National Cyber Hubs

National Cyber Hubs is a forthcoming Digital Europe Programme call DIGITAL-ECCC to create or strengthen one national cyber hub per participating Member State, combining a joint procurement for core infrastructure with a complementary budget-based grant for setup, integration, training and operation. Applicants must be designated by their Member State to act under national authority and demonstrate secure handling of sensitive cyber threat information and cooperation with CSIRTs, ISACs and critical infrastructure operators. The portal shows an indicative topic contribution of €2 million for 2026 with wider work programme allocations of €5 million in 2026 and €5 million in 2027, and funding rates are indicatively up to 50% for procurement and up to 50% for grants, with remaining costs expected to be covered nationally. The planned opening date is 15 October 2026 and the deadline is 16 March 2027 at 17:00 Brussels time, and grants will only be awarded to applicants successful in the joint procurement evaluation.

What this funds

Scope at a glance

Support to create or strengthen National Cyber Hubs acting as national gateways for detecting, aggregating and analysing cyber threat data, producing cyber threat intelligence, sharing actionable warnings and providing targeted training. Activities include procurement of infrastructure and tools, data feeds, AI and analytics, interconnection with Cross-Border Cyber Hubs, operational running costs and capacity building. Options may also cover monitoring of undersea infrastructure and integration with Copernicus services.

This topic is implemented under the Digital Europe Programme (ECCC). Applications are subject to security eligibility restrictions in the call (Article 12(5) of the DEP Regulation) pending a mapping exercise under the Cyber Solidarity Act; these restrictions may affect participation and procurement from non-EU controlled providers 1.

Footnotes

1. 1Participation and procurement under this topic are subject to Article 12(5) of Regulation (EU) 2021/694 pending the ECCC mapping exercise under the Cyber Solidarity Act; this may limit procurement from or involvement of entities not established in or controlled from eligible countries until the mapping outcome is implemented.

Basic call data and objectives

Who may apply and what is fundable

This call is targeted to the public entities designated by Member States to host and operate National Cyber Hubs (single entity acting under Member State authority). The actions are split into: (A) a call for expression of interest to select entities that can host/operate National Cyber Hubs and take part in the joint procurement; (B) a grant workstream to finance preparatory, integration and operating costs for National Cyber Hubs. Applications to both procurement and grant workstreams are required; grants will only be awarded following successful evaluation of the joint procurement action.

Eligible applicant types

Funding type and mechanism

Consortium, geographic scope and project maturity

What is in scope (detailed technical and operational activities)

Eligibility, admissibility and application process

Application type, stages, evaluation and timeline

Financial management, co-funding and related rules

Application forms and templates — structure and guidance

Application uses the EU Grants Application Form (DEP) Part A and Part B structure. Part A (administrative) is filled in via Portal screens (organizational data, participants, budget tables). Part B is the technical description uploaded as PDF following the provided template. Key elements applicants must provide: project abstract, relevance, implementation plan, impact, work packages, deliverables, detailed budget, staff effort, subcontracting and major purchases, risks, consortium description, ethics/security self-assessments and annexes (CVs, previous projects list, ownership/control declarations). Page, font and layout rules are specified in Part B; typical page limit is 70 pages unless otherwise stated. Ownership/control declaration template is mandatory where calls have ownership/control restrictions.

Selection, award criteria and security/ownership restrictions

Budgetary and programme context

The DEP Cybersecurity Work Programme 2025-2027 allocates an indicative total for Cybersecurity actions of approximately €355 million. Within the Work Programme, the Cyber Hubs cluster and related topics receive targeted allocations across 2025-2027. The call for National Cyber Hubs is part of the wider series of DEP/ECCC topics including Cross-Border Cyber Hubs, PQC testing infrastructure, AI for Cybersecurity and preparedness/mutual assistance actions.

Success rates, co-funding and risks

Templates and application structure — practical checklist

Use the EU Funding & Tenders Portal Submission System. Complete Part A in the portal (administrative forms). Prepare Part B using the DEP application template downloaded from the Portal (cover page, project summary, 1.Relevance, 2.Implementation, 3.Impact, 4.Work plan with WPs/resources/time, 5.Other (ethics/security), 6.Declarations). Annexes to include: ownership control declaration, appointment decision from Member State designating the National Cyber Hub (no template mandatory), budget details in Annex 2 format, CVs and other annexes requested by the call. Respect page and font rules (typical example: 70 pages; Arial >= 9). Provide deliverables, milestones and a timetable aligned to the 3-year indicative duration. Ensure the consortium agreement or internal arrangements (if required) are in place and do not contradict the grant agreement. Supporting documents for ownership/control to be uploaded to the Participant Register upon request.

Mentioned countries and geographic references

The opportunity is addressed to entities in EU Member States and associated EEA/EFTA countries as applicable under the Digital Europe Programme. The call text repeatedly references the Union, Member States, and EEA/EFTA association; no specific non-EU countries are listed as eligible recipients. Participation and procurement from non-EU entities are restricted under Article 12(5) of the DEP Regulation until and unless the ECCC mapping under the Cyber Solidarity Act allows derogations.

Project stage, duration and expected deliverables

Success rate and application difficulty — practical advice

No explicit success rate is published for this specific topic. The call combines high security requirements and joint procurement evaluation with grant eligibility conditioned on procurement success — applicants should expect strict eligibility, ownership/control checks, high evaluation standards for technical capability and operational readiness, and the need to coordinate with Member State authorities. Practical advice: start early with Member State designation, gather ownership/control documentation, prepare procurement plans and technical integration roadmaps, establish partnerships with CSIRTs, ISACs, industry suppliers and HPC providers where required, and prepare ECSF-aligned training plans.

Summary: What this opportunity is about and how to approach it

This call seeks to create or strengthen National Cyber Hubs across EU Member States as part of the European Cybersecurity Alert System and the Cyber Solidarity Act implementation. It combines a joint procurement workstream (to buy the core infrastructure, tools and services) with a grant workstream (to support preparatory, integration and running costs). National Cyber Hubs will act as national reference points for collecting, analysing and sharing cyber threat intelligence and contribute to Cross-Border Cyber Hubs and EU situational awareness. The technical scope covers automation, CTI, SIEM, AI-based analytics, secure exchange and storage, compatibility with standards (CSAF, IntelMQ, EUVD), PQC readiness and optional undersea cable monitoring. Applicants must be designated or established under Member State authority, comply with ownership/control and security restrictions, apply via the Funding & Tenders Portal using Part A and Part B application templates, and plan for co-funding and integration with national and cross-border stakeholders.

Footnotes

1. 1Common Security Advisory Framework (CSAF) and IntelMQ examples cited in the call: CSAF machine-processable security advisory format supports automated advisory handling (see BSI and CSAF references). IntelMQ provides message handling pipelines for CTI feeds. Applicants are encouraged to use established standards and automation pipelines where possible.

Funding opportunity overview

National Cyber Hubs is a forthcoming Digital Europe Programme opportunity under the European Cybersecurity Competence Centre work programme. It supports the creation or strengthening of one national cyber hub per participating Member State, operating under the authority of that Member State and serving as a national reference point for cyber threat intelligence, incident information, analysis, early warning and cooperation with public and private cybersecurity actors.

The opportunity is intended for operational deployment and capacity building rather than research alone. It combines a joint procurement action for core infrastructure, tools and services with a complementary grant for preparation, integration, cooperation, training and operation of the National Cyber Hub.

Key facts

The call is currently marked as forthcoming. It uses a single-stage submission procedure and the DIGITAL Action Grant Budget-Based model, implemented as a DIGITAL JU Simple Grant. The planned opening date is 15 October 2026 and the deadline is 16 March 2027 at 17:00 Brussels time.

The indicative contribution shown for the National Cyber Hubs topic is €2 million for the 2026 budget year. The portal does not state an indicative number of grants, so the available amount should not be interpreted as a guaranteed award per applicant or as a fixed project amount.

The wider Digital Europe cybersecurity work programme indicates an indicative National Cyber Hubs allocation of €5 million in each of 2026 and 2027, with a total indicative allocation of €10 million across the 2025 to 2027 programming period. The topic-level portal budget and the wider work programme allocation should be reconciled against the final call document and any updated portal information before submission.12

Key data

What the funding is intended to achieve

The funded National Cyber Hubs are expected to act as national clearing houses and gateways for detecting, collecting, storing, correlating and analysing cybersecurity threat information and incidents. They should produce and share cyber threat intelligence, reviews, analyses and situational awareness outputs using established standards and interoperable processes.

Expected operational outcomes include the following:

Eligible applicant profile

The opportunity is not designed as a general open call for any cybersecurity company. It is intended to select entities in Member States that provide the facilities and institutional basis to host and operate a National Cyber Hub. The selected entity must act under the authority of the relevant Member State and must be designated by that Member State to act as the National Cyber Hub.

The required appointment decision from the Member State is listed among the application documents. There is no specific template for that decision, but applicants should expect to demonstrate a clear legal and institutional mandate.

Potential applicants may include national public authorities, competent cybersecurity authorities, national cyber agencies or other entities with an appropriate public mandate and operational capacity. A private organisation would only appear suitable where it can satisfy the Member State authority, designation, control, security and operational requirements. The final legal form and eligibility conditions must be checked in section 6 of the call document.

Eligibility is subject to the security restrictions applicable to sensitive cybersecurity actions under Article 12(5) of Regulation (EU) 2021/694, pending completion of the ECCC mapping exercise under the Cyber Solidarity Act. The work programme describes the applicable principle as participation by legal entities established in eligible countries and controlled by Member States or nationals of Member States, with EEA and EFTA countries associated to the Digital Europe Programme benefiting from equivalent status.2

Applicant responsibilities and institutional relationships

The applicant should explain how the National Cyber Hub will relate to and cooperate with other national and regional cybersecurity actors. The proposal should address cooperation with CSIRTs, ISACs, national authorities, critical infrastructure operators, essential service providers, cybersecurity companies, research organisations and other relevant stakeholders.

The applicant should demonstrate that the hub can handle sensitive information securely, operate as a trusted national gateway and provide practical services rather than merely coordinate existing activities. It should also demonstrate how information will be shared with other stakeholders on a mutually beneficial basis and how the hub will contribute to European cybersecurity cooperation.

Mandatory and material commitments include applying to participate in a Cross-Border Cyber Hub within the following two years, with the purpose of exchanging information with other National Cyber Hubs. This commitment should be reflected in the implementation plan, resource model, technical architecture and milestones.

Two required workstreams

Applications must cover both workstreams. The procurement and grant components are linked and should be designed as one coherent operational plan.

Grants will only be awarded to applicants that succeed in the evaluation of the joint procurement action. A technically strong grant proposal cannot compensate for failure in the procurement evaluation.

Funding rate and financial structure

The work programme indicates a Digital Europe funding rate of up to 50 percent for National Cyber Hubs joint procurement and up to 50 percent for the complementary grants. The remaining eligible and total cost of ownership is expected to be covered by the participating Member State or other participating national resources. The procurement and grant funding rates should be confirmed against the final call document because the portal extract does not display the detailed financial provisions.2

The €2 million shown on the portal is an indicative topic contribution, not a stated maximum award per project. Applicants should prepare a complete cost model separating procurement costs, preparation costs, personnel, subcontracting, data feeds, software and licensing, infrastructure operation, training, stakeholder cooperation, security controls, maintenance and sustainability costs.

There is no stated applicant co-financing amount in the available portal extract. Nevertheless, the 50 percent funding rate means that national or other eligible financing will normally be required for the unfunded share and for any costs that are ineligible under the grant agreement.

Indicative eligible activity areas

Technology and architecture expectations

Proposals should show how the hub will move beyond a static monitoring centre and become an operational national capability. The architecture should support continuous collection, secure storage, processing, correlation, analysis, dissemination and feedback of threat information.

Automation is a central theme. Applicants should explain how automated ingestion, enrichment, correlation, prioritisation, alerting, notification and reporting will reduce manual processing and improve response times. Artificial intelligence should be presented with clear use cases, data governance, human oversight, security testing, explainability and safeguards against manipulation or dependency risks.

Interoperability should be addressed from the beginning. Applicants should identify relevant standards, taxonomies, ontologies, APIs, data models and exchange mechanisms, and should explain how systems procured under the action will interoperate with national and European cyber hub capabilities.

Proposals involving undersea infrastructure should explain the operational relationship with cable owners, maritime and national authorities, sensor operators, satellite data providers and the Copernicus Security Service. This is an optional area of scope, not a universal requirement for every National Cyber Hub.

Application content and documents

The proposal should provide a detailed and credible implementation plan covering at least the following elements:

Evaluation and award considerations

The portal states that admissibility requirements, proposal page limits and layout are described in section 5 of the call document and Part B of the application form. Eligibility and other eligibility conditions are described in section 6. Financial and operational capacity and exclusion are described in section 7. Submission and evaluation processes are described in section 8, award criteria and thresholds in section 9, the indicative evaluation timeline in section 4 and grant legal and financial arrangements in section 10.

Because the detailed call document and evaluation table are not reproduced in the supplied portal extract, applicants should not assume that the general Digital Europe award criteria or standard scoring thresholds automatically apply without checking the final topic-specific documents.

Likely success factors

Main risks and conditions to manage

Recommended preparation plan

Overall assessment

This is a strategically significant but institutionally specialised opportunity. It is best suited to a Member State backed entity that already has, or can rapidly establish, the authority, secure facilities, operational personnel, national stakeholder relationships and financial commitment required to run a sensitive national cyber intelligence capability.

The strongest applications will treat the procurement and grant as one deployment programme, demonstrate immediate operational value, provide a realistic national governance model and show how the hub will become part of the European Cybersecurity Alert System and a Cross-Border Cyber Hub. Technology acquisition alone is unlikely to be sufficient without a credible operating model, information-sharing framework, staffing plan, national mandate and sustainability strategy.

Sources and qualification

The opportunity details, deadline, portal budget, action type and listed application documents are taken from the supplied European Commission Funding and Tenders Portal metadata. The indicative funding rates and wider work programme allocation are supported by the ECCC Digital Europe Cybersecurity Work Programme information reproduced in the search results.12

1

The Funding and Tenders Portal metadata supplied for this analysis identifies €2 million for the National Cyber Hubs topic in budget year 2026 and does not state an indicative number of grants.

2

The ECCC Digital Europe Cybersecurity Work Programme indicates 50 percent funding for National Cyber Hubs procurement and 50 percent for grants, and an indicative National Cyber Hubs allocation of €5 million in 2026 and €5 million in 2027. These figures remain subject to the final call documents and any amendments.