Uptake of innovative cybersecurity solutions for SMEs

This EU grant opportunity falls under the Digital Europe Programme targeting the uptake of innovative cybersecurity solutions specifically designed for small and medium-sized enterprises (SMEs). The call, officially known as DIGITAL-ECCC-2025-DEPLOY-CYBER-09-UPTAKE, aims to enhance SMEs' cybersecurity capabilities and promote compliance with EU legislation such as the Cyber Resilience Act. The initiative recognizes the vulnerability of SMEs to cyber threats and aims to provide accessible tools and services to improve their cybersecurity posture.

The funding type is a direct grant mechanism termed "Action Grant Budget-Based" with an indicative funding amount of €3 million per grant, totaling €15 million available for this specific call. There will be five grants awarded under this opportunity. The application process is single-stage, with the submission period opening on October 28, 2025, and closing on March 31, 2026.

Eligible applicants include technology companies, cybersecurity firms, public entities managing cybersecurity infrastructure, and possibly public-private partnerships. While a formal consortium is not required for application, cooperation with Cyber Hubs, CSIRTs, and ISACs is strongly encouraged to ensure sufficient operational capabilities and network integration.

Projects are expected to deliver a comprehensive cyber toolkit as a service that includes functionalities for risk assessment, vulnerability alerts, incident reporting, and interfaces with existing SaaS applications. Additionally, support services such as multilingual helplines and incident response capabilities are included in the project's scope.

Geographically, the call targets all EU Member States, along with Iceland and Norway. Although there are no mandatory co-funding requirements, the program generally provides 100% financial support for the eligible actions, which could attract established organizations with relevant expertise.

The competitive nature of this funding opportunity suggests that success rates might be below 15%, with projections estimating around five successful applications out of potentially 50-100 submissions. Proposals must demonstrate innovation, relevance to the cybersecurity landscape, and the capability to implement operational partnerships effectively.

In summary, the goal is to develop and deploy practical cybersecurity solutions that specifically address the unique challenges SMEs face in the digital landscape, ultimately enhancing their resilience and compliance with evolving EU cybersecurity regulations.

This EU grant opportunity, under the Digital Europe Programme (DIGITAL), specifically targets the "Uptake of innovative cybersecurity solutions for SMEs" within the call "Deploying Strategic Cyber Capabilities Across Europe" (DIGITAL-ECCC-2025-DEPLOY-CYBER-09). It is a DIGITAL-JU-SME DIGITAL JU SME Support Action, utilizing a DIGITAL Action Grant Budget-Based [DIGITAL-AG] Model Grant Agreement. The deadline model is single-stage. The planned opening date is 28 October 2025, and the deadline is 31 March 2026, at 17:00:00 Brussels time.

The expected outcome is the development of a cyber toolkit as a service to support SMEs in managing cyber risks, defining, and implementing their cybersecurity strategy. The toolkit should include at least one of the following:

Interfaces that will connect to existing SaaS applications such as HR, invoice and financial management, CRM and accounting systems, etc., which are often used by SMEs for increasing their cybersecurity.

A functionality that enables the mapping and maintenance of an SME’s digital assets and possible vulnerabilities by interfacing with other SaaS applications that manage an asset inventory and data repositories.

A function that supports the assessment and management of an SME’s cybersecurity risks and of supply chain risk management. This function should perform a risk assessment, provide recommendations for risk mitigation, and identify options.

An interface to existing tools that support the analysis and assessment of the extent of an SME’s cyber risk based on information gathered from digital infrastructure scanning and data provided by authorised users.

A function that issues alerts on vulnerabilities and threats based on the information collected by the risk management function.

A function that connects SMEs to a CSIRT or a Cyber Hub to report an incident and assist with recovery if possible.

A mapping and one-stop window/portal to existing tools and solutions targeting cybersecurity support to SMEs.

Tools supporting detection, prevention and response in Operational Technology infrastructures using open standards or technologies.

Support and incident response capabilities to SMEs:

Non-commercial cybersecurity hotline with a standardised framework and guidelines for response times, escalation procedures, and the scope of assistance provided.

A fully operational, multilingual helpline that provides timely and accurate cybersecurity assistance to SMEs, leading to reduced successful cyber scams and improved digital hygiene.

A National Cyber Response Platform for first cyber responders to exchange their experiences, share relevant news and engage discussions regarding challenges and emerging cyber threats complementary to existing cyber crisis management structures.

Specialised training modules for first (public and private) responders’ services targeting different sectors such as healthcare, finance, energy, and transportation.

Support tools and platforms:

Control Centre and Panel on Incident Reporting and dispatching of incident responders.

SME user interface for Incident reporting associated with the cyber toolkit. Users can report an incident, get instructions on how to react and obtain information on how to receive support for the response. An AI assistant connected to a Control Centre could also be included.

Interfaces with the National Authorities and Cross-Border Platforms (CBPs) for incident notification and information sharing.

The objective of this action is to improve industrial and market readiness for the cybersecurity requirements for SMEs as specified in relevant EU cybersecurity legislation, for instance, as set in the Cyber Resilience Act ensuring more secure hardware and software products.

Proposals should contribute to achieving at least one of these objectives:

Availability of innovative tools and services that support SMEs in complying with the EU cybersecurity legislation.

Availability of innovative tools and services that support SMEs in reporting incidents and in assisting with recovery if possible, and in exchanging with competent authorities (i.e. cooperation with Cyber Hubs, CSIRTs (including in relation to the CSIRT Network) and/or ISACs, for e.g. highly critical and other critical sectors entities).

Improved security and notification processes and means in the EU.

Improved security of network and information systems in the EU.

Industrial and market readiness for the proposed Cyber Resilience Act.

Support for Cybersecurity certification in line with the Cybersecurity Act.

Support for supply chain partners in standardised self-assessments and certifications. Helping downstream supply chain partners in a step-by-step approach to increase cyber resilience.

Overcome the challenge of finding the technical skills required to deal with a complex technology landscape that relies heavily on extensive configurations and capabilities.

Cyber toolkit as a service to support for SMEs managing cyber risks, defining, and implementing their cybersecurity strategy, including several functions dedicated to risk assessment, vulnerabilities and threats detection, etc.

Support and incident response capabilities to SMEs.

The action will focus on supporting at least one of the priorities listed under the Expected Outcomes section.

Conditions for application include:

1. Admissibility Conditions: Proposal page limit and layout are described in section 5 of the call document and Part B of the Application Form available in the Submission System.

2. Eligible Countries are described in section 6 of the call document.

3. Other Eligible Conditions are described in section 6 of the call document.

4. Financial and operational capacity and exclusion are described in section 7 of the call document.

5a. Evaluation and award: Submission and evaluation processes are described in section 8 of the call document and the Online Manual.

5b. Evaluation and award: Award criteria, scoring and thresholds are described in section 9 of the call document.

5c. Evaluation and award: Indicative timeline for evaluation and grant agreement are described in section 4 of the call document.

6. Legal and financial set-up of the grants are described in section 10 of the call document.

Relevant documents include:

Digital Europe Cybersecurity Work Programme 2025-2027

Regulation (EU) 2021/887 of the European Parliament and of the Council of 20 May 2021 establishing the European Cybersecurity Industrial, Technology and Research Competence Centre and the Network of National Coordination Centres

Call document and annexes: call document

Application form templates: Standard application form (DEP) available in the Submission System, Ownership control declaration

Model Grant Agreements (MGA): DEP MGA

Additional documents: Digital Europe Cybersecurity Work Programme 2025-2027, DEP Regulation 2021/964, EU Financial Regulation 2024/2509, Rules for Legal Entity Validation, LEAR Appointment and Financial Capacity Assessment, EU Grants AGA Annotated Model Grant Agreement, Funding & Tenders Portal Online Manual, Funding & Tenders Portal Terms and Conditions, Funding & Tenders Portal Privacy Statement

The budget overview for the year 2025 includes several topics:

DIGITAL-ECCC-2025-DEPLOY-CYBER-09-CABLEHUBS - DIGITAL-JU-SIMPLE: 10,000,000 EUR, single-stage, opening 2025-10-28, deadline 2026-03-31, contribution around 3,000,000 EUR, indicative number of grants 4.

DIGITAL-ECCC-2025-DEPLOY-CYBER-09-COORDPREP - DIGITAL-JU-SIMPLE: 10,000,000 EUR, single-stage, opening 2025-10-28, deadline 2026-03-31, contribution around 1,500,000 EUR, indicative number of grants 6.

DIGITAL-ECCC-2025-DEPLOY-CYBER-09-CYBERAI - DIGITAL-JU-SIMPLE: 15,000,000 EUR, single-stage, opening 2025-10-28, deadline 2026-03-31, contribution 3,000,000 to 5,000,000 EUR, indicative number of grants 4.

DIGITAL-ECCC-2025-DEPLOY-CYBER-09-UPTAKE - DIGITAL-JU-SME: 15,000,000 EUR, single-stage, opening 2025-10-28, deadline 2026-03-31, contribution around 3,000,000 EUR, indicative number of grants 5.

LEARs, Account Administrators, or self-registrants can publish partner requests for open and forthcoming topics after logging into the Portal, as well as any user having an active public Person profile. The submission system is planned to be opened on the date stated on the topic header.

For guidance and support, applicants are encouraged to contact the National Cybersecurity Coordination Centres (NCC) in their country or the ECCC Applicants Direct Contact Centre at applicants@eccc.europa.eu. Additional resources include the Funding & Tenders Portal FAQ, IT Helpdesk, and Online Manual.

In summary, this grant opportunity aims to bolster the cybersecurity posture of SMEs by funding the development and deployment of a comprehensive cyber toolkit. This toolkit should provide SMEs with the necessary resources to manage cyber risks, comply with EU cybersecurity legislation, and respond effectively to incidents. The EU is looking for projects that can deliver innovative tools, support services, and training programs, ultimately enhancing the security and resilience of SMEs across the European Union. The focus is on practical solutions that can be easily integrated into existing SME workflows and that address the specific challenges faced by these businesses in the digital landscape.

Eligible Applicant Types: The call is specifically targeting SMEs, as indicated by the "DIGITAL-JU-SME DIGITAL JU SME Support Actions" type of action. However, the call also mentions cooperation with Cyber Hubs, CSIRTs (including in relation to the CSIRT Network) and/or ISACs, which suggests that these entities could also be involved, potentially as part of a consortium. Therefore, eligible applicant types include SMEs and potentially Cyber Hubs, CSIRTs, and ISACs.

Funding Type: The funding type is a grant, specifically a "DIGITAL Action Grant Budget-Based [DIGITAL-AG]". The call also mentions "DIGITAL JU Simple Grants" for some topics.

Consortium Requirement: The text does not explicitly state whether a single applicant or a consortium is required. However, the mention of cooperation with Cyber Hubs, CSIRTs, and ISACs suggests that consortia are possible and potentially encouraged. To be certain, the call document should be consulted.

Beneficiary Scope (Geographic Eligibility): The call mentions the Network of NCCs includes one national centre from each of the 27 EU Member States plus Iceland and Norway. This suggests that the geographic eligibility includes the 27 EU Member States, Iceland, and Norway. The call is part of the Digital Europe Programme, which typically involves entities from EU member states, associated countries, and potentially other countries under specific conditions.

Target Sector: The primary target sector is cybersecurity. The call focuses on improving industrial and market readiness for cybersecurity requirements, particularly for SMEs. It also touches upon Operational Technology infrastructures.

Mentioned Countries: The 27 EU Member States, Iceland, and Norway are explicitly mentioned.

Project Stage: The project stage appears to be focused on development and deployment, specifically the "uptake of innovative cybersecurity solutions." The call aims to improve industrial and market readiness, suggesting that the projects should be beyond the initial research phase and closer to practical application and commercialization. The development of a cyber toolkit as a service also points to a development and deployment stage.

Funding Amount: The funding amounts vary depending on the specific topic.
DIGITAL-ECCC-2025-DEPLOY-CYBER-09-CABLEHUBS: around €3,000,000 (out of a total budget of €10,000,000)
DIGITAL-ECCC-2025-DEPLOY-CYBER-09-COORDPREP: around €1,500,000 (out of a total budget of €10,000,000)
DIGITAL-ECCC-2025-DEPLOY-CYBER-09-CYBERAI: €3,000,000 to €5,000,000 (out of a total budget of €15,000,000)
DIGITAL-ECCC-2025-DEPLOY-CYBER-09-UPTAKE: around €3,000,000 (out of a total budget of €15,000,000)

Application Type: The deadline model is single-stage, meaning there is only one submission deadline. The call is an open call, as it is published on the EU Funding & Tenders Portal.

Nature of Support: The beneficiaries will receive money in the form of a grant.

Application Stages: There is a single stage for the application process.

Success Rates: The success rates are not explicitly mentioned in the provided text.

Co-funding Requirement: The text does not explicitly state whether co-funding is required.

Summary:

This opportunity is a call for proposals under the Digital Europe Programme, specifically targeting the deployment of strategic cyber capabilities across Europe. The call, DIGITAL-ECCC-2025-DEPLOY-CYBER-09-UPTAKE, focuses on the uptake of innovative cybersecurity solutions for SMEs. The primary goal is to improve the cybersecurity posture of SMEs by providing them with access to innovative tools, services, and support mechanisms. The call aims to enhance industrial and market readiness for EU cybersecurity legislation, particularly the Cyber Resilience Act.

The expected outcome is the development of a cyber toolkit as a service to support SMEs in managing cyber risks, defining, and implementing their cybersecurity strategies. This toolkit should include functionalities such as interfaces with SaaS applications, digital asset mapping, risk assessment, vulnerability alerts, incident reporting, and connections to CSIRTs or Cyber Hubs. The call also emphasizes the importance of support and incident response capabilities, such as non-commercial cybersecurity hotlines, multilingual helplines, and national cyber response platforms.

Eligible applicants are primarily SMEs, but cooperation with Cyber Hubs, CSIRTs, and ISACs is also encouraged. The geographic scope includes the 27 EU Member States, Iceland, and Norway. The funding type is a DIGITAL Action Grant, with indicative grant amounts around €3,000,000 for the DIGITAL-ECCC-2025-DEPLOY-CYBER-09-UPTAKE topic. The application process is single-stage, with a planned opening date of October 28, 2025, and a deadline of March 31, 2026.

In essence, this call is seeking projects that can develop and deploy practical, innovative, and accessible cybersecurity solutions for SMEs, helping them to comply with EU regulations, improve their security practices, and enhance their overall cyber resilience. The focus is on creating a comprehensive cyber toolkit and support ecosystem that addresses the specific needs and challenges faced by SMEs in the digital landscape.