Cross-Border Cyber Hubs

The Call for Expression of Interest Cross-Border Cyber Hubs 2027 EOI-ECCC-2027 under the Digital Europe Programme seeks multi-country consortia led by public National Cyber Hubs from at least three EU Member States to establish, enlarge or enhance cross-border platforms for pooling, analysing and sharing cybersecurity threat intelligence. Selected consortia become eligible for joint procurements with the European Cybersecurity Competence Centre with up to 75% co-funding for purchased tools, infrastructure and services and must separately apply for grants covering up to 50% of eligible non-procurement operational costs. Applications require a single-stage submission via the Funding & Tenders Portal with compulsory documents (Application Form Part B, model hosting and usage agreement, Member State designation and commitment letters) and selected consortia must sign consortium and hosting agreements and cooperate on interoperability with ENISA. The call opened 15 October 2026 and the submission deadline is 16 March 2027 at 17:00 Brussels time; selection under this EOI is a precondition for downstream procurement and grant actions but does not guarantee grant award.

What it funds

Purpose

Supports the deployment, enlargement or enhancement of Cross-Border Cyber Hub platforms to pool cyber threat data and cyber threat intelligence, share tools and jointly develop detection, analysis and prevention capabilities across Member States. Activities include joint procurement of tools/infrastructure, creation of data lakes, cyber range services, training and support for detection and situational awareness (including optional undersea infrastructure surveillance).

Footnotes

1. 1Related grant call for deploying or enlarging Cross-Border Cyber Hubs: DIGITAL-ECCC-2027-DEPLOY-CYBER-12-CBCH. Full call document, templates (Part B, hosting agreement, commitment letters) and guidance are available on the Funding & Tenders Portal.

Opportunity summary

This is an EU Call for Expression of Interest EOI-ECCC-2027 managed under the European Cybersecurity Competence Centre and Network. Opening date: 15 October 2026. Submission deadline: 16 March 2027, 17:00 Brussels time. Type of action: Call for Expression of Interest, single-stage submission. Purpose: to select entities able to deploy, host and manage Cross-Border Cyber Hub platforms that pool cybersecurity threat data and cyber-threat intelligence (CTI), operate shared tools and services, and develop joint detection, analysis and prevention capabilities across multiple EU Member States and eligible countries.

Who can apply and consortium model

This CfEI targets entities in EU Member States and other eligible countries as described in the call document. The call specifically intends to select one or more multi-country consortia led by public bodies from at least three Member States. Consortia are expected to be composed of multiple National Cyber Hubs. A National Cyber Hub is defined for this call as a public body acting as a central hub and gateway to public or private organisations that produce, share, receive and analyse cybersecurity data (for example operators of critical infrastructures, cybersecurity companies, etc.). One participating National Cyber Hub will be designated as consortium coordinator for legal representation and will be responsible for hosting the platform infrastructure or one or more National Cyber Hubs may assume hosting responsibilities.

Eligibility and applicant types

Eligible Applicant Types

Funding, procurement and financial details

Selection, evaluation and application process

Application stages and timeline

The call documentation provides an indicative timeline for evaluation and grant agreement; applicants must consult the call document for precise dates and sequencing of evaluation, contractual steps and procurement phases.

Evaluation and award criteria (high level)

Detailed award criteria, scoring and thresholds are described in the call document. Applicants should expect assessment of: consortium composition and governance; legal and operational capacity; technical capabilities to host, operate and secure CTI and platform infrastructure; data sharing commitments within platform and across platforms; interoperability plans and commitment to cooperate with ENISA; contribution to EU situational awareness and crisis response; sustainability and plan to involve contributors; compliance with procurement and hosting agreement templates; financial viability and exclusion checks.

Technical scope and technology expectations

Platforms must enable pooling of heterogeneous data and CTI from public and private sources, provide high-quality actionable intelligence, and support improved detection and response via advanced analytics. The call expects use and development of state-of-the-art tools and technologies including AI and ML for processing large CTI data sets, creation of one or more data lakes, sharing and common procurement of tools and software, provision of cyber range services, analyst training, and optional capabilities for surveillance and protection of undersea infrastructure using in-situ sea-based sensors and satellite imagery (with Copernicus Security Service synergies). Interoperability and alignment with ENISA guidelines and EU systems such as EU-CyCLONe and the CSIRTs network are required.

Target sector

Geographic eligibility and mentioned countries

Mentioned Countries

EEA countries are explicitly mentioned as fully associated; otherwise the call references EU Member States and other eligible countries as defined in the call document.

Project stage, expected maturity and activities

Application requirements, documents and templates

Applicants must follow the admissibility, eligibility and submission rules in the call document and the Funding & Tenders Portal Online Manual. Compulsory annexes to be uploaded in the portal include Template Application Form Part B (to be submitted as Part B), Template Model Hosting and Usage Agreement (uploaded under Hosting Agreement), Template Commitment and Mandate Letter (under Letters of Commitment), appointment decision from Member State designating the National Cyber Hub (Proof of MS designation), and official letters of support (Letters of support). Additional documentation available includes the Cyber Hub Blueprint Architecture and the call document itself.

Legal, financial set-up and co-funding

Legal and financial set-up of grants, financial and operational capacity checks and exclusion criteria are described in the call document. Joint procurements will result in ECCC ownership rights over procured tools, infrastructures and services; amendments for phase 2 enlargement or enhancement may be possible but will not affect ECCC ownership of already procured items. For joint procurements the EU contribution is up to 75% of purchasing costs. For grant-funded eligible operational costs under the separate call, the EU contribution is up to 50%; applicants must read separate call conditions for eligible cost categories and co-funding rules.

Nature of support and award modality

Application mechanics and portal requirements

Submission must be via the EU Funding & Tenders Portal. Two-factor authentication is mandatory for portal access. Applicants choose the Call for Expression of Interest model in the portal and upload Part A and Part B documents and supporting annexes. Admissibility conditions including page limits and layout for Part B are set out in the call document.

Application Type

Open call for expression of interest, single-stage submission via the Funding & Tenders Portal.

Success rates and expected number of selections

The call text provides an indicative budget line and does not publish explicit success rate statistics. The portal shows an indicative budget entry of €3,000,000 for the topic and expected number of grants is not fixed (portal shows expectedGrants 0 in metadata). Selection will depend on evaluation ranking and available procurement/grant resources. Applicants should assume competitive selection and rely on meeting all award criteria and thresholds described in the call document.

Key obligations for selected consortia

How this CfEI connects to downstream actions

Selection under this CfEI enables entry into joint procurement processes with the ECCC to acquire tools, infrastructure and services. Separate call(s) for proposals exist to award grants that complement procurement by covering eligible operational costs of platforms. Consortia selected for this CfEI must apply separately to the relevant grant call and meet its requirements to receive grant funding of up to 50% for eligible costs.

Where to find more information and documents

All details, templates and annexes are published on the EU Funding & Tenders Portal and the European Cybersecurity Competence Centre website. Key documents available: Call for Expression of Interest Cross-Border Cyber Hubs 2027 call document; Cyber Hub Blueprint Architecture; Template Application Form Part B; Template Model Hosting and Usage Agreement; Template Commitment and Mandate Letter; appointment decision proof requirements; and Funding & Tenders Portal Online Manual. The topic page URL is provided on the portal. Applicants must read the call document and annexes carefully for full conditions and submission rules Cross-Border Cyber Hubs topic Call for Expression of Interest Cross-Border Cyber Hubs 2027 - call document. 1

Final summary — what is this opportunity about and why it matters

This Call for Expression of Interest seeks to identify and select multi-country consortia of designated National Cyber Hubs (public bodies) able to host and operate Cross-Border Cyber Hub platforms that pool cybersecurity data and threat intelligence across several Member States, share advanced tools and services, and collectively raise EU detection, analysis, prevention and situational awareness capabilities. Selected consortia will enter joint procurement processes with the ECCC (with EU co-funding up to 75% per procurement) to acquire the necessary tools, infrastructures and services, and may be eligible to apply to a separate grant call for up to 50% funding of eligible operational costs. The initiative supports EU strategic objectives including interoperability, cooperation with ENISA, integration with EU incident-response networks, technological sovereignty, and protecting critical infrastructures including undersea assets. Applicants must form or be part of a multi-country consortium led by a public National Cyber Hub designated by Member States, submit a single-stage expression of interest via the Funding & Tenders Portal by 16 March 2027, and provide required annexes and templates. This CfEI is both a selection exercise enabling procurement and a preparatory step for subsequent grants and platform deployment across Europe.

Footnotes

1. 1Full call text, templates and annexes are available on the Funding & Tenders Portal topic page and the European Cybersecurity Competence Centre webpages. Use the portal entry point for submission and to download the Template Application Form Part B and other compulsory annexes.

Funding opportunity summary

The Call for Expression of Interest on Cross-Border Cyber Hubs 2027 is a Digital Europe Programme opportunity implemented with the European Cybersecurity Competence Centre. It seeks to select multi-country consortia capable of establishing, enlarging or enhancing cross-border platforms for collecting, analysing and sharing cybersecurity threat intelligence and operational data between participating countries. The platforms are intended to complement existing security operations centres, computer security incident response teams and other relevant cybersecurity actors.1

The opportunity is strategically linked to the European Cybersecurity Alert System under the Cyber Solidarity Act. Its intended outcome is a collaborative and interoperable European network of national and cross-border cyber hubs capable of improving threat detection, collective situational awareness, coordinated response and European technological sovereignty.2

The call is an expression of interest rather than a conventional grant call. Successful applicants will be eligible to participate in joint procurement with the European Cybersecurity Competence Centre. They must also apply separately under the related grant call for operational and implementation costs. Selection under this expression of interest is a precondition for receiving the related grant, but does not itself guarantee the grant award.

Key opportunity facts

Purpose and policy objectives

The platforms should provide a trusted environment in which public and private cybersecurity data can be pooled, analysed and shared. They are expected to generate additional capacity beyond existing national SOCs, CSIRTs and comparable structures rather than merely duplicate existing functions.

The principal objectives are to produce high-quality and actionable cyber threat intelligence, accelerate the detection and response to cyber threats, improve common situational awareness, strengthen EU technological sovereignty and support a wider European ecosystem for cybersecurity information sharing.

Applicants should demonstrate how their platform will use advanced analytics and state-of-the-art technologies, including artificial intelligence and machine learning where appropriate, to analyse large datasets and improve the quality, timeliness and usability of cyber threat intelligence.

The platform should support information exchange at three levels. First, participating entities must share operationally relevant information within the consortium. Second, platforms should establish arrangements for cooperation and interoperability with other cross-border platforms. Third, platforms must provide relevant information and early warnings to responsible EU networks and entities, including the CSIRTs network and EU-CyCLONe, where the applicable conditions are met.

Eligible platform activities may include the operation of shared data lakes, exchange of threat intelligence feeds and indicators of compromise, development or sharing of detection and response tools, cyber range services, analyst training, common procurement of tools and services, and provision of selected services to the wider European cybersecurity community.

The scope may also include surveillance and protection of critical undersea infrastructure, including submarine cables. Such activities may use sea-based sensor data and satellite imagery and should create operational synergies with the Copernicus Space Programme, particularly its Security Service.

Who can apply

The primary applicants are multi-country consortia led by public bodies from at least three EU Member States. The consortium must be composed of multiple National Cyber Hubs that will jointly establish and manage a Cross-Border Cyber Hub platform.

A National Cyber Hub must be a public body acting as a central hub, reference point or gateway to public or private organisations with significant capacity to produce, share, receive or analyse cybersecurity-related data. Relevant connected organisations may include operators of critical infrastructure, cybersecurity companies, CERTs, CSIRTs, ISACs, research organisations and other entities benefiting from the National Cyber Hub services.

EEA countries associated with the Digital Europe Programme are treated as having a status equivalent to EU Member States for the purposes of the programme. The detailed call document remains the controlling source for the full country eligibility rules and any restrictions applicable to individual entities.1

The consortium must designate a coordinator. One or more participating National Cyber Hubs must assume responsibility for hosting the Cross-Border Cyber Hub infrastructure. The platform will be legally represented by the designated coordinator or by the hosting consortium where it has legal personality.

Existing consortia may also apply. Enlargement applications may add National Cyber Hubs to an existing consortium, while enhancement applications may reinforce the capabilities of an existing consortium without changing its membership. For enlargement, the coordinator of the ongoing grant must remain part of the new consortium. For enhancement, the consortium is expected to remain the same as under the ongoing grant.

In addition to formal consortium partners, applicants are expected to seek a broad community of contributors willing to share data, tools, expertise or services without necessarily participating directly in governance or operational management.

Consortium and governance requirements

All consortium members must sign a consortium agreement setting out responsibilities, governance arrangements and the information that will be shared between participants. The agreement should address operational roles, data access, security responsibilities, decision-making, interoperability, incident handling and the conditions for adding future National Cyber Hubs.

The coordinator, or hosting consortium where applicable, must sign a hosting and usage agreement with the European Cybersecurity Competence Centre. This agreement will govern the operation and maintenance of jointly procured tools and infrastructure.

For applications involving enlargement of an existing platform, the consortium agreement must be amended to reflect the enlarged structure and responsibilities. The hosting and usage agreement and joint procurement agreement may also be amended at the request of the European Cybersecurity Competence Centre.

Selected consortia must cooperate with ENISA on interoperability. They should therefore be prepared to align their architecture, interfaces, information-sharing processes and technical standards with emerging EU guidance on interoperability of cross-border cyber hubs.

Funding and financial model

The joint procurement and grant components are financially distinct. The EOI selects consortia and supports the preparation and planning of procurement, while the related grant provides co-financing for eligible establishment and operating activities. Applicants should ensure that the same expenditure is not presented for both procurement financing and grant financing.

The EU contribution rates are maximum rates. Applicants must provide the remaining co-financing and demonstrate that the consortium can sustain its financial responsibilities, operate the platform and maintain the required infrastructure and services. The call metadata does not identify a maximum contribution per consortium or a fixed number of selected platforms.

Eligible activities and expected outputs

A credible application should cover the following areas:

Expected outputs should include an operational cross-border platform, secure and interoperable infrastructure, effective threat intelligence sharing arrangements, documented governance and information-sharing procedures, advanced analytical capabilities, and measurable improvements in detection, response and collective situational awareness.1

Application documents and formal requirements

The Funding and Tenders Portal identifies the following compulsory or supporting documents:

The application must comply with the page limit, layout and formatting requirements in the call document and Part B template. Applications should be prepared in the required language and uploaded under the correct document categories in the Funding and Tenders Portal.

Applicants must also complete the standard Funding and Tenders Portal requirements concerning participant registration, legal entity validation, appointment of a Legal Entity Appointed Representative, financial capacity assessment where applicable, operational capacity and exclusion checks.

Evaluation and selection considerations

The published topic page refers applicants to the call document for the detailed evaluation process, award criteria, scoring system, thresholds and indicative timetable. The supplied metadata does not reproduce the detailed scoring matrix, so applicants should not rely on generic Digital Europe evaluation assumptions in place of the official call document.

In practical terms, applications will need to demonstrate that the consortium is genuinely multi-country, institutionally authorised, operationally capable and able to host and manage secure cyber infrastructure. The proposal should show clear added value compared with existing national capabilities and explain how the platform will function as part of a wider European network.

The strongest applications are likely to be those that provide a precise technical and operational design, credible data-sharing commitments, clear arrangements for security and confidentiality, mature governance, measurable outcomes, realistic procurement specifications and a sustainable operating model beyond the initial EU support.

Important conditions and risks

Applicant preparation priorities

Overall assessment

This is a highly specialised infrastructure and institutional cooperation opportunity suited primarily to national public cybersecurity authorities and established public-sector cyber hub operators. It is not designed as a standalone technology development grant for an individual company or research organisation.

The opportunity is attractive for eligible public bodies that already have national cyber intelligence, SOC, CSIRT or critical infrastructure protection capabilities and want to connect them across borders. The principal value lies in access to large-scale jointly procured tools and infrastructure, structured cooperation with other European platforms and the possibility of complementary operating-cost support.

The main application challenge is coordination. Applicants must simultaneously demonstrate political and legal authorisation, technical readiness, operational data-sharing capacity, procurement maturity, interoperability, co-financing and long-term sustainability. Early agreement among participating Member States and National Cyber Hubs will be essential.

The deadline is 16 March 2027 at 17:00 Brussels time. Applicants should use the official call document, compulsory templates and Funding and Tenders Portal submission system as the controlling sources for final eligibility, page limits, evaluation criteria, document requirements and submission mechanics.1

Sources

Official Funding and Tenders Portal topic information and call documents for EOI-ECCC-2027.1

European Cybersecurity Competence Centre information on Digital Europe cybersecurity work programme priorities and Cross-Border Cyber Hubs.2

Footnotes

1. 1The official Funding and Tenders Portal topic page identifies the opening date, deadline, indicative EOI budget, application documents and the separate grant relationship. The ECCC Digital Europe cybersecurity work programme provides additional context on indicative action duration, implementation and joint procurement.1
2. 2The European Cybersecurity Competence Centre describes National and Cross-Border Cyber Hubs as part of the European Cybersecurity Alert System and the implementation of the Cyber Solidarity Act.2