Loading…
Strategic Analysis
A winning proposal must position itself as an operational implementation engine bridging EU cybersecurity regulatory frameworks (NIS 2, CRA, GDPR) with market deployment, specifically easing compliance burdens for SMEs through open-source conformity assessment tools and automated incident/vulnerability reporting. The strategic differentiator lies in balancing technical validation pilots with cross-border threat intelligence federation and an inclusive talent pipeline grounded in the European Cybersecurity Skills Framework (ECSF).
TRL 6 → 8
Based on programme defaults
The implementation of EU legislation in cybersecurity to be supported to achieve a higher cybersecurity level in Europe.
Provide support to SMEs aiming to enhance cybersecurity resilience with a particular focus on legal requirements deriving from EU legislation such as NIS 2, Cyber Resilience Act, Cybersecurity Act, etc., including practical guidelines and user-friendly tools allowing the company to check whether its solutions are compliant with the requirements of the new legislation considering open standards.
Develop reporting platforms for NIS 2 (e.g. incident reporting platform) and CRA (e.g. vulnerability single reporting platform).
Establish short-term and long-term actions to prepare professionals to properly implement the requirements of new EU regulations in entities covered by those regulations.
Develop programmes to promote diversity and equal opportunities for all young Europeans, providing tailored onboarding programmes for youth. These programmes will offer resources and easy access to educational content, ensuring that participants from various backgrounds can engage with cybersecurity training. By supporting non formal education and offering participation opportunities, such as cybersecurity challenges, these efforts will help equip the next generation with the skills needed to thrive in the sector.
Creation and development of cooperation initiatives in cross-border and cross-sector contexts. Encourage collaboration between national and regional authorities to enhance cyber resilience and raise cybersecurity maturity levels through development and implementation of common methodologies.
The design and evaluation of platforms for training programmes and tools for cross country exchange will support these efforts. Additionally, benchmarking and assessment programmes will help optimise performance, enhancing participants’ skills. These initiatives, including training materials, with cybersecurity challenges as one example, will also include peer exchange and fellowship opportunities, fostering a connected community of cybersecurity professionals. By encouraging cross-border collaboration and ongoing engagement, these programmes aim to strengthen Europe’s cybersecurity workforce and support long-term talent development.
Support the development of cross-border collaboration programmes, enabling pan European teams to participate in international cybersecurity competitions, enhancing visibility and competitiveness on the global stage. These initiatives will provide teams with access to advanced tools, mentorship, and leadership training, fostering the growth of a European cybersecurity talent pipeline. By promoting excellence, skills development, and leadership, this support will ensure that Europe’s top talent remains competitive, well-prepared, and collaborative in facing global cybersecurity challenges.
At national level, federate national actors working on cyber threat intelligence and national competent authorities around a common platform. Including facilitating and centralising the notification process for NIS 2 entities.
At vertical level within the EU, organise or support cyber threats intelligence (CTI) unclassified information sharing in confidence between stakeholders of the given vertical.
At EU level, enabling and organising collaboration between countries and information sharing.
Collaborate on and implement a framework of guidelines - in the EU or multiple EU MS - to ensure and continuously improve cybersecurity both within the public and private sectors through better protection of their data, a significant reduction of the risk of the most common cyberattacks, and an increase of cyber resilience in general.
Implementation of guidelines, standardised processes, or manuals – in the EU or multiple EU MS – concerning the most challenging issues, supporting specific stakeholders and sectors addressed by cybersecurity legislation.
Develop and implement tools, raise awareness and encourage and facilitate industry uptake, with a focus on SMEs, of conformity assessments of essential cybersecurity requirements for products with digital elements (hardware and software) under the CRA.
Support for mechanisms reducing the administrative burden for entities, like single entry point for incident notification.
Establish secure communication channels allowing for cooperation and information sharing initiatives.
Support the organisation of regular meetings/workshops to identify good practices within specific sectors or emerging areas and facilitate collaborative efforts between different sectors.
Support the development of training courses, on the basis of the ECSF and exercises that promote capacity building and internal awareness.
Contribution to CR standardisation: Training materials and training actions on cybersecurity certification for national authorities and conformity assessment bodies.
Fostering certification: Educational and supporting materials and an explanatory press campaign using interactive material such as ‘Do I comply with CRA?’. Information campaign through various channels such as conferences, meetings, etc. Website dedicated to the mandatory certification and conformity assessments of essential requirements.
Development of training programmes and materials, including tools for cross-country collaboration and exchange, aimed at enhancing participants’ skills and readiness for real-world threats. These programmes can also support non-formal education for high school students and teachers, enhancing digital literacy and cybersecurity awareness at early educational levels.
Creation of benchmarking and assessment programmes to evaluate and optimise the performance of participants in cybersecurity training programmes, ensuring continuous improvement and alignment with industry standards.
Implement peer exchange and fellowship programmes, aimed at fostering a connected, resilient community of cybersecurity professionals across Europe. These programmes will also include support for cross-border training initiatives and non formal education activities, ensuring that both students and educators can participate in hands-on cybersecurity learning experiences and contribute to long-term talent development.
Establishment of cross-border collaboration programmes to support the development of pan-European teams in cybersecurity competitions. These programmes will provide access to mentorship, advanced tools, and leadership training, ensuring European teams remain competitive on the global stage. Additionally, the programmes will foster the growth of a European cybersecurity leadership pipeline, enhancing Europe’s visibility and effectiveness in international cybersecurity challenges.
Support organisations, including SMEs, in assessing the robustness, applicability and relevance of security- and privacy-enhancing technologies to be integrated in the ICT products and services they develop.
Set-up pilot projects to test CRA compliance, use open-source software and libraries for conformity assessment and testing; develop assessment methodologies for the purpose of CRA compliance/requirements.
Develop best practices or guidelines for setting-up and operating market surveillance authorities in MSs; develop awareness of CRA requirements.
Support organisations, including SMEs, in commercialising privacy-enhancing technologies and demonstrate how they can address security and privacy risks from emerging technologies.
Facilitate cooperation between the producers of emerging technologies, the users of those technologies and regulators. Such cooperation would make it possible to identify which requirements can be met by which privacy-enhancing technology, in which use cases, to what extent they could facilitate compliance or reduce the cost thereof, and how to engineer it in practice, during the early phases of design and development of ICT products and services.
Strengthen cooperation in the whole privacy-enhancing technology value chain, including between researchers, providers, integrators and users, and GDPR national authorities/European supervisors.
No expected impacts identified for this destination.
Cyber Resilience Act (CRA)
highThe Cyber Resilience Act (Regulation (EU) 2024/2847) introduces mandatory EU-wide cybersecurity requirements for hardware and software products with digital elements throughout their entire lifecycle. It mandates security-by-design, vulnerability handling processes, and obligations for manufacturers to report actively exploited vulnerabilities and incidents.
Evaluators expect proposals to directly address how digital tools, architectures, or products developed within the project integrate security-by-design and vulnerability management workflows consistent with CRA obligations. Projects should show clear pathways to compliance and support industry uptake of conformity assessment processes.
NIS 2 Directive
highThe NIS 2 Directive (Directive (EU) 2022/2555) modernizes the EU legal framework to elevate the overall level of cybersecurity across critical sectors and essential entities. It imposes baseline risk management measures, stricter incident reporting timelines, and enhanced supply chain security requirements across the Union.
Evaluators expect proposals to align operational protocols, tooling, and threat intelligence sharing frameworks with the risk-management and notification obligations stipulated under NIS 2. Projects should specifically consider operational readiness for essential and important entities.
Cybersecurity Act
highThe Cybersecurity Act (Regulation (EU) 2019/881) granted a permanent mandate to the EU Agency for Cybersecurity (ENISA) and established a common European cybersecurity certification framework for ICT products, services, and processes. It aims to prevent fragmentation across national certification schemes and ensure trusted digital solutions across the internal market.
Evaluators expect projects to leverage existing European certification schemes (EUCC, EUCS) or demonstrate how novel security architectures and validation frameworks can integrate into future ENISA-led certification mechanisms.
General Data Protection Regulation (GDPR)
mediumDigital Operational Resilience Act (DORA)
mediumThe Digital Operational Resilience Act (Regulation (EU) 2022/2554) establishes uniform cybersecurity and operational resilience rules for the financial services sector and critical third-party ICT service providers. It covers ICT risk management, incident management and reporting, digital operational resilience testing, and third-party risk oversight.
Evaluators look for targeted approaches to continuous risk assessment, robust testing procedures (such as threat-led penetration testing), and contractual compliance with critical ICT third-party provider rules where solutions impact financial market participants.
Artificial Intelligence Act (AI Act)
mediumThe Artificial Intelligence Act (Regulation (EU) 2024/1689) establishes a harmonized, risk-based legal framework for the development, deployment, and use of AI systems across the EU. It enforces strict compliance and governance obligations for high-risk AI, including requirements for data quality, human oversight, transparency, and technical robustness against adversarial attacks.
Evaluators expect proposals utilizing or developing AI-driven cybersecurity tools to classify their systems under the AI Act risk categories and detail specific measures for algorithmic transparency, adversarial resilience, and ethical oversight.
Digital Education Action Plan
lowThe Digital Education Action Plan (2021-2027) is an EU policy initiative aimed at supporting the sustainable and effective adaptation of education and training systems across Europe to the digital age. It focuses on promoting a high-performing digital education ecosystem and enhancing digital skills and competences, including cybersecurity literacy.
Evaluators expect training curricula, capacity-building tracks, and educational awareness modules within cybersecurity proposals to reference and align with the Action Plan's digital skills frameworks (such as DigComp) and address the cybersecurity workforce gap.
">
described in section 5 of the call document.
Proposal page limits and layout: described in Part B of the Application Form available in the Submission System.
described in section 6 of the call document.
described in section 6 of the call document.
described in section 7 of the call document.
described section 8 of the call document and the Online Manual.
described in section 9 of the call document.
described in section 4 of the call document.
described in section 10 of the call document.
Application form templates
Standard application form (DEP) — the application form specific to this call is available in the Submission System
Model Grant Agreements (MGA)
Digital Europe Cybersecurity Work Programme 2025-2027
EU Financial Regulation 2024/2509
Rules for Legal Entity Validation, LEAR Appointment and Financial Capacity Assessment
EU Grants AGA — Annotated Model Grant Agreement
Funding & Tenders Portal Online Manual
Evaluators will prioritize concrete, ready-to-deploy operational mechanisms over theoretical policy studies, looking closely for scalable technical tools that directly operationalize CRA conformity assessments and single-entry-point incident reporting under NIS 2. They will scrutinize the consortium's genuine access to national competent authorities, market surveillance bodies, and pan-European SME ecosystems, as well as measurable capacity building metrics (e.g. validated training uptake, cross-border exercises, and inclusion of underrepresented youth).
Everything the call asks for, seen from the call's point of view. Each line shows what answers it, and which partner carries it.
This matrix lists everything the call asks for: outcomes, impacts, scope, the requirements buried in the call text, and policy alignment. Sign up free and GrantForge tracks each line against the concept you build.
| Requirement | Covered by | Carried | Status |
|---|---|---|---|
| Scope activities | |||
| SC1The implementation of EU legislation in cybersecurity to be supported to achieve a higher cybersecurity level in Europe. | · | · | Sign up to track |
| SC2Provide support to SMEs aiming to enhance cybersecurity resilience with a particular focus on legal requirements deriving from EU legislation such as NIS 2, Cyber Resilience Act, Cybersecurity Act, etc., including practical guidelines and user-friendly tools allowing the company to check whether its solutions are compliant with the requirements of the new legislation considering open standards. | · | · | Sign up to track |
| SC3Develop reporting platforms for NIS 2 (e.g. incident reporting platform) and CRA (e.g. vulnerability single reporting platform). | · | · | Sign up to track |
| SC4Establish short-term and long-term actions to prepare professionals to properly implement the requirements of new EU regulations in entities covered by those regulations. | · | · | Sign up to track |
| SC5Develop programmes to promote diversity and equal opportunities for all young Europeans, providing tailored onboarding programmes for youth. These programmes will offer resources and easy access to educational content, ensuring that participants from various backgrounds can engage with cybersecurity training. By supporting non formal education and offering participation opportunities, such as cybersecurity challenges, these efforts will help equip the next generation with the skills needed to thrive in the sector. | · | · | Sign up to track |
| SC6Creation and development of cooperation initiatives in cross-border and cross-sector contexts. Encourage collaboration between national and regional authorities to enhance cyber resilience and raise cybersecurity maturity levels through development and implementation of common methodologies. | · | · | Sign up to track |
| SC7The design and evaluation of platforms for training programmes and tools for cross country exchange will support these efforts. Additionally, benchmarking and assessment programmes will help optimise performance, enhancing participants’ skills. These initiatives, including training materials, with cybersecurity challenges as one example, will also include peer exchange and fellowship opportunities, fostering a connected community of cybersecurity professionals. By encouraging cross-border collaboration and ongoing engagement, these programmes aim to strengthen Europe’s cybersecurity workforce and support long-term talent development. | · | · | Sign up to track |
| SC8Support the development of cross-border collaboration programmes, enabling pan European teams to participate in international cybersecurity competitions, enhancing visibility and competitiveness on the global stage. These initiatives will provide teams with access to advanced tools, mentorship, and leadership training, fostering the growth of a European cybersecurity talent pipeline. By promoting excellence, skills development, and leadership, this support will ensure that Europe’s top talent remains competitive, well-prepared, and collaborative in facing global cybersecurity challenges. | · | · | Sign up to track |
| SC9At national level, federate national actors working on cyber threat intelligence and national competent authorities around a common platform. Including facilitating and centralising the notification process for NIS 2 entities. | · | · | Sign up to track |
| SC10At vertical level within the EU, organise or support cyber threats intelligence (CTI) unclassified information sharing in confidence between stakeholders of the given vertical. | · | · | Sign up to track |
| SC11At EU level, enabling and organising collaboration between countries and information sharing. | · | · | Sign up to track |
| SC12Collaborate on and implement a framework of guidelines - in the EU or multiple EU MS - to ensure and continuously improve cybersecurity both within the public and private sectors through better protection of their data, a significant reduction of the risk of the most common cyberattacks, and an increase of cyber resilience in general. | · | · | Sign up to track |
| Expected outcomes | |||
| EO1Implementation of guidelines, standardised processes, or manuals – in the EU or multiple EU MS – concerning the most challenging issues, supporting specific stakeholders and sectors addressed by cybersecurity legislation. | · | · | Sign up to track |
| EO2Develop and implement tools, raise awareness and encourage and facilitate industry uptake, with a focus on SMEs, of conformity assessments of essential cybersecurity requirements for products with digital elements (hardware and software) under the CRA. | · | · | Sign up to track |
| EO3Support for mechanisms reducing the administrative burden for entities, like single entry point for incident notification. | · | · | Sign up to track |
| EO4Establish secure communication channels allowing for cooperation and information sharing initiatives. | · | · | Sign up to track |
| EO5Support the organisation of regular meetings/workshops to identify good practices within specific sectors or emerging areas and facilitate collaborative efforts between different sectors. | · | · | Sign up to track |
| EO6Support the development of training courses, on the basis of the ECSF and exercises that promote capacity building and internal awareness. | · | · | Sign up to track |
| EO7Contribution to CR standardisation: Training materials and training actions on cybersecurity certification for national authorities and conformity assessment bodies. | · | · | Sign up to track |
| EO8Fostering certification: Educational and supporting materials and an explanatory press campaign using interactive material such as ‘Do I comply with CRA?’. Information campaign through various channels such as conferences, meetings, etc. Website dedicated to the mandatory certification and conformity assessments of essential requirements. | · | · | Sign up to track |
| EO9Development of training programmes and materials, including tools for cross-country collaboration and exchange, aimed at enhancing participants’ skills and readiness for real-world threats. These programmes can also support non-formal education for high school students and teachers, enhancing digital literacy and cybersecurity awareness at early educational levels. | · | · | Sign up to track |
| EO10Creation of benchmarking and assessment programmes to evaluate and optimise the performance of participants in cybersecurity training programmes, ensuring continuous improvement and alignment with industry standards. | · | · | Sign up to track |
| EO11Implement peer exchange and fellowship programmes, aimed at fostering a connected, resilient community of cybersecurity professionals across Europe. These programmes will also include support for cross-border training initiatives and non formal education activities, ensuring that both students and educators can participate in hands-on cybersecurity learning experiences and contribute to long-term talent development. | · | · | Sign up to track |
| EO12Establishment of cross-border collaboration programmes to support the development of pan-European teams in cybersecurity competitions. These programmes will provide access to mentorship, advanced tools, and leadership training, ensuring European teams remain competitive on the global stage. Additionally, the programmes will foster the growth of a European cybersecurity leadership pipeline, enhancing Europe’s visibility and effectiveness in international cybersecurity challenges. | · | · | Sign up to track |
| EO13Support organisations, including SMEs, in assessing the robustness, applicability and relevance of security- and privacy-enhancing technologies to be integrated in the ICT products and services they develop. | · | · | Sign up to track |
| EO14Set-up pilot projects to test CRA compliance, use open-source software and libraries for conformity assessment and testing; develop assessment methodologies for the purpose of CRA compliance/requirements. | · | · | Sign up to track |
| EO15Develop best practices or guidelines for setting-up and operating market surveillance authorities in MSs; develop awareness of CRA requirements. | · | · | Sign up to track |
| EO16Support organisations, including SMEs, in commercialising privacy-enhancing technologies and demonstrate how they can address security and privacy risks from emerging technologies. | · | · | Sign up to track |
| EO17Facilitate cooperation between the producers of emerging technologies, the users of those technologies and regulators. Such cooperation would make it possible to identify which requirements can be met by which privacy-enhancing technology, in which use cases, to what extent they could facilitate compliance or reduce the cost thereof, and how to engineer it in practice, during the early phases of design and development of ICT products and services. | · | · | Sign up to track |
| EO18Strengthen cooperation in the whole privacy-enhancing technology value chain, including between researchers, providers, integrators and users, and GDPR national authorities/European supervisors. | · | · | Sign up to track |
| Other requirements | |||
| REQ1Consortium representation across privacy-enhancing technology value chainConsortia should consider including at least one representative from each of the following categories: privacy-enhancing technology researchers, privacy-enhancing technology providers, developers of ICT products and services integrating privacy-enhancing technologies, and ICT product and services user organisations. | · | · | Sign up to track |
| REQ2Involvement of conformity assessment and certification stakeholdersDevelopment of supporting tools and software platforms for certification and evaluation processes should involve relevant stakeholders such as Certification Bodies (CBs), Conformity Assessment Bodies (CABs), and client representatives. | · | · | Sign up to track |
| REQ3Promotion of diversity and inclusion of underrepresented groupsThe action requires fostering cross-border collaboration and promoting diversity within the cybersecurity workforce, specifically encouraging participation from women and other underrepresented groups. | · | · | Sign up to track |
| REQ4Synergies with the Cybersecurity Skills AcademyActivities related to cybersecurity challenges and capacity building must be implemented in conjunction with and in support of initiatives like the Cybersecurity Skills Academy. | · | · | Sign up to track |
| REQ5Alignment with the European Cybersecurity Skills Framework (ECSF)Training courses, capacity building, and awareness exercises must be developed on the basis of the European Cybersecurity Skills Framework (ECSF). | · | · | Sign up to track |
| REQ6Security and privacy by design in ICT developmentEfforts must promote security and privacy 'by design' during the early design and development phases of ICT products and services, including IoT, Operational Technology, Identity, and e-government systems. | · | · | Sign up to track |
| REQ7Use of open-source software and open standardsProjects are expected to use open-source software and libraries for conformity assessment and testing, and take into account open standards for compliance tools. | · | · | Sign up to track |
| Expected impacts | |||
| No expected impacts in this call. | |||
| Underlying policies | |||
| POL1cyber resilience actThe Cyber Resilience Act (Regulation (EU) 2024/2847) introduces mandatory EU-wide cybersecurity requirements for hardware and software products with digital elements throughout their entire lifecycle. It mandates security-by-design, vulnerability handling processes, and obligations for manufacturers to report actively exploited vulnerabilities and incidents. | · | · | Sign up to track |
| POL2nis 2 directiveThe NIS 2 Directive (Directive (EU) 2022/2555) modernizes the EU legal framework to elevate the overall level of cybersecurity across critical sectors and essential entities. It imposes baseline risk management measures, stricter incident reporting timelines, and enhanced supply chain security requirements across the Union. | · | · | Sign up to track |
| POL3cybersecurity actThe Cybersecurity Act (Regulation (EU) 2019/881) granted a permanent mandate to the EU Agency for Cybersecurity (ENISA) and established a common European cybersecurity certification framework for ICT products, services, and processes. It aims to prevent fragmentation across national certification schemes and ensure trusted digital solutions across the internal market. | · | · | Sign up to track |
The binding rules of this call. Items marked auto are verified by GrantForge from the call and the template. The others are yours to confirm.
4 key insights you must internalise before writing. Each is grounded in the call text and tells you what evaluators will actually look for. Share these with your consortium before drafting.
Proposals must strictly avoid theoretical policy studies and instead deliver concrete, ready-to-deploy operational tools like CRA conformity assessments or NIS 2 reporting platforms. Evaluators will heavily scrutinize the consortium's direct, proven access to national competent authorities, market surveillance bodies, and SME ecosystems to ensure these tools can be immediately scaled.
Source: Evaluation_pre_award
A proposal addressing privacy-enhancing technologies (PETs) must construct a consortium that spans the entire value chain. Evaluators will look for the explicit inclusion of PET researchers, providers, ICT developers integrating PETs, and end-user organizations. Missing any of these four pillars will severely compromise the operational credibility of the proposal.
Source: Scope
Any capacity-building or training component must go beyond generic awareness campaigns. Evaluators are instructed to score based on measurable capacity building metrics, specifically demanding validated training uptake, cross-border exercises, and the targeted inclusion of underrepresented youth aligned with the European Cybersecurity Skills Framework (ECSF).
Source: Evaluation_pre_award
While the call covers a broad spectrum of EU cybersecurity frameworks, a compliant proposal must explicitly anchor its activities to at least one specific legislative act (e.g., CRA, NIS 2, GDPR). Applicants must clearly map their technical tools or training pipelines to the exact compliance obligations of their chosen legislation rather than attempting a superficial, catch-all approach.
Source: Scope
Nothing to show for this call yet.