Cross-border Cyber Hubs

Forthcoming Digital Europe Programme call DIGITAL-ECCC for Cross-border Cyber Hubs supports establishment of multinational operational platforms pooling cybersecurity threat data across Member States. Planned opening is 15 October 2026 with a provisional submission deadline of 16 March 2027, the topic shows an indicative budget of €2 million and indicative funding rates of 75 percent for the joint procurement component and 50 percent for the grant component. Applications must address two linked workstreams (joint procurement and grant) and grants will only be awarded if the joint procurement evaluation succeeds. Participation is subject to security and ownership restrictions under Article 12(5) of Regulation (EU) 2021/694 pending the ECCC mapping exercise.

What it funds

Purpose

Use the official call page and annexes for full eligibility, budget details, application templates and security requirements: EU Funding & Tenders Portal — Cross-border Cyber Hubs. 1

Footnotes

1. 1Call page and documents (application form, ownership/control declaration, model grant agreement, work programme) are available via the Funding & Tenders Portal topic page above.

Call summary and purpose

This call under the Digital Europe Programme (implemented by the European Cybersecurity Competence Centre ECCC) funds the creation and strengthening of Cross-Border Cyber Hubs across the EU. The intended outcome is world-class Cross-Border Cyber Hubs enabling pooling of cybersecurity data across several Member States, secure infrastructures, advanced data analytics for detection, storage and sharing of cyber threat intelligence (CTI), cooperation with CSIRTs and the CSIRTs network, operational synergies with Copernicus Security Service for maritime/satellite data, and the option to monitor undersea infrastructure (submarine cables).

Structured extraction: eligibility, funding and processes

Key technical and operational expectations

Core technology, standards and operational components expected and explicitly recommended in proposals: secure and highly available infrastructures for CTI pooling; advanced data analytics and large-scale processing; automation and orchestration for CTI sharing and advisory automation; adoption or interoperability with well-established open CTI standards (e.g. MISP standard for CTI sharing), machine-readable advisory standard CSAF for advisories and automation, use of message collection/processing tools (e.g. IntelMQ) and EU standardisation initiatives (EUVD, EU certification streams). Consideration of AI/ML tools for detection and CTI generation, secure-by-design and secure-AI principles, privacy-preserving processing (anonymisation) and GDPR compliance, crypto-agility and post-quantum readiness (PQC migration pathways). Operational integration with national CSIRTs, EU-CyCLONe and the CSIRTs Network is required for sharing early warnings and situational information. Where monitoring undersea infrastructure is proposed, operational synergies with EU Copernicus Space Programme Security Service and in-situ sea-based sensors and satellite imagery are expected.

Budget, funding mechanics and co-investment overview

Procurement, evaluation and award process

Practical advice and required content in applications

Key references and standards

The MISP, CSAF and IntelMQ references are specifically called out in the topic description as well-established standards to consider for CTI sharing, automation and advisory automation. Proposals should demonstrate compatibility and use of open standards where feasible, and provide justification where proprietary or specialised solutions are required.

Security, restrictions and legal framework

Footnotes

1. 1Call topic Digital Europe Programme: Cross-border Cyber Hubs DIGITAL-ECCC. Full topic description, conditions and call documents are available on the EU Funding & Tenders Portal Cross-border Cyber Hubs topic.

Opportunity identification

This is a forthcoming Digital Europe Programme call for proposals under the European Cybersecurity Competence Centre cybersecurity work programme. The topic reference is DIGITAL-ECCC and the action type is DIGITAL-JU-SIMPLE DIGITAL JU Simple Grants under a budget-based DIGITAL Action Grant. 1

The opportunity supports the creation or strengthening of Cross-border Cyber Hubs that pool cybersecurity threat data from several Member States and provide secure, advanced capabilities for threat detection, analysis, storage, intelligence sharing, reporting and coordinated situational awareness.

The action is closely linked to the Cyber Solidarity Act and the planned European Cybersecurity Alert System. Cross-border Cyber Hubs are intended to operate as multinational operational platforms connecting national authorities, National Cyber Hubs, CERTs and CSIRTs, ISACs, operators of critical infrastructure and other trusted cybersecurity stakeholders. 2

Key dates and status

The call is forthcoming. The planned opening date is 15 October 2026 and the submission deadline is 16 March 2027 at 17:00 Brussels time. It uses a single-stage submission procedure.

The deadline should be treated as provisional until the official call document and submission system confirm the final timetable. The Funding and Tenders Portal states that the submission system is planned to open on the date shown in the topic header.

Funding summary

The topic budget shown for Cross-border Cyber Hubs is €2 million for budget year 2026. The portal does not publish an indicative number of grants or a minimum or maximum contribution per selected project. The €2 million should therefore be treated as the total indicative EU contribution available for this topic, rather than as an automatic award amount for each applicant.

A separate National Cyber Hubs topic under the same call family also shows a €2 million contribution. That amount is distinct from the €2 million allocated to Cross-border Cyber Hubs and should not be added to an individual Cross-border Cyber Hub application.

The work programme provides the following indicative funding rates for Cyber Hubs and Cross-border Cyber Hubs: 75 percent for the joint procurement component and 50 percent for the grant component. 3

Funding element

Joint procurement action

EU support is indicated at 75 percent of eligible procurement costs, subject to the final call documents, procurement arrangements and approved budget. The procurement component is implemented jointly with the participating Member State or Member States and covers the infrastructure, equipment, tools and services required to establish the Cross-border Cyber Hub.

Grant for building and operating the hub

EU support is indicated at 50 percent of eligible grant costs. The grant may cover preparatory work, hub establishment, stakeholder cooperation, operationalisation, personnel and running costs associated with operating the hub and using the infrastructure and services acquired through the joint procurement.

Co-financing and cash flow

Applicants should plan for the non-funded share of eligible costs and for costs that may be ineligible under the grant agreement or procurement rules. The final financial model, eligible cost categories, payment arrangements and reporting requirements must be checked in the call document and the DIGITAL Model Grant Agreement. The published information does not state whether a pre-financing payment will be made or specify the precise payment schedule.

Purpose and expected results

The opportunity aims to establish world-class Cross-border Cyber Hubs across the Union with highly secure infrastructure and advanced data analytics capabilities. The hubs should enable several Member States to pool large volumes of cybersecurity data, including data generated by consortium members, and use it to improve detection, analysis, prevention, response and threat intelligence.

Expected results include the following:

Eligible strategic and technical scope

The proposed hub should be designed as additional capacity that complements, rather than duplicates, existing Security Operations Centres, National or other Cyber Hubs, CSIRTs, ISACs and relevant cybersecurity actors. The call is aimed mainly at new Cross-border Cyber Hubs, although supporting activities involving SOC platforms financed under earlier Digital Europe work programmes may be included where they are necessary for effective collaboration.

Applicants should consider established open standards and interoperable technologies for cyber threat intelligence and security information exchange. Examples identified in the topic include the MISP standard for threat intelligence, the Common Security Advisory Framework for machine-processable security advisories and IntelMQ for cybersecurity-related messaging.

Possible technical capabilities include network and infrastructure monitoring, threat intelligence ingestion, correlation and enrichment, advanced analytics, automated detection, secure data exchange, incident reporting, dashboards, alerting, secure storage, access control, auditability and integration with national and European cybersecurity networks.

The scope may also include surveillance and protection of critical undersea infrastructure, including submarine cables, and detection of malicious activity around such infrastructure. Activities in this area may use sea-based sensor data and satellite imagery and should create operational synergies with the EU Copernicus Space Programme, particularly its Security Service.

Who can apply

The opportunity is directed primarily at entities in Member States that provide the necessary facilities to host and operate a Cross-border Cyber Hub for pooling cybersecurity threat data between several Member States.

The application is expected to involve a multinational arrangement with participating Member States and relevant operational stakeholders. The applicant or designated hub operator should have the institutional authority, facilities, security capability, technical capacity and operational mandate required to host and run a hub handling sensitive cybersecurity information.

Potential participants and supporting partners may include the following:

The final beneficiary composition and consortium requirements must be confirmed in section 6 of the call document. The portal metadata identifies an ownership control declaration and an appointment decision from the Member State designating the entity to act as National Cyber Hub among the relevant application documents. Although this document is described for the broader Cyber Hub action, applicants should expect to provide clear evidence of public authority designation, mandate and control for the Cross-border Cyber Hub proposal.

Geographical and ownership restrictions

The topic is subject to security restrictions under Article 12 of Regulation (EU) 2021/694 as amended by the Cyber Solidarity Act. Until the ECCC mapping of available tools, infrastructure and services is completed and assessed, participation is expected to be restricted to legal entities established in or deemed established in eligible Member States and controlled by Member States or nationals of Member States.

EEA and EFTA countries associated with the Digital Europe Programme are treated as having a status equivalent to Member States for the relevant programme participation rules. The exact list of eligible countries and the detailed control tests must be checked in section 6 of the call document and Appendix 3 of the ECCC Cybersecurity Work Programme.

The security restrictions may be amended after completion of the ECCC mapping exercise under the Cyber Solidarity Act. Applicants should therefore verify the final call text immediately before submission, particularly for ownership, control, hosting, procurement and supply chain conditions.

Mandatory application structure

Applications must address both workstreams. A proposal covering only the grant or only the procurement component is not sufficient.

The two required workstreams are:

Grants will only be awarded to applicants that successfully pass the evaluation of the joint procurement action. This creates a material sequencing and dependency risk: a technically strong grant proposal cannot compensate for failure to satisfy the procurement evaluation.

Applicants should ensure that the procurement plan and grant work plan are fully aligned. Each proposed purchase should have a clear operational purpose, technical specification, security justification, implementation milestone, ownership arrangement and connection to the hub services and expected results.

Information expected in the proposal

The proposal should provide a detailed and credible description of the intended hub, its governance, its operational role and its contribution to the European cybersecurity ecosystem.

Security, data protection and compliance considerations

The hub will handle sensitive operational cybersecurity information and will occupy a central role in protecting national authorities, critical infrastructure and essential services. Security should therefore be treated as a core design requirement rather than a supporting administrative issue.

The proposal should demonstrate secure architecture, trusted hosting, identity and access management, encryption, logging, monitoring, incident response, supply chain assurance, vulnerability management, business continuity, disaster recovery and controlled information exchange.

Applicants should explain how the hub will comply with applicable EU and national rules on data protection, classified or sensitive information, cybersecurity, procurement, records management, intellectual property and information sharing. The proposal should also address risks arising from third-country ownership, control, dependency, access to data or exposure to foreign legal requirements.

Where personal data or information relating to identifiable persons is processed, the applicant should define the applicable legal basis, data minimisation approach, retention period, access controls and responsibilities under the General Data Protection Regulation.

Interoperability and cooperation requirements

The Cross-border Cyber Hub should function as a central point for broad and secure pooling of threat intelligence and operational cybersecurity information. It should not be designed as an isolated national platform.

The proposal should define technical and procedural interfaces with National Cyber Hubs, CSIRTs, CERTs, ISACs, critical infrastructure operators and other trusted actors. It should also specify the information that will be shared, the conditions for sharing, the classification and handling rules, the timing of alerts and the responsibilities of each participant.

The hub should be able to issue early warnings and transmit relevant information to the responsible authorities and European coordination networks without undue delay when it identifies a potential or ongoing large-scale cybersecurity incident.

Duration and implementation planning

The portal information supplied for this opportunity does not state a definitive project duration. Applicants should not assume a standard duration without checking the final call document, application form and grant agreement.

The work plan should nevertheless distinguish clearly between preparation, procurement, installation, integration, testing, operational launch, full operation, monitoring and sustainability. A realistic schedule should allow for public procurement, security accreditation, data-sharing agreements, technical integration, user onboarding and operational testing.

The grant application should include measurable milestones and deliverables for both workstreams. Procurement milestones should be linked to the availability of the infrastructure and tools needed for the grant-supported operational activities.

Evaluation and award process

The call is single-stage. The portal directs applicants to the call document and the Funding and Tenders Portal Online Manual for the submission, evaluation, award and grant agreement process.

The detailed award criteria, scoring system, thresholds, evaluation timetable and grant agreement process are referenced in sections 4, 8, 9 and 10 of the call document. Those details are not reproduced in the available portal extract and must be reviewed before finalising the proposal.

Applicants should expect evaluation to focus on relevance to the topic, quality and feasibility of the technical and operational concept, capacity to deliver the procurement and hub services, security and resilience, cross-border added value, cooperation and interoperability, implementation planning, governance, budget credibility and sustainability.

Financial and operational capacity will be assessed under the applicable Digital Europe rules. Applicants should ensure that all participating entities are registered or able to register in the Participant Register, have validated legal entity information, appoint a LEAR where required and can demonstrate the financial and operational capacity necessary for the proposed activities.

Costs and budget preparation

The budget should separate procurement expenditure from grant expenditure and identify the applicable funding rate for each component. Procurement costs should be supported by a clear technical specification and an explanation of why each item is necessary for the hub's operational objectives.

Grant costs should be linked to eligible activities such as preparation, coordination, technical integration, stakeholder cooperation, personnel, testing, operational management, security management, data governance and reporting. The applicant should not include costs that are already financed by another EU action or that cannot be clearly allocated to the proposed operation.

The prohibition on double funding applies. The same cost cannot be financed twice from the EU budget. Any complementary national, regional or other EU funding should be mapped carefully, with activities and costs separated and cumulative funding rules respected.

Procurement planning should take account of ownership and control restrictions, eligible supplier conditions, security accreditation, data sovereignty, maintenance, licensing, support, interoperability and lifecycle costs. The lowest acquisition price should not be the only selection consideration where operational security and long-term dependence are material risks.

Strategic assessment for applicants

This is a highly specialised opportunity for public or publicly mandated cybersecurity operators and multinational consortia with access to secure infrastructure, operational threat data and trusted cross-border relationships. It is not a conventional research grant and is unlikely to suit an applicant that lacks a formal national mandate or an established role in cybersecurity operations.

The strongest proposals are likely to show genuine cross-border added value, clearly defined participating Member States, a credible hub operator, enforceable information-sharing arrangements, complementary rather than duplicative capabilities, mature procurement specifications and a practical plan for continuous operation.

Technology suppliers and research organisations are more likely to be suitable as supporting participants than as sole applicants unless the final call document expressly permits a different structure. Their role should be tied to the hub's operational needs, security requirements and deployment plan.

The option to include submarine cable monitoring may strengthen a proposal where the participating Member States share relevant undersea infrastructure and can demonstrate access to meaningful sensor, maritime or satellite data. It should not be included as an ancillary feature without a clear operational use case, competent partners and a defined link to Copernicus and cable security priorities.

Recommended preparation checklist

Key risks and points requiring verification

Official application source

The authoritative application and document source is the European Commission Funding and Tenders Portal topic page for Cross-border Cyber Hubs. 1

The ECCC Cybersecurity Work Programme 2025 to 2027 provides the wider policy, funding rate and implementation context for Cyber Hubs and Cross-border Cyber Hubs. 3

Conclusion

Cross-border Cyber Hubs is a strategic Digital Europe deployment opportunity for establishing secure multinational cybersecurity operating platforms. It combines a 75 percent supported joint procurement action with a 50 percent supported grant for preparation, operation and cooperation, subject to a total indicative topic contribution of €2 million and the final call rules.

Applicants should approach the opportunity as an integrated public-sector capability project requiring Member State backing, cross-border governance, operational cybersecurity maturity, secure data-sharing arrangements, detailed procurement planning and sufficient national co-financing. The most important immediate actions are to secure formal public mandates, build the cross-border consortium, define the target operating model and verify the final call document when the topic opens.

Footnotes

1. 1Official Funding and Tenders Portal topic page: Cross-border Cyber Hubs Funding and Tenders Portal
2. 2ECCC information on Cyber Hubs and the Cyber Solidarity Act: ECCC funding opportunities
3. 3ECCC Digital Europe Cybersecurity Work Programme 2025 to 2027, including the Cyber Hub funding rates and policy context: ECCC Digital Europe Cybersecurity Work Programme