Cybersecurity improvement grant: up to 100 000 euros for development activities
The conditions for the cybersecurity improvement grant have been approved. The regulation issued by the Minister of Justice and Digital Affairs entered into force on 24 July 2026. The grant aims to help entities newly covered by the Cybersecurity Act improve their cybersecurity and meet the requirements arising from the NIS2 Directive (§ 1 lg 3).
The Enterprise and Innovation Foundation (EIS) will announce the opening date and budget of the application round separately.
Who can apply for funding?
Funding is available to legal entities that are:
- service providers within the meaning of the Cybersecurity Act;
- domain name registration service providers.
Applicants must have fulfilled the obligation specified in § 41 of the Cybersecurity Act and meet the tax, reporting and other requirements set out in the regulation (§ 11).
The grant is therefore not open to all companies. Before preparing a project, check whether your company falls within the target group defined in the regulation.
Which activities are eligible for funding?
Preparing a cybersecurity roadmap
The roadmap describes the company’s current cybersecurity status, identified shortcomings and the improvements needed. The roadmap must comply with the EIS methodology and must be prepared by an expert holding a valid, internationally recognised professional certification as an information systems auditor (§ 4).
Funding for preparing a roadmap may be granted once under the regulation (§ 7 lg 3).
Development activities based on the roadmap
Eligible activities include:
- organisational and process development;
- preparing and implementing specifications for development activities;
- cybersecurity consultancy, analysis and expert assessments;
- training for management and staff;
- acquiring and using tangible and intangible assets;
- purchasing, upgrading and configuring hardware (§ 8 lg 3).
To apply for development funding, the company must have a cybersecurity roadmap that complies with the EIS methodology (§ 7 lg 2).
Auditing development activities
Funding is also available for auditing development activities carried out under the roadmap. The audit must be conducted by an expert holding an internationally recognised professional certification as an information systems auditor (§ 12 lg 6).
Development activities and the audit may be submitted as a single project or as separate applications (§ 7 lg 4).
How much funding is available?
| Activity | Grant amount | Funding rate |
|---|---|---|
| Preparing a cybersecurity roadmap | 5000 euros | lump-sum grant |
| Development activities based on the roadmap | 10 000–100 000 euros | up to 50% |
| Auditing development activities | up to 20 000 euros | up to 50% |
For development activities and audits, at least 50% of eligible costs must be covered by the applicant’s own contribution. Other non-repayable grants from the state, local authorities or the European Union cannot count towards this contribution (§ 10 lg-d 4–5).
How long can a project last?
A roadmap preparation project may last up to six months. A project covering development activities and an audit may last up to 12 months in total (§ 9 lg 4).
Project activities must not begin, and binding commitments must not be made, before the application is submitted to EIS (§ 9 lg 2).
The project must end no later than 31 December of the year following submission of the application (§ 9 lg 3).
How does the application process work?
Applications are submitted through the e-grants portal. Applications are accepted on a rolling basis until the budget is exhausted, applications are suspended or the round is closed (§ 13).
Applicants may apply for funding for only one project at a time and may implement only one project supported under the same regulation at a time (§ 13 lg 1).
Roadmap and audit applications are approved if they meet the requirements. Applications for development activities are assessed against three criteria:
- quality of the activities and alignment with the roadmap – 50%;
- cost-effectiveness of the project – 25%;
- the applicant’s ability to implement the project – 25% (§ 15 lg 5).
De minimis aid
The grant is awarded as de minimis aid. The general de minimis aid ceiling, including the grant applied for, is 300 000 euros over three years.
The ceiling is 50 000 euros in the agricultural sector and 40 000 euros in the fisheries and aquaculture sector (§ 10 lg-d 6–8).
What should a company do before applying?
Before the application round opens, it is worth:
- checking whether the company falls within the scheme’s target group;
- ensuring that the obligation under the Cybersecurity Act has been fulfilled;
- assessing the amount of de minimis aid already used;
- mapping out the planned activities and the applicant’s own contribution;
- avoiding binding contracts and orders before submitting the application.
Summary
The cybersecurity improvement grant can fund the preparation of a cybersecurity roadmap, development activities based on the roadmap and audits of those activities.
The roadmap grant is 5000 euros, the development grant is 10 000–100 000 euros and the audit grant is up to 20 000 euros. For development activities and audits, the maximum funding rate is 50%.
EIS will publish the application round’s opening date, budget, forms and detailed assessment methodology on its website.