Can an SME get EU funding for Cyber Resilience Act compliance?
Yes. The EU-funded SECURE project pays micro, small and medium-sized enterprises 50% of a Cyber Resilience Act compliance project, up to EUR 30,000. The second open call accepts proposals from 1 October to 11 December 2026.
Key takeaways
- SECURE pays a lump sum of 50% of the eligible costs of a CRA compliance project, with a maximum of EUR 30,000, so a project of EUR 60,000 or more gets the full EUR 30,000.
- Only a single legal entity that is a micro, small or medium-sized enterprise established in an EU Member State, Norway, Iceland, Liechtenstein or Switzerland can apply.
- A SECURE budget can include the applicant's own staff time, subcontracted tasks such as a gap analysis or a penetration test, and software licences for the 180-day project period.
- Only costs after the signature of the Sub-Grant Agreement count, and Annex 1 expects the evaluation result about 3 months after the call closes on 11 December 2026.
- Support for the EU declaration of conformity and for vulnerability disclosure policies is Category 15 of Annex 2, which the second call does not fund.
What are the terms of the second SECURE open call?
The second call pays 50% of a CRA compliance project, up to EUR 30,000, for proposals sent between 1 October 2026 and 11 December 2026. You apply on the SECURE platform with the proposal and budget templates of the call.
| Item | Second open call |
|---|---|
| Call | SECURE-CALL #2 |
| Open for proposals | 1 October 2026 to 11 December 2026 |
| Call budget | EUR 11,500,000, which unspent funds of the first call can raise |
| Grant | 50% of the eligible costs, up to EUR 30,000 per project |
| Form of grant | Lump sum, paid when the project reaches its milestones and KPIs |
| Project duration | 180 calendar days at most |
| Payment | Optional pre-financing of 40% at the signature. The balance after the approval of the final Technical Report |
| Funding body | The European Union and the European Cybersecurity Competence Centre, through the SECURE consortium coordinated by the Agenzia per la Cybersicurezza Nazionale (ACN) |
| Language | English |
Who can apply for a SECURE grant?
A micro, small or medium-sized enterprise whose products or business fall, or will fall, in the scope of the CRA can apply. It must meet every condition below (Annex 1, section 2 and Appendix A).
- It is a single legal entity and meets the EU definition of a micro, small or medium-sized enterprise.
- It is legally established in an EU Member State, Norway, Iceland, Liechtenstein or Switzerland, and does the project work there.
- Its ultimate beneficial owner is a citizen of one of those countries, and it is controlled from one of them.
- It names the products that fall, or will fall, in the scope of the CRA.
- The project gets no other EU funding for the same work.
The National Cybersecurity Coordination Centre of your country checks the company eligibility. Annex 1 recommends that applicants contact it before they apply. In Belgium that is the Centre for Cybersecurity Belgium. The CRA scope page shows whether your products are in scope.
Which CRA activities does the second call fund?
The second call funds 15 of the 16 activity categories in Annex 2, plus goods and licences. Annex 2 says Category 15, support for CRA documentation, becomes eligible only after the mechanisms and standards for product certification are identified.
Your own staff or an external supplier can do each activity. Category 15 covers the declaration of conformity, post-market surveillance plans and vulnerability disclosure policies, so leave that work out of the project budget.
| Category | Title in Annex 2 | Second call |
|---|---|---|
| 1 | Accredited trusted third-party audit with the CRA certificate | Eligible |
| 2 | CRA Cybersecurity Governance, Risk Management and Compliance Assessment. Module 1: CRA Conformity Gap Analysis. Module 2: CRA Compliance Needs and Risk Analysis. Module 3: CRA Remediation Plan | Eligible |
| 3 | CRA requirements training | Eligible |
| 4 | CRA-related cybersecurity trainings | Eligible |
| 5 | Expertise support in the CRA conformity Project execution | Eligible |
| 6 | Vulnerability tests | Eligible |
| 7 | Laboratory tests | Eligible |
| 8 | Penetration tests | Eligible |
| 9 | CRA third-party assessment service | Eligible |
| 10 | CRA self-assessment tool | Eligible |
| 11 | Software Development – Security by Design for CRA Products | Eligible |
| 12 | Business Continuity, Incident and Response Planning for CRA Products and Processes | Eligible |
| 13 | Supply Chain Risk & Security Assessment | Eligible |
| 14 | Data Protection & Privacy Compliance | Eligible |
| 15 | CRA Regulatory Obligations and Documentation Support | Not eligible in the second call |
| 16 | Monitoring, protection and prevention services and tools | Eligible |
| Goods | Goods and Licensing | Eligible for the 180-day project period only |
Which costs can a SECURE budget include?
A SECURE budget can include personnel, subcontracting, purchase and equipment costs, plus 7% indirect costs (Annex 1.2). Each cost must be necessary for the project and incurred during the project.
Travel, dissemination, recoverable VAT and costs before the signature of the Sub-Grant Agreement are not eligible.
| Budget category | What it covers | Rule |
|---|---|---|
| Personnel | Time that your employees, owners and in-house contractors work on the project | Daily rate is the annual personnel cost divided by 215. One person-month is 18 days |
| Subcontracting | A project task that a third party performs, such as a gap analysis or a penetration test | Supplier registered and controlled in the EU or EFTA. Best value for money or lowest price. No conflict of interest |
| Purchase | Goods, works and services that the project needs and that are not a project task, such as a software licence | A licence counts only for its share of use during the 180-day project |
| Equipment | Durable assets such as a server | Depreciation only. At most 80% of the total direct costs |
| Indirect | Overheads | Flat rate of 7.000000000000001% of the direct costs, with no justification |
How much of a software licence counts?
Only the share of the licence that the project uses during its 180 days counts (Annex 1.2, section 2.6). On an annual plan, your company pays the rest of the year without the grant.
The CVD Portal SECURE project term covers the project period only, at the annual price on the pricing page pro rata. The full price counts. Prices exclude VAT.
| Plan | SECURE project term, 180 days | Annual price | Annual plan, part that does not count |
|---|---|---|---|
| Reporting | EUR 586 | EUR 1,188 | EUR 602 |
| Compliance | EUR 1,769 | EUR 3,588 | EUR 1,819 |
What does a SECURE budget look like?
In the example below, the applicant's own staff time is the largest cost, and the grant pays half of it. The example is for one product, with example personnel costs.
Use the real personnel costs of your company and a real offer for each subcontracted task.
| Line | Budget category | Amount |
|---|---|---|
| Product lead, 3 person-months at EUR 6,000 | Personnel | EUR 18,000 |
| Engineer, 2 person-months at EUR 5,000 | Personnel | EUR 10,000 |
| External CRA conformity gap analysis | Subcontracting | EUR 8,000 |
| CVD Portal Compliance, 180-day SECURE project term | Purchase | EUR 1,769 |
| Indirect costs, 7% of EUR 37,769 | Indirect | EUR 2,644 |
| Total eligible costs | EUR 40,413 | |
| SECURE grant, 50% | EUR 20,207 | |
| Paid by the company | EUR 20,206 |
When does the grant money arrive?
The grant pays for work done after the signature of the Sub-Grant Agreement, which follows the evaluation result about 3 months after 11 December 2026. The balance comes after the project ends.
Article 14 reporting already applies from 11 September 2026. A manufacturer that waits for the grant has no reporting process for those months. The CRA reporting obligations apply with or without a grant.
| Step | When |
|---|---|
| Proposal deadline | 11 December 2026 |
| Evaluation result | About 3 months after the call closes |
| Sub-Grant Agreement signature | After the result. Optional 40% pre-financing at the same time or a few days later |
| Project | Up to 180 days from the signature. Only costs from the signature count |
| Balance payment | About 2 months after the upload of the final Technical Report |
Where does CVD Portal fit in a SECURE project?
CVD Portal supports five of the funded activities. The licence is a purchase cost, and the time your team works in it is a personnel cost.
The platform also drafts the EU declaration of conformity. That work is Category 15, so it stays outside the second-call budget.
| Annex 2 activity | What CVD Portal does | Plan |
|---|---|---|
| Category 10: CRA self-assessment tool | Product classification and the assessment of each Annex I requirement, with evidence and sign-off | Compliance |
| Category 2, Module 1: CRA Conformity Gap Analysis | The list of open Annex I requirements for each product | Compliance |
| Category 2, Module 2: CRA Compliance Needs and Risk Analysis | The risk assessment and the threat model for each product | Compliance |
| Category 12: Business Continuity, Incident and Response Planning for CRA Products and Processes | The Article 14 workflow, which prepares the early warning, the notification and the final report with their deadlines | Reporting |
| Category 13: Supply Chain Risk & Security Assessment | The SBOM of each product version | Reporting |
Example text for your SECURE proposal
The blocks below fit section 2.2, section 5 and the budget template of the call. Replace each text in square brackets and change the tasks to match your product.
Pick each supplier on best value for money, as Annex 1.2 requires. This text names CVD Portal as an example supplier.
Supplier details
| Legal name | Porta Regulus B.V. |
| Trading name | CVD Portal |
| Registered in | Netherlands |
| KvK number | 42062307 |
| VAT number | NL869534208B01 |
| Address | WTC Amsterdam, Strawinskylaan 6, 1077 XW Amsterdam, Netherlands |
| Hosting | The platform, its database and its backups are hosted in Germany |
| Written offers | secureproject@cvdportal.com |
Section 2.2, project team and suppliers
The CRA compliance software is CVD Portal, operated by Porta Regulus B.V., WTC Amsterdam, Strawinskylaan 6, 1077 XW Amsterdam, Netherlands (KvK 42062307, VAT NL869534208B01). The platform, its database and its backups are hosted in Germany. The Project uses the platform for the CRA self-assessment of [product name], the risk assessment and threat model, and the record of the gap closure. [Company name] selected the supplier on best value for money after a comparison of [number] offers.
Section 5, work package 1
WP1 CRA conformity gap analysis and risk assessment (Annex 2, Category 2 Modules 1 and 2, Category 10) Task 1.1 Classify [product name] under the CRA and assess each Annex I requirement in the CRA self-assessment tool. Task 1.2 Build the threat model and the risk assessment, and map each risk to an Annex I requirement. Task 1.3 Rank the gaps and approve the remediation plan. D1.1 CRA Conformity Gap Analysis Report. KPIs: number of CRA controls evaluated, number of high-priority gaps identified versus total gaps. D1.2 CRA Risk Assessment Report. KPIs: number of risks identified and classified, number of analysed threats. Milestone: delivery of the ranked gap register in month 3.
Section 5, work package 2
WP2 Vulnerability handling and supply chain (Annex 2, Category 2 Module 3, Categories 12 and 13) Task 2.1 Upload the SBOM of each version of [product name] and assess the risk of each third-party component. Task 2.2 Write the incident response plan and the Article 14 reporting procedure, and run one drill. Task 2.3 Close the high-priority gaps from D1.1. D2.1 SBOM-Based Risk Analysis. KPIs: number of components analysed, vulnerabilities identified. D2.2 Incident Response Plan and drill report. KPIs: number of tests conducted, plan completeness percentage. D2.3 Updated Gap Closure Register. KPI: reduction in the number of critical non-compliances. Milestone: drill completed in month 5.
Section 5, detailed explanation of the costs
Purchase cost, software licence. CVD Portal Compliance, SECURE project term of 180 days at the annual price pro rata, EUR 3,588 × 180 / 365 = EUR 1,769 excluding VAT. The term starts on the Project start date and ends with the Project. The licence serves this Project only, so Annex 1.2 section 2.6 admits the full price. The licence supports WP1 Deliverables D1.1 and D1.2.
Annex 1.3, purchase cost line
Item: Software licence, CVD Portal Compliance, SECURE project term Cost description: CRA self-assessment and risk assessment platform for WP1. Licence term equal to the 180-day Project duration (EUR 3,588 × 180 / 365). Amount (EUR): 1,769
Frequently asked questions
Can a SECURE grant pay for a CVD Portal licence?
Yes, as a purchase cost. A licence counts only for the project period, so CVD Portal sells a SECURE project term. The term covers the project period, up to 180 days, at the annual price pro rata, and the full price counts. Compliance for 180 days costs EUR 1,769. The term starts on the project start date, after the signature of the Sub-Grant Agreement, and does not renew by itself.
Does the second call fund the EU declaration of conformity?
No. Support for the declaration of conformity, post-market surveillance plans and vulnerability disclosure policies is Category 15 of Annex 2. Annex 2 says Category 15 is not eligible in the second call.
Can a company outside the EU apply?
Only from Norway, Iceland, Liechtenstein or Switzerland. The applicant must be legally established in an EU Member State or one of those four countries, and must be controlled from one of them. Its ultimate beneficial owner must be a citizen of one of them. A company established in the United States or the United Kingdom cannot apply.
Can we combine SECURE with another EU grant?
Not for the same work. Annex 1 excludes double funding, and costs declared under another EU grant are not eligible.
How do evaluators score a proposal?
Three evaluators score Excellence and relevance, Impact and clarity, and Implementation. The first two have a weight of 1.5 and Implementation a weight of 1. A proposal below 10 overall, or below 10 on two or more criteria, gets no funding.
Does a proposal score higher when it uses tools from other EU projects?
Yes. The Implementation criterion rewards a project that uses tools, guidelines or services from other Digital Europe Programme projects on the CRA.
The SECURE helpdesk answers questions on the call at submission-support@secure4sme.eu. The SECURE FAQ holds its earlier answers.
Sources
- SECURE second open call The call page with every annex and template.
- Annex 1, Open Calls Application Guidelines Dates, eligibility, payment, evaluation and scoring.
- Annex 1.2, Proposal Budget Guidelines Budget categories, the licence rule and ineligible costs.
- Annex 2, CRA Scope and Eligible Activities, Services and Goods The 16 activity categories and the Category 15 exclusion.
- Regulation (EU) 2024/2847, the Cyber Resilience Act, EUR-Lex CELEX:32024R2847.
This page summarises the documents of the second SECURE open call. It is not legal or funding advice. CVD Portal is an independent software vendor. The SECURE consortium runs the call and decides on each proposal.
Published by Porta Regulus B.V., KvK 42062307. Read the editorial policy.
Last updated on 2026-11-04.
Start the CRA work before the grant arrives
Start a trial to classify your product and see your Annex I gaps, which is the evidence a proposal needs. Ask us for a written offer for the SECURE project term to attach to your proposal.