Coordinated preparedness testing and other preparedness actions

Digital Europe Programme call DIGITAL-ECCC funds coordinated preparedness testing and other cyber preparedness actions for highly critical and other critical sectors under the Cyber Solidarity Act and the Cybersecurity Emergency Mechanism. Topic budget is €15,000,000 with an indicative grant size of around €1,500,000 per project, a funding rate of 50 percent, single-stage submission via the EU Funding & Tenders Portal and a deadline of 14 January 2027 at 17:00 Brussels time. Eligible applicants include national competent authorities (National Cybersecurity Authorities, CSIRTs), Security Operation Centres, Cyber Hubs, critical sector operators, research organisations and cybersecurity service providers, including SMEs and consortia. Funded activities cover penetration testing, cyber ranges and cross-border exercises, threat and risk assessments, continuous risk and vulnerability monitoring, coordinated vulnerability disclosure, and training aligned with the European Cybersecurity Skills Framework.

Call: Strengthening European Cybersecurity Technologies, Capacities and Preparedness

Type and deadline

Call for proposals DIGITAL-ECCC. Single-stage submission. Deadline 14 January 2027 (Brussels time). Apply via the Funding & Tenders Portal Topic page. ¹

What it funds:Actions to increase preparedness and resilience across sectors of high criticality: coordinated preparedness testing (including penetration tests covering ICT and OT/ICS), threat and risk assessment services, deployment of cyber-ranges and testing facilities, continuous risk monitoring and attack surface/vulnerability monitoring, coordinated vulnerability disclosure, exercises, training and skills development, and onboarding to CEF cybersecurity core services.

1. 1Part 1: Coordinated preparedness testing across sectors of high criticality (penetration testing, sector stress tests, capability evaluation).
2. 2Part 2: Other preparedness actions for highly critical and other critical sectors (vulnerability monitoring, CVD coordination, exercises, training, supply-chain risk management).

Who can apply:legal entities established in eligible countries as defined in the call document (public bodies, national competent authorities and CSIRTs, SOCs/Cyber Hubs, research organisations, industry stakeholders including ISACs, SMEs and start-ups). Proposals should target support to Member State competent authorities and critical/essential entities under NIS2 and the Cyber Solidarity Act; consult the call document for precise eligibility rules.

Grant modality and practical notes:DIGITAL JU Simple Grants (Digital Europe Programme). Single-stage submission; follow page limits and templates in the application form (Part B). National Cybersecurity Coordination Centres (NCCs) are recommended contact points for support during preparation.

Footnotes

1. 1Full call text, conditions, templates and application portal: DIGITAL-ECCC Call details.

Call summary and objectives

Call title:Strengthening European Cybersecurity Technologies, Capacities and Preparedness. Topic identifier: DIGITAL-ECCC. Programme: Digital Europe Programme (DIGITAL). Type of action: DIGITAL JU Simple Grants. Type of model grant agreement: DIGITAL Action Grant Budget-Based (DIGITAL-AG). Opening date: 01 September 2026. Submission deadline: 14 January 2027, 17:00 Brussels time. Deadline model: single-stage. Submission via the EU Funding & Tenders Portal.

Expected outcomes:Deliverables split in two parts. Part 1: enhanced cooperation, preparedness and cybersecurity resilience in the EU through preparedness support services; threat assessment and risk assessment services. Part 2: risk monitoring services; better compliance and coordinated vulnerability disclosure and monitoring; improved skills via exercises, training courses, events, workshops; stakeholder consultations and white papers.

Overall objective:Support implementation of two Cyber Solidarity Act actions linked to the Cybersecurity Emergency Mechanism: (1) coordinated preparedness testing across the Union for entities in sectors of high criticality, including penetration testing and threat assessment covering ICT and Operational Technology/Industrial Control Systems (OT/ICS); and (2) other preparedness actions for entities in sectors of high criticality and other critical sectors (vulnerability monitoring, exercises, training). Proposals must complement Member States and Union-level efforts and provide knowledge and expertise to improve preparedness of critical industrial installations and infrastructures.

Scope and eligible activities (detailed)

The topic explicitly covers two parts with overlapping service categories. Applicants may target one or both parts as defined in the call document. Activities and services described below are required and are to be provided for entities identified by the Commission under the Cyber Solidarity Act, drawn from the Sectors of High Criticality (Annex I to Directive (EU) 2022/2555) and, for Part 2, also from other critical sectors (Annex II to NIS2) where relevant.

1. 1Part 1 — Coordinated preparedness testing: development of penetration testing scenarios (covering networks, applications, virtualisation, cloud, industrial control systems, IoT); conducting testing of essential entities operating critical infrastructure to identify potential vulnerabilities; deployment of digital tools and infrastructures (standardised cyber-ranges or other testing facilities) to execute testing and cross-border cyber-exercises; evaluation and stress-testing of MS entities and sectors using maturity models and compliance schemes; supply chain security evaluation; consulting services with recommendations to improve infrastructure security; support for implementation of threat assessment processes and customised risk-scenario analysis targeted at MS competent authorities (CSIRTs, National Cybersecurity Authorities).
2. 2Part 2 — Other preparedness actions: includes services listed in Part 1 plus supply chain risk management in risk assessments; continuous risk monitoring services (attack surface monitoring, asset and vulnerability monitoring); coordinated vulnerability disclosure and management (promote national CVD policies and the EU Vulnerability Database, coordinate disclosure and patch dissemination, standardisation of information sharing, CVD applications integrating multiple vulnerability sources); awareness raising on vulnerability management best practices; comprehensive exercises and training programmes and international workshops for cybersecurity professionals (based on the European Cybersecurity Skills Framework); maturity checks and continuous learning activities aligned with EU regulatory requirements (NIS2, CSA, CSoA, DORA, EECC, GDPR, CRA).
3. 3Support activities may include onboarding organisations to the CEF Cybersecurity Core Service Platforms; targeted support for industry uptake with emphasis on start-ups and SMEs to realise market opportunities created by the Cyber Resilience Act; assistance to implement elements of NIS2.

Eligibility, application and administrative conditions

Full eligibility criteria, admissibility conditions (page limits and layout), eligible countries, other eligibility conditions, operational and financial capacity checks, exclusion grounds, evaluation and award procedures, scoring and thresholds, timelines, legal and financial setup are described in the call document and associated annexes. Applicants must consult and follow the Application Form templates and the DEP MGA and other call-specific documents. Pre-submission guidance: contact your National Cybersecurity Coordination Centre (NCC) or the ECCC Applicants Direct Contact Centre at applicants@eccc.europa.eu. Submission is through the Portal; once started, the selected model of MGA and ToA cannot be changed in the submission system.

Admissibility, forms and page limits:Proposal Part B (technical description) must be completed using the DEP application form template. Standard page limit guidance applies (normally 70 pages unless otherwise stated in call document). Formatting rules (font size, margins, A4) must be respected. Supporting documents can be provided as annexes and do not count towards the page limit. See application form templates available in the Submission System Call document and application templates ¹.

Budget and expected grant size

This topic is part of a suite of related topics under DIGITAL-ECCC-2027-DEPLOY-CYBER-11. The dedicated budget for the COORDPREP action in 2026 is €15,000,000. Indicative number of grants: c. 10. Indicative contribution per grant: around €1,500,000 (the call documents list expected grants and contribution ranges per sub-topic). Applicants must consult the call document for precise financial rules, funding rate, eligible cost categories and budget breakdown rules. Detailed budget map for the topic shows minimum and maximum contributions and expected numbers of grants per related topic; for COORDPREP the call-level estimate is around €1,500,000 per grant.

Who can apply and recommended applicant types

Detailed eligibility of legal entities and eligible countries is described in section 6 of the call document. The Funding & Tenders Portal standard eligible countries list applies unless the call document specifies restrictions. Applicants should verify the exact eligibility of their country and legal entity type in the call document and the Portal Participant Register. The topic explicitly targets public authorities and operational cybersecurity bodies as beneficiaries or target recipients of services (e.g. National Cybersecurity Authorities, CSIRTs, sectoral CSIRTs, Security Operation Centres, Cyber Hubs) and public/private critical sector operators.

1. 1Eligible applicant types (typical and recommended): national competent authorities (CSIRTs, National Cybersecurity Authorities), public bodies, research organisations, universities, cybersecurity centres, industry consortia, large enterprises operating critical infrastructure, SMEs (including cybersecurity start-ups), trusted private-sector security vendors, non-profit organisations with cybersecurity competence, public-private partnerships.
2. 2Targeted participants/beneficiaries of the services: CSIRTs (national and sectoral), Security Operation Centres (SOC)/Cyber Hubs, highly critical and other critical sector operators (energy, transport, health care, telecoms, water, etc.), industry stakeholders including ISACs, start-ups and SMEs requiring uptake support.

Funding type, consortium requirement and application mode

Funding type:grant (budget-based action grant under the Digital Europe Programme). Consortium requirement: single-stage single submission; the topic is managed as DIGITAL JU Simple Grants. The call documents indicate whether single beneficiaries or consortia are required for each sub-action; applicants must check section 6 of the call document for other eligibility conditions (e.g. minimum number of beneficiaries or restrictions). Submission mode: open call (competitive), single-stage. Application must be submitted electronically through the Funding & Tenders Portal Submission System using the DEP application form (Part A via online forms, Part B uploaded as PDF and annexes).

Beneficiary geographic scope:Primary geographic eligibility: EU Member States and other eligible countries as listed in the call document and the Funding & Tenders Portal Participant Register (EU/EEA and associated countries). The call directs applicants to national NCCs; the Network of NCCs includes one centre from each of the 27 EU Member States plus Iceland and Norway, indicating strong emphasis on EU/EEA participation and alignment with Member State authorities.

Target sectors and project maturity

Target sectors:critical infrastructure sectors and sub-sectors listed in Annex I (Sectors of High Criticality) and Annex II of the NIS2 Directive. Examples: energy (electricity grid systems), transport & mobility, health care, telecommunications, water, digital infrastructure, manufacturing and industrial control systems. The topic explicitly covers ICT and OT/ICS environments and supply chain risk across digital technology and industrial control system domains.

1. 1Target sector keywords (from call metadata): Cybersecurity, Critical Infrastructure Protection, Cyber Exercises, Cyber Ranges, Cyber Training, Incident Readiness, Penetration Testing, Preparedness Testing, Risk Assessment, Supply Chain Security, Vulnerability Management, Security Evaluation, Energy, Transport, Health care, ICT, Industrial Control Systems, IoT.

Project stage and expected maturity:Expected project maturity: from development/validation through demonstration up to deployment and consolidation of preparedness services. Projects should be implementation-focused and operationally mature enough to deliver testing services, cyber-range deployments, continuous risk monitoring, vulnerability disclosure coordination, exercises and training at an operational level for critical entities and national competent authorities.

Evaluation, selection and contractual framework

Evaluation, award criteria, scoring and thresholds, indicative timeline for evaluation and grant agreement preparation are described in the call document (sections 8 and 9, and section 4 for the timeline). Applicants must follow the DEP Model Grant Agreement (DEP MGA) and the Application Form. The evaluation follows standard Portal and Digital Europe rules; scoring typically covers relevance, implementation, impact and quality. The call is single-stage: proposals are evaluated once and successful applicants proceed to grant preparation.

1. 1Application stages: single-stage submission and evaluation (1 main stage).
2. 2Indicative contractual steps: submission via Portal, administrative checks, eligibility checks, expert evaluation, ranking and award decision, grant preparation and signature under DEP MGA (Digital Action Grant Budget-Based).

Success rates and expected competition:Success rates are not published for this specific call. Indicative number of grants for COORDPREP is around 10 from a €15 million earmark; competition is expected to be strong given the operational focus and EU-wide remit. Applicants should assume selective competition and ensure strong alignment with call objectives and operational capacity.

Co-funding, forms of support and eligible costs

Co-funding requirement:applicants must consult the call document for the exact funding rate and co-funding rules. Digital Europe actions are typically budget-based grants with a defined funding rate and eligible cost categories (personnel, subcontracting, purchase costs including travel and equipment, other cost categories such as financial support to third parties where allowed, and indirect costs). The DEP MGA and application templates describe detailed cost eligibility, record-keeping, time recording and audit requirements. The call metadata indicates grants are budget-based and to be paid as action grants under DIGITAL-AG.

Nature of support:Beneficiaries receive monetary grants (budget-based). In addition to funding, beneficiaries will receive non-monetary benefits derived from EU collaboration such as access to NCC network, potential onboarding support to CEF Cybersecurity Core Service Platforms, visibility and policy-level engagement. The call may permit provision of financial support to third parties in some related topics where explicitly allowed in the call document.

Application form structure and templates

Applications must be prepared using the EU Grants DEP Application Form. The form has two parts: Part A (administrative fields entered via the Portal Submission System) and Part B (narrative technical description to be downloaded, completed and re-uploaded as PDF). The Application Form template (DEP) includes mandatory sections and guidance. Key structure items applicants must prepare and include are described below; applicants should use the provided templates and the Submission System to ensure compliance.

1. 1Application Form Part A (online): administrative information; participant legal and contact details; budget summary; declarations; ethics and security checklists. Complete via Portal screens.
2. 2Application Form Part B (PDF upload): Technical Description cover page and table of contents; Project summary; 1. Relevance (objectives, policy alignment, digital technology supply chain, financial obstacles); 2. Implementation (maturity, implementation plan, management, quality assurance, risks, capacity and consortium roles); 3. Impact (expected outcomes, dissemination and communication, competitiveness, societal benefits, environmental sustainability); 4. Work plan, work packages, activities, deliverables, milestones, staff effort, subcontracting, purchases and equipment, other cost categories, timetable; 5. Other (ethics, security); 6. Declarations; Annexes (detailed budget table where required, CVs, list of previous projects, ownership/control declaration, supporting documents).
3. 3Mandatory supporting templates: Ownership control declaration; Model Grant Agreement (DEP MGA); annotated MGA guidance; Application form templates and Part B DEP PDF template; if financial statement certificates will be needed they are described in DEP MGA and Data Sheet for the awarded grant.
4. 4Formatting constraints: page limits (normally 70 pages for Part B unless otherwise specified), font minimum Arial 9, A4 pages, margins at least 15 mm. Excess pages will be hidden automatically by the Portal and not evaluated.
5. 5Declaration requirements: Each participant must confirm eligibility, non-exclusion, and financial and operational capacity in the online Part A declarations. Ownership/control documentation may be requested at validation stage.

Key practical recommendations for applicants

1. 1Engage early with your National Cybersecurity Coordination Centre (NCC) for guidance and to ensure national alignment and facilitation.
2. 2Read and follow the Call document and all annexes carefully. All eligibility, admissibility and evaluation rules are set there.
3. 3Use the DEP Application Form templates exactly as provided. Ensure Part B fits within page limits and all mandatory sections are addressed (relevance, implementation, impact, work plan, budget justification and ethics/security where applicable).
4. 4Demonstrate operational capacity and experience to run penetration testing at scale across ICT and OT/ICS environments, to deploy or operate cyber-ranges, to run cross-border exercises, threat and supply-chain risk assessment services, continuous risk monitoring operations, vulnerability disclosure coordination, and professional training programs aligned with ECSF.
5. 5Provide clear deliverables, milestones, KPIs and sustainability plan for continuation of preparedness services after grant completion. Include cross-border collaboration mechanisms and how the work complements Member State activities without duplication.
6. 6Prepare ownership/control declarations and ensure participant register (PIC) data are up to date in the Portal.

Eligible countries and stakeholders explicitly mentioned

The call references EU Member States and the Network of National Coordination Centres (NCCs) which includes the 27 EU Member States plus Iceland and Norway. The call specifically targets entities covered by NIS2 high criticality sectors (Annex I) and other critical sectors (Annex II). The call text and supporting documents reference Member States broadly; therefore geographic eligibility follows the standard Funding & Tenders Portal eligible countries list unless otherwise specified in the call document.

1. 1Explicitly mentioned countries or regions: EU Member States (27), Iceland, Norway (via the NCC network).
2. 2Region: European Union / EEA (applicants should consult call document section 6 for eligible country list).

Success metrics, reporting and post-award requirements

Awarded projects must comply with DEP MGA reporting, audit and record-keeping rules. Continuous reporting via the Portal Continuous Reporting tool is required for deliverables and progress indicators. Periodic technical and financial reporting timelines are set in the grant Data Sheet and DEP MGA; deadlines for periodic reporting and payment are defined in the grant agreement. Records and original supporting documents must be kept for the retention period set in the Data Sheet and DEP MGA. Certificates on financial statements (CFS) may be required at final payment if thresholds are reached; exact thresholds are in DEP MGA and Data Sheet.

Security, ethics and confidentiality:Projects will be required to comply with security and ethics requirements described in the call document and DEP MGA. Sensitive or classified information handling follows Decision 2015/444 and relevant implementing rules. Confidential information must be protected; any deliverables with classified content follow special submission procedures agreed with the granting authority.

Summary: What this opportunity is about and how to explain it

This Digital Europe call funds operational activities to raise EU-level cyber preparedness across critical sectors by supporting coordinated preparedness testing (including penetration testing covering ICT and OT/ICS), threat and risk assessment services, cross-border cyber-ranges and testing infrastructures, continuous risk monitoring, coordinated vulnerability disclosure and vulnerability management, and large-scale training and exercises aligned with the European Cybersecurity Skills Framework. The action is explicitly designed to complement Member State activities and the Cyber Solidarity Act Cybersecurity Emergency Mechanism, assisting national authorities (CSIRTs, National Cybersecurity Authorities), sectoral actors, SOCs/Cyber Hubs and critical operators to increase maturity, resilience and cross-border coordination. It provides budget-based grants (indicative grant ~€1.5M for this sub-topic) to organisations (public bodies, research organisations, cybersecurity providers, consortia of competent authorities and private sector stakeholders including SMEs) able to deliver operational services at scale. Applicants must submit a single-stage proposal via the Funding & Tenders Portal using the DEP application form templates and comply with DEP MGA, call-specific eligibility and evaluation criteria, reporting, audit and record-keeping obligations. Successful proposals will deliver concrete preparedness services, demonstrators, exercises and training, and coordinate with national NCCs and relevant EU cybersecurity platforms and policy instruments to avoid duplication and maximise impact. See the call document and the Portal for the official full conditions and templates Call page ¹.

Footnotes

1. 1Full call document, application templates, DEP Model Grant Agreement and related reference documents are available on the EU Funding & Tenders Portal: ec.europa.eu

This is a Digital Europe Programme call under Strengthening European Cybersecurity Technologies, Capacities and Preparedness that funds coordinated preparedness testing and broader cyber preparedness actions for critical sectors and related authorities. It is a single stage call under the DIGITAL JU Simple Grants scheme and the submission deadline is 14 January 2027 at 17:00 Brussels time.[3][14]

Funding Snapshot

What the Call Funds

The call covers two action areas under the Cyber Solidarity Act and the Cybersecurity Emergency Mechanism. Part 1 covers coordinated preparedness testing for entities operating in sectors of high criticality, including penetration testing, threat assessment and testing across ICT and operational technology or industrial control systems. Part 2 funds other preparedness actions for entities in highly critical and other critical sectors, including vulnerability monitoring, coordinated vulnerability disclosure, exercises, training and risk management services.[3][7][14]

• Penetration testing scenarios for networks, applications, virtualisation, cloud, industrial control systems and IoT[3]
• Testing support for essential entities operating critical infrastructure[3]
• Digital tools and cyber ranges or other testing facilities to run exercises, including cross border scenarios where relevant[3]
• Evaluation and stress testing of cybersecurity capabilities at Member State, sector and entity level, including supply chain risk evaluation[3]
• Threat assessment and customised risk scenario analysis[3]
• Risk monitoring services such as attack surface, asset and vulnerability monitoring[3][7]
• Coordinated vulnerability disclosure, vulnerability management and use of the EU Vulnerability Database[3][7]
• Exercises, training courses, workshops, events and stakeholder consultations based on the European Cybersecurity Skills Framework[3]

Who Can Apply

The call is aimed primarily at competent authorities in Member States, especially National Cybersecurity Authorities and CSIRTs, including sectoral CSIRTs. It also targets Security Operation Centres, Cyber Hubs, organisations in highly critical and other critical sectors, industry stakeholders including ISACs, and other actors within the scope of NIS 2, DORA, the Cybersecurity Act and related EU frameworks.[3][7]

The topic also mentions support for public and private organisations working on NIS 2 implementation and potential users of the CEF Cybersecurity Core Service Platforms, as well as support for start ups and SMEs to capture market opportunities created by the Cyber Resilience Act.[3]

Eligibility and Proposal Conditions

Admissibility conditions, eligible countries, other eligibility conditions, financial and operational capacity checks, evaluation procedures, award criteria, the indicative evaluation timeline and the legal and financial set up are all set out in the call document and the application form templates. The call is open for submission and uses a single stage procedure.[3][14]

Applicants are advised by the Commission to contact the National Cybersecurity Coordination Centre in their country where available, or the ECCC Applicants Direct Contact Centre at applicants@eccc.europa.eu for guidance.[3][14]

Practical Assessment

This is a focused implementation grant for organisations with strong technical and operational cybersecurity capacity, especially those able to deliver testing environments, risk monitoring, vulnerability coordination, training or sector specific preparedness services at European scale. The fixed indicative budget and expected project size suggest that proposals should be substantial, collaborative and clearly linked to critical infrastructure resilience and NIS 2 implementation.[3][14]

The opportunity is most relevant for public cybersecurity bodies, national coordination structures, sectoral response organisations, specialised cyber service providers and consortia combining operational expertise, sector access and training or testbed capabilities.[3][7][14]