Make your CRA work cost less
Eligible European product companies can apply for 50% co-financing of CRA-related cybersecurity work, with up to €30,000 in grant funding.
Applications close 11 December 2026.
Who can apply — and what can be funded?
The SECURE second open call is aimed at EU micro, small and medium-sized enterprises whose products fall, or may soon fall, within the scope of the Cyber Resilience Act.
This is most relevant for companies that develop, manufacture, import or distribute connected software or hardware for the EU market — including SaaS products where remote data processing is integral to the product, IoT devices, firmware, gateways and separately marketed software or hardware components.
Funding
- 50% co-financing of eligible project costs
- Up to €30,000 in grant funding per successful applicant
- Applications close 11 December 2026
For example, an eligible €30,000 penetration-testing project could receive up to €15,000 in funding. Reaching the €30,000 grant cap generally requires €60,000 in eligible project costs.
Eligible work can include
- Application, API, cloud, firmware and embedded-system penetration testing
- Vulnerability assessments, configuration reviews and remediation verification
- CRA conformity gap analysis, risk analysis and remediation planning
- Threat modelling, secure coding, SBOM management and CI/CD security testing
- Incident-response and business-continuity planning
- Supply-chain security assessments
Important boundary
Formal accredited CRA certification audits, CRA third-party conformity assessments and formal regulatory-documentation support are not eligible in Call 2. Readiness work may still qualify when it is scoped as gap, risk or remediation work rather than certificate issuance.
Eligibility, cost acceptance and award decisions remain with the SECURE project and its evaluators. Always confirm the final project scope against the official call documents.