available scraped material. They must be verified against the official competitive-call page, call documents, annexes and any applicant guide before relying on the opportunity for a submission decision.

Evaluation and selection considerations

Although the detailed evaluation rubric was not available in the collected material, proposals are likely to be assessed against their fit with the selected challenge, technical quality, feasibility within the support period, interoperability with CIPHER, cybersecurity value, relevance to critical infrastructure and capacity to deliver measurable results.

Application preparation checklist

Strategic assessment

This is a targeted market-entry and technology-validation opportunity rather than a broad cybersecurity research call. It is most suitable for an organisation that already has a usable capability and can demonstrate integration, testing or operational value within approximately nine months.

The strongest applications are likely to combine a narrow and technically credible challenge fit with rapid deployment readiness, measurable validation outcomes and a clear contribution to NIS2-related assurance, industrial cyber resilience or critical-sector testing. Applicants should avoid generic descriptions of cybersecurity products and instead explain the exact CIPHER interface, activity, evidence and benefit that will be delivered.

Source and verification note

The deadline and challenge description are taken from the opportunity metadata supplied for this analysis. Public project materials confirm CIPHER's Digital Europe funding, 36-month project duration, critical-infrastructure focus, open-call mechanism and SME orientation. The reported open-call budget, opening date and nine-month period are corroborated by public secondary listings but should be verified against the official competitive-call documents before submission. Official call page CIPHER about page Funding listing