National Cyber Hubs

The European Cybersecurity Competence Centre (ECCC) invites a Call for Expression of Interest for National Cyber Hubs 2027 under the Digital Europe Programme to select public entities formally designated by Member States to host, operate and enhance National Cyber Hubs participating in the European Cybersecurity Alert System. Selected hubs will participate in joint procurements coordinated with the ECCC, with EU contributions of up to 50% and an indicative topic contribution of €3 million, and may apply for a separate complementary grant providing up to €2 million in co-funding for eligible operational costs. Applications must be submitted in English via the EU Funding and Tenders Portal and include the Member State appointment decision and required templates; two-factor authentication and portal registration should be prepared in advance. Deadline for submission is 16 March 2027 at 17:00 Brussels time.

Quick summary

What this funds

Selection of national public entities to host or enhance National Cyber Hubs that act as national clearinghouses for cyber threat information, analytics and operational support, and to participate in the European Cybersecurity Alert System. Funding covers joint procurement of tools, infrastructure and services plus complementary grants for hub operations and cooperation.

Financial details (high level)

Selected National Cyber Hubs will sign hosting and usage agreements with the ECCC, commit to interoperability and to apply to join a cross-border Cyber Hub within 2 years of acquiring jointly procured tools or receiving grant funding.

Key eligibility and conditions

Applicants must be public bodies designated or established by their Member State to act as a national SOC/National Cyber Hub. Expressions of interest must include Member State appointment decision and required annexes (templates provided). Eligible country rules are described in the call document; EEA countries are associated to the programme.

For full application requirements, documents and templates see the call webpage and the Call for Expression of Interest National Cyber Hubs 2027 materials on the Funding & Tenders Portal Call page. 1

Footnotes

1. 1Call details, documents and templates are available on the EU Funding & Tenders Portal: ec.europa.eu

Opportunity snapshot

Summary and objectives

The European Cybersecurity Competence Centre (ECCC) invites Expressions of Interest to select entities in EU Member States and other eligible countries to deploy, host or enhance National Cyber Hubs as part of the European Cybersecurity Alert System. National Cyber Hubs are public entities acting as national clearinghouses for detecting, collecting, aggregating, storing, analysing and sharing cyber threat intelligence (CTI) and related data. Hubs will support national SOC networks, CSIRTs/CERTs, ISACs, critical infrastructure operators, academia and industry to improve detection, response, situational awareness and EU-wide interoperability. The CfEI opens 15 October 2026 and the submission deadline is 16 March 2027, 17:00 Brussels time 1.

Administrative and financial framework

This is a Call for Expression of Interest (EOI) linked to joint procurements managed by the ECCC and to a separate grant call. Selected National Cyber Hubs will engage in one or more joint procurements with the ECCC to purchase tools, infrastructures and services. For each joint procurement the EU will contribute up to 50% of the purchasing costs. Separately, platforms must apply to a dedicated call for proposals for grant funding to complement the joint procurement; the EU grant will contribute up to 50% of eligible operational and staff costs excluding those items purchased through the joint procurement(s). The CfEI is single-stage (submission of EOI only) via the Funding & Tenders Portal. The Funding & Tenders Portal contribution lines show a budget indication of €3,000,000 per topic line and the programme communicates additional complementary grant funding (up to €2,000,000 in grants to complement procurements) in its public materials.

Detailed eligibility and applicant types

Eligible applicants and the intended designated actors are public bodies designated or established by Member States to act as a national SOC or National Cyber Hub. The CfEI explicitly targets public entities; acceptable forms include CSIRTs/ CERTs, national cyber crisis management authorities or other competent authorities designated under Directive (EU) 2022/2555 (NIS 2), or another public entity appointed by a Member State. Existing consortia that previously won phase 1 procurements may apply for enhancement (phase 2). While the applying entity is the single designated National Cyber Hub (or the coordinator of an existing hosting consortium), the hub must identify and engage a broad set of stakeholders and contributors (sectoral SOCs, law enforcement, academia, private sector, operators of essential services).

Funding type, co-funding and amounts

The CfEI governs selection for joint procurements (procurement action) and is linked to a separate call for proposals for grants. The EU contribution model comprises: joint procurement participation where the EU contributes up to 50% of purchasing costs for tools, software, infrastructure and services; and grant funding (from a separate call) to cover eligible operational costs up to 50% of those costs. The Portal and call materials reference a contribution envelope of €3,000,000 per topic instance and public communications mention up to €3 million under Digital Europe for procurements and up to €2 million in complementary grants overall. Precise financial ceilings per selected hub will depend on the number of successful applicants and subsequent procurement allocation decisions.

Consortium requirement and project stage

The primary applicant to the EOI is a single designated entity per Member State (the National Cyber Hub). For newly designated hubs the submission is expected from that single entity. Existing hosting consortia (previously selected consortia that already engaged in joint procurements) may apply to a phase 2 enhancement; in that case the consortium structure is already established and acts via a coordinator. Selected National Cyber Hubs must commit to integrate with other hubs and apply to participate in a cross-border Cyber Hub within two years following acquisition of tools or receipt of grant funding. Expected project maturity is deployment, enhancement and operational running of national platforms (deployment, validation, operational).

Geographic and sectoral scope

Scope of technical activities and required capabilities

National Cyber Hubs should provide central operational capacity at national level to aggregate CTI and threat data, apply advanced analytics (including AI/ML), run large-scale dissemination of threat information and support other SOCs. Expected technical and operational deliverables include: data ingestion and aggregation pipelines capable of handling large CTI datasets; interoperable data formats and taxonomies; situational awareness dashboards; secure communications channels; detection and monitoring tooling; incident response methodologies; training and cyber range services; shared data lakes and analytics toolsets; and mechanisms to exchange CTI at national, cross-border and EU levels. For undersea critical infrastructure surveillance the CfEI explicitly allows deployment of sea-based sensors and the use of satellite imagery in operational synergies with the Copernicus Security Service.

Application process, templates and required documents

Expressions of interest must be submitted in English through the Funding & Tenders Portal. Submissions must be readable, accessible and printable. The Portal enforces single-stage submission. The call provides mandatory templates and annexes that must be uploaded to the portal in the defined upload slots. Two-factor authentication on the Portal is mandatory for users submitting proposals (see Portal guidance).

Applicants must consult the call document for admissibility details (page limits, layout), eligible countries list, operational and financial capacity requirements, exclusion grounds, evaluation criteria, scoring and thresholds, and the indicative timeline for evaluation and grant agreement. Legal and financial set-up provisions for the grants are described in the call document and Model Grant Agreement references.

Evaluation, selection, timeline and follow-up actions

Selection will identify entities able to host and operate National Cyber Hubs and will also inform the planning/design of the joint procurements. National Cyber Hubs selected will sign hosting and usage agreements with the ECCC regulating use of tools/infrastructure acquired through joint procurement. Selected hubs must commit to interoperability requirements, to applying to participate in a cross-border Cyber Hub within two years from acquisition or grant receipt, and to information exchange conditions that will be established. The CfEI is single-stage; however the overall programme involves follow-on procurement processes and a separate grant call (to obtain complementary funding), so practical project onboarding will include additional contractual, procurement and grant-activation steps.

Nature of support and deliverables expected from the EU and beneficiaries

Success rate and evaluation expectations

The call does not publish an explicit success rate or fixed number of selections per Member State. The Portal lists indicative budgets but not a guaranteed number of awards. Selection is competitive and based on criteria and thresholds described in the call document (technical/operational capacity, legal designation, stakeholder engagement, interoperability commitments). Exact success rates will depend on applications received and ECCC selection decisions. Applicants should assume a competitive process and must ensure they meet designation and capacity requirements.

Key compliance, legal and technical obligations

Templates and application form structure

The call provides a Template Application Form Part B which applicants must complete and upload under Part B in the Funding & Tenders Portal. The Part B template is the main narrative component and will request detailed information on: organisational profile; designation evidence; operational SOC capabilities; planned services and stakeholders; technical architecture and interoperability commitments referencing the Cyber Hub Blueprint Architecture; data protection and legal compliance arrangements; staffing and expertise; sustainability and cooperation plans (including cross-border participation within two years); and the requested procurement/grant-related planning. Applicants must also provide the Model hosting and usage agreement and a Template Commitment letter filled by contributors where needed. The call document describes page limits and admissibility rules to be followed.

Practical advice and next steps for applicants

Carefully read the Call for Expression of Interest call document and the Cyber Hub Blueprint Architecture. Prepare the official national appointment/decision document before submission. Complete Template Part B with clear operational capabilities and interoperability commitments. Collect letters of support and commitment letters from contributors and stakeholders. Ensure Portal accounts have two-factor authentication enabled and validate organisational details (LEAR appointment, legal entity validation) in the Funding & Tenders Portal. Plan co-funding sources for the non-EU share of procurement and grant-eligible costs. If selected, expect to enter joint procurements managed by the ECCC and to apply to the separate grant call to fund operational costs.

Concluding summary

This Call for Expression of Interest selects nationally designated public entities to host, operate or enhance National Cyber Hubs that will integrate into a pan-European network of Cyber Hubs supporting the European Cybersecurity Alert System. The initiative combines jointly procured tools and services (co-funded by the EU up to 50% through ECCC-coordinated procurements) with complementary grant funding for eligible operational costs (also up to 50% through a separate call). The selected hubs will perform CTI collection, aggregation and analytics (including AI/ML), support national SOCs and critical infrastructure operators, and commit to interoperability and cross-border cooperation. Applications must be submitted in English through the Funding & Tenders Portal, using the provided templates and compulsory annexes, before the deadline 16 March 2027. Successful applicants will sign hosting and usage agreements with the ECCC and will participate in joint procurements to acquire required capabilities; they must also apply to the separate grant call to obtain operational funding. Detailed requirements on admissibility, evaluation, legal and financial set-up are described in the call document and associated annexes available on the Funding & Tenders Portal and the ECCC call webpage Call page 1.

Footnotes

1. 1Official call page and documents: Call for Expression of Interest National Cyber Hubs 2027 and annexes available on the EU Funding & Tenders Portal and the ECCC website. Submission deadline: 16 March 2027, 17:00 CET. See the topic page for call document, Cyber Hub Blueprint Architecture and submission templates National Cyber Hubs topic.

Funding opportunity overview

The Call for Expression of Interest on National Cyber Hubs 2027 is a Digital Europe Programme action implemented by the European Cybersecurity Competence Centre. It seeks to select public entities designated or established by Member States to host, operate, enhance and manage National Cyber Hubs participating in the European Cybersecurity Alert System. 1

The opportunity is primarily an expression of interest linked to a joint procurement with the European Cybersecurity Competence Centre. It is not, by itself, a conventional grant call for unrestricted project expenditure. Successful applicants will participate in the planning and implementation of jointly procured cybersecurity tools, infrastructure and services, and may subsequently apply for complementary grant funding under a separate call. 2

Key opportunity data

The main characteristics of the opportunity are as follows.

Purpose and policy context

National Cyber Hubs are intended to serve as national reference points and gateways for collecting, processing, analysing and sharing cyber threat information. They should connect public authorities, private organisations, operators of critical infrastructure, sectoral security operations centres, computer security incident response teams, information sharing and analysis centres, research organisations and other relevant cybersecurity actors.

The action forms part of the European Cybersecurity Alert System established under the EU Cyber Solidarity Act. The wider policy objective is to create interconnected National and Cross-Border Cyber Hubs that improve coordinated detection, common situational awareness, cyber threat intelligence exchange and response capabilities across the European Union. 3

The opportunity is particularly relevant to Member State authorities seeking to build or consolidate national cyber monitoring and security operations capabilities, establish a national data and intelligence exchange function, and connect national systems to a wider European infrastructure.

Eligible applicants

The applicant must be a public entity designated or established by a Member State as the National Cyber Hub. The entity must be able to host or operate the platform and act as a central national hub with sufficient operational capacity to serve as a reference point and gateway for organisations that produce, share, receive or analyse cybersecurity data.

Potential applicant types include the following.

The application must be supported by an official appointment decision from the relevant Member State designating the applicant entity as National Cyber Hub. A private company, university or research organisation cannot normally apply as the designated National Cyber Hub unless it is itself a public entity formally designated or established by the Member State.

The call also refers to eligible countries associated with the Digital Europe Programme. The opportunity documentation specifically states that European Economic Area countries are fully associated with the programme and benefit from a status equivalent to Member States. The final call document should be checked for the complete country list and any country-specific conditions.

New and existing National Cyber Hubs

The call supports two categories of participation.

New National Cyber Hubs

New applicants may be entities newly designated or established by a Member State to host and operate a National Cyber Hub. They must demonstrate the facilities, operational capacity, governance arrangements, stakeholder access and technical planning necessary to create or strengthen the national platform.

Enhancement of existing National Cyber Hubs

Existing consortia selected under previous Cyber Hub expressions of interest may apply for a second phase to reinforce the capabilities of their National Cyber Hub platforms. Where selected, the existing hosting and usage agreement and joint procurement agreement may be amended at the request of the European Cybersecurity Competence Centre. The European Cybersecurity Competence Centre retains ownership rights over tools, infrastructure and services already jointly procured with the hosting consortium.

Activities and capabilities expected

A credible application should explain how the National Cyber Hub will deliver a central operational function for national cyber threat information and how it will connect to the European Cybersecurity Alert System.

Stakeholder cooperation and information exchange

Applicants should identify the national stakeholders that will contribute data, tools, expertise, services or operational cooperation. The call encourages involvement of a broad contributor community even where those contributors do not participate directly in platform governance or day-to-day operation.

Interoperability requirements

The National Cyber Hub must fit within a common high-level blueprint architecture and support a high level of interoperability with other participating platforms. The application should therefore address compatibility of data formats, taxonomies, data handling processes, analytical tools, secure communications channels, application-layer security, situational awareness dashboards and indicators.

Applicants should avoid presenting the Hub as an isolated national IT project. The proposal should demonstrate how national systems, operational procedures and information-sharing arrangements will support a future pan-European network of interoperable Cyber Hubs.

Funding and financial structure

The financial structure has two connected components.

Joint procurement

The selected National Cyber Hub will engage in and manage a joint procurement with the European Cybersecurity Competence Centre for the tools, infrastructure and services needed to establish or strengthen the platform. The European Union will contribute up to 50 percent of the purchasing costs for each joint procurement. The portal shows an indicative contribution of €3 million for the National Cyber Hubs expression of interest workstream.

The joint procurement component is therefore a cost-sharing mechanism rather than a fixed grant awarded directly to every applicant. The final amount available to an individual National Cyber Hub will depend on the procurement planning, the number of successful applications, the eligible procurement requirements and the resulting agreements with the European Cybersecurity Competence Centre.

Complementary grant

A separate application must be submitted under call reference DIGITAL-ECCC-2027-DEPLOY-CYBER-12-NATCH for a grant covering eligible costs that complement the joint procurement. The complementary grant is available only if the expression of interest is successful and the separate grant application satisfies its own requirements.

The European Union may contribute up to 50 percent of eligible complementary costs, including staff costs and other eligible costs for setting up, enhancing and operating the National Cyber Hub, stakeholder interaction and cooperation. Tools, infrastructure and services purchased through the joint procurement are excluded from the complementary grant cost base.

The ECCC call webpage indicates that the complementary grant envelope may reach €2 million. This amount should be treated as an overall or indicative call-level figure unless the separate grant call confirms a different maximum per project or beneficiary. 4

The applicant should plan to provide at least 50 percent co-financing for eligible costs supported through the grant and for the procurement expenditure subject to the 50 percent contribution rate. The final co-financing, ownership, procurement, payment and reporting arrangements will be governed by the relevant agreements and the separate grant call.

Mandatory commitments and conditions

Required application documents

The Funding and Tenders Portal identifies the following compulsory documents and uploads.

The applicant should prepare the Member State designation decision early because it is a substantive eligibility document rather than a supporting statement that can be replaced by general institutional endorsement. Letters of support should also demonstrate concrete cooperation, data contribution, service use, governance participation or operational coordination.

Application content that should be prioritised

Duration and implementation planning

The Digital Europe cybersecurity work programme gives an indicative action duration of three years. The binding duration for an individual selected action will depend on the call documents, hosting and usage agreement, joint procurement agreement and any separate grant agreement.

The implementation should be planned in phases covering mobilisation and governance, requirements and architecture, procurement preparation, deployment and integration, operational validation, stakeholder onboarding, information exchange, performance monitoring and preparation for Cross-Border Cyber Hub participation.

Evaluation and selection considerations

The portal states that admissibility, eligibility, financial and operational capacity, exclusion, evaluation procedures, award criteria, thresholds, indicative evaluation timing and legal and financial arrangements are described in the call document and the Funding and Tenders Portal Online Manual. The available portal extract does not reproduce the detailed scoring matrix or thresholds, so applicants should use the official call document as the controlling source rather than relying on general assumptions about evaluation scores.

In practical terms, the strongest applications are likely to be those that provide clear Member State authority, mature operational capacity, credible national stakeholder access, a technically coherent interoperability plan, realistic procurement requirements, strong information-sharing safeguards, adequate co-financing and a concrete path towards cross-border cooperation.

Key risks and points requiring attention

Recommended applicant readiness checklist

Overall assessment

This is a strategically significant infrastructure opportunity for national public cybersecurity authorities rather than a standard research or innovation grant. Its value lies in combining European Union cost sharing for advanced cyber threat detection tools and services with access to a wider interoperable network of National and Cross-Border Cyber Hubs.

The opportunity is best suited to a Member State backed public body with an established cybersecurity mandate, national convening power, access to relevant threat data, the ability to operate a secure and resilient platform, and the authority to coordinate public and private stakeholders. Applicants should approach the expression of interest, joint procurement and complementary grant as connected stages of a multi-year national capability programme.

Official sources and documents

The official Funding and Tenders Portal topic page, the ECCC call webpage, the Cyber Hub Blueprint Architecture and the Digital Europe cybersecurity work programme should be treated as the controlling sources for final eligibility, submission, budget, evaluation and contractual requirements. 5