SECURE - Second Open Call

The CRA sets common cybersecurity requirements for products with digital elements placed on the EU market. These requirements cover the entire product lifecycle, from design and development to updates and end-of-life. The main obligations will apply in full from 2027 and affect manufacturers, developers, importers and distributors. Certain sectors are excluded, including medical devices, aviation and motor vehicles.

SECURE co-finances targeted projects that help companies prepare for and meet CRA requirements.

Examples of eligible activities include:

• Regulatory compliance, e.g. audits, support for conformity assessment and policy development

• Product security improvements, e.g. vulnerability assessment and penetration testing, source code analysis and application security

• Security improvements to production infrastructure, including ICT and OT resilience

• Governance and risk management, e.g. incident detection, response and notification processes, risk assessments, supply chain security, and product maintenance and update plans

• Awareness raising and training

• Procurement of goods and professional services needed to meet the requirements

Key details

• Grant amount: 50% of eligible costs, up to €30,000 per project. The €30,000 cap also applies if total project costs exceed €60,000. The grant is paid as a lump sum. The total call budget is at least €11.5 million.

• Application period: 1 October – 11 December 2026

• Who can apply:

  • Micro, small and medium-sized enterprises under the EU definition (fewer than 250 employees, with turnover not exceeding €50m and/or a balance sheet total not exceeding €43m), including sole traders

  • Companies must be established and have their main operations in the EU or EEA, including Iceland. The ultimate beneficial owner must be a citizen of an eligible country, and the project must be carried out in an eligible country.

  • The business must be involved in developing, manufacturing, importing or distributing digital products or services that fall, or will fall, within the scope of the CRA

  • Only individual companies may apply; consortia are not eligible. Subcontracting to consultants and other suppliers is permitted.

• Project duration: Up to 180 days from the signature of the sub-grant agreement. Only costs incurred after the agreement is signed are eligible.

• Payments: Applicants can request 40% pre-financing in their proposal. The balance is paid once the final technical report has been approved. The grant may be reduced if milestones and key performance indicators (KPIs) are not fully achieved.

• Evaluation: Three experts assess excellence and relevance, impact and clarity, and implementation. Proposals must score at least 10 out of 15 points. In the event of a tie, submission time determines the ranking, so submitting early is advisable. Results are expected approximately three months after the application deadline.

• State aid: The grant does not fall under the de minimis or General Block Exemption Regulation (GBER) rules.

• How to apply: Proposals must be submitted in English through the SECURE application portal. Documents must be signed using a qualified electronic signature (PAdES). Applicants must also provide a company registration extract, an ownership structure chart and their latest financial statements.

The role of NCC-IS

National Cybersecurity Coordination Centres (NCCs) carry out eligibility checks for SECURE applicants. For Icelandic companies, these checks are carried out by the NCC-IS representative at Rannís.

Interested applicants are encouraged to read the call guidelines and annexes and the FAQ, and to prepare their proposals well in advance of the deadline.

For more information, contact Rannís: ncc@rannis.is / +354 515 5800.