EU funding for Cyber Resilience Act implementation
A 50 % grant for your EU CRA project.
The SECURE open call from the EU's Digital Europe Programme co-finances projects by small and medium-sized manufacturers implementing the Cyber Resilience Act. This page covers who can apply, what is funded, how Kunnus fits into the eligible costs, what a project costs you, and how the process works.
Last updated: October 21, 2026
At a glance
- Grant
- 50 % of eligible project costs, up to €30,000 per company; the cap applies from €60,000 of project costs.
- Deadline
- The application window opened on 1 October 2026 and closes on 11 December 2026. Awards are competitive, based on evaluation, not on order of receipt.
- Who
- Individual SMEs under the EU definition, based in an EU or EEA country (the guide also names Switzerland), that develop, manufacture, import or distribute products covered by the EU CRA.
- What
- Gap analysis, remediation plan, training, secure-by-design work such as SBOM, threat modelling and CI/CD tests, vulnerability and penetration tests, supply-chain analysis, software licences for the project duration.
- Duration
- Up to 180 days, with projects expected to start from the second quarter of 2027, after the grant agreement is signed.
Applications are open until 11 December 2026; awards are competitive. Only costs incurred after the grant agreement is signed are eligible, so projects are expected to start from the second quarter of 2027. Official call page
The programme
What funding is there for implementing the Cyber Resilience Act?
SECURE is an EU project under the Digital Europe Programme that co-finances cybersecurity work in small and medium-sized enterprises. Its second open call has a budget of at least €11.5 million and is open to manufacturers, importers and distributors of products covered by the Cyber Resilience Act. The grant is paid as cascade funding, directly to the individual company. No consortium is required.
Whether national or regional programmes also fit your plans is something we discuss in the intro call. The rest of this page is about the SECURE call.
Kunnus in the funded project
How does Kunnus fit into the eligible costs?
SECURE funds your company's Cyber Resilience Act project, not a product. Within that project the call allows three cost categories: staff, subcontracting and material costs. Kunnus and our support fall into two of them.
Software licence
Eligible · material costs, project durationKunnus for the project duration. Eligible when SBOM or vulnerability management is part of your project, and only for the duration, at most 180 days.
External support
Eligible · subcontractingOur support during the project, from the gap analysis to the training, billed as subcontracting costs. You choose the provider freely.
Your own person-days
Eligible · staff costsYour team's time in the project, for the maturity assessment, threat modelling and implementation. Eligible as staff costs, plus a flat 7 % for overheads.
- Software licence · Eligible · material costs, project duration
- External support · Eligible · subcontracting
- Your own person-days · Eligible · staff costs
Technical documentation, the declaration of conformity, audits and certifications are not covered by this call (see below).
Eligibility
Who can apply?
SECURE funds individual companies that place products under the Cyber Resilience Act on the market. These conditions come from the call guide:
- A small or medium-sized enterprise under the EU definition: fewer than 250 employees and either up to €50 million in turnover or up to €43 million in balance-sheet total. Partner and linked enterprises count towards these figures.
- Registered in an EU member state or an EEA country; the guide also names Switzerland.
- Controlled from the EU or the countries named above. Companies owned from outside these countries are excluded.
- The company develops, manufactures, imports or distributes products with digital elements that fall, or could fall, under the EU Cyber Resilience Act.
- One application per company. Consortia and joint applications are not part of this call.
Whether your company meets the SME definition is best checked against the official documents; the decision rests with SECURE.
Funded activities
What is funded?
The guide lists these activities as eligible. The project has to fit them.
Eligible activities (examples from the guide)
- Gap analysis, needs and risk analysis, remediation plan
- Training and expert guidance
- Vulnerability and penetration tests
- Secure by design in the development process: threat modelling, SBOM, tests in the CI/CD pipeline
- Incident response and business continuity, supply-chain analysis including SBOM analysis
- Software licences, for example for SBOM or vulnerability management, limited to the project duration and only where they fit the project
Eligible cost categories are your own staff, external service providers (subcontracting) and material costs; overheads are covered by a flat rate of 7 %.
Outside this call
- Drawing up the technical documentation, the EU declaration of conformity, a post-market surveillance plan or a vulnerability disclosure policy
- Accredited audits, certifications and third-party conformity assessment under the EU CRA
- Travel and dissemination activities
Technical documentation and the declaration of conformity therefore remain obligations under the Cyber Resilience Act. Those obligations apply to every product placed on the EU market from 11 December 2027.
Worked examples
What does a funded Cyber Resilience Act project cost?
Three example projects, one below the cap, one close to it and one above, followed by your own figures. The examples use round illustrative values; the arithmetic follows the rules of the call.
| Small project | Mid-sized project | At the cap | |
|---|---|---|---|
| Own person-days | €6,00015 days × €400 | €12,00030 days × €400 | €20,00050 days × €400 |
| External support | €14,6008 days of support × €1,200 + onboarding | €23,00015 days of support × €1,200 + onboarding | €35,00025 days of support × €1,200 + onboarding |
| Software licence (project duration) | €13,30010 products · 180 days, pro rata | €16,30030 products · 180 days, pro rata | €20,70060 products · 180 days, pro rata |
| Material costs | €0 | €1,000 | €2,000 |
| Overheads (7 %) | €2,373 | €3,661 | €5,439 |
| Eligible project costs | €36,273 | €55,961 | €83,139 |
| Grant (50 %, max. €30,000) | €18,137 | €27,981 | €30,000 |
| Own share | €18,137 | €27,981 | €53,139 |
| Optional advance (40 %) | €7,255 | €11,192 | €12,000 |
Licence and support follow the assumptions of our business case calculator. Business case calculator
Run the numbers for your project
Enter your own figures. The calculator applies the rules of the SECURE call for Cyber Resilience Act projects: a 50 % grant capped at €30,000, a 7 % flat rate for overheads, and an optional 40 % advance.
- Staff costs
- €12,000
- Direct costs
- €52,300
- Overheads (7 %)
- €3,661
- Eligible project costs
- €55,961
- Your own share
- €27,981
- Optional advance (40 % of the grant)
- €11,192
- Balance after completion
- €16,788
For guidance only: SECURE decides which costs are eligible, and to what extent, on the basis of your application.
Process and timeline
How does the application process run?
Five steps from application to payout, as the call guide describes them.
- 111 December 2026
Apply
Your company submits its own application on the SECURE platform, in English and with a qualified electronic signature (PAdES).
- 2about 3 months
Evaluation
Awards are competitive and based on the evaluation of the applications. The result is expected about three months after the deadline.
- 3about 1 month later
Grant agreement
Only costs incurred after the grant agreement is signed are eligible. An advance of 40 % is available on request once the agreement is signed.
- 4from Q2 2027 · up to 180 days
Project
A Cyber Resilience Act maturity assessment at the start is mandatory. Your company picks its own service provider, following the best-value-for-money principle and free of conflicts of interest.
- 5lump sum on results
Report and payout
The project closes with a technical report and evidence. The grant is paid as a lump sum once the agreed deliverables and KPIs are met; if the goals are only partly met, the grant is reduced proportionally. The same costs cannot be funded twice.
How we support you
How do we support a funded EU CRA project?
SECURE decides on the grant. The technical side of the project is ours, from scoping to the remediation plan.
Shaping the project
We help you scope a Cyber Resilience Act project that fits the eligible activities and supply the technical content for the project description.
Assessment and remediation plan
We support the Cyber Resilience Act maturity assessment every funded project starts with and derive the gap analysis and the remediation plan from it.
Application support
You submit the application yourself. Who can help with that is covered in the next section.
Application partners
Who supports you with the application?
The application is written in English and submitted with a qualified electronic signature. For that part we work with funding consultants who prepare SECURE applications. We are happy to put you in touch.
Ask for an introduction in the intro callFrequently asked questions
Is there funding for implementing the Cyber Resilience Act?+
Yes, at EU level through the SECURE open call from the Digital Europe Programme: a 50 % grant of up to €30,000 per SME for a Cyber Resilience Act implementation project, with applications open until 11 December 2026. Eligible activities include gap analysis, remediation plan, training, secure-by-design measures and software licences for the project duration. National or regional programmes may come on top, depending on the project.
We are a Swiss manufacturer. Can we take part?+
The call guide names Switzerland alongside the EU member states and the EEA countries. It also requires that the company is controlled from these countries. In case of doubt, the official call documents prevail.
Can we claim Kunnus licences through SECURE?+
A Kunnus licence is eligible as a software licence for the project duration, provided the project includes SBOM or vulnerability management. The guide limits licences to the project duration, at most 180 days, and ties them to the project's activities, so the licence appears in the application as one cost item next to staff and subcontracting costs.
Is drawing up the technical documentation funded?+
Drawing up the technical documentation, the EU declaration of conformity, a post-market surveillance plan and a vulnerability disclosure policy are excluded from this call, as are accredited audits, certifications and third-party conformity assessment. These obligations under the Cyber Resilience Act apply to every product placed on the EU market from 11 December 2027.
When can the project start?+
Only costs incurred after the grant agreement is signed are eligible. The evaluation result is expected about three months after 11 December 2026, the agreement about one month after that, so projects are expected to start from the second quarter of 2027.
Is any of the grant paid in advance?+
An advance of 40 % is available on request once the grant agreement is signed. The remaining grant is paid as a lump sum once the agreed deliverables and KPIs are met.
Does the application have to be in English?+
The application is submitted on the SECURE platform in English and signed with a qualified electronic signature (PAdES).
What happens if we do not meet all the goals?+
Payment is tied to the agreed results. If they are only partly met, the grant is reduced proportionally. It pays to set the deliverables and KPIs realistically in the application.
Book an intro call
In an intro call we look at whether a Cyber Resilience Act project fits SECURE's requirements for your company and how to scope it.
Source: SECURE Second Open Call, retrieved on October 21, 2026. https://www.secure4sme.eu/cascade-funding/second-open-call
The information on this page is provided without warranty. In case of doubt, the official documents of the SECURE call prevail.