Coordinated preparedness testing and other preparedness actions

What is this call about?

The topic funds preparedness support for entities in highly critical and other critical sectors, including coordinated penetration testing, risk monitoring, vulnerability disclosure and training, mainly through Member State competent authorities.

What does this call fund?

Scope

The topic implements two actions of the Cybersecurity Emergency Mechanism under the Cyber Solidarity Act. Part 1 covers coordinated preparedness testing of entities in sectors of high criticality across the Union, including penetration testing and threat assessment for ICT as well as operational technology and industrial control systems. Part 2 covers other preparedness actions for entities in highly critical and other critical sectors, such as vulnerability monitoring, exercises and training. Proposals should contribute to at least one of these two objectives.

Part 1: coordinated preparedness testing

• Development of penetration testing scenarios for networks, applications, virtualisation, cloud, industrial control systems and IoT, and support for testing essential entities.
• Digital tools and infrastructures for testing and exercises, such as standardised cyber ranges that mimic critical sectors.
• Evaluation and testing of cybersecurity capabilities, compliance activities, consulting on infrastructure security, and threat and risk assessment.
• Support targets competent authorities in the Member States, such as CSIRTs and national cybersecurity authorities.

Part 2: other preparedness actions

• Supply chain risk management and continuous risk monitoring such as attack surface monitoring.
• Support for coordinated vulnerability disclosure, national disclosure policies and the EU Vulnerability Database.
• Exercises, training programmes, maturity checks and continuous learning linked to EU cybersecurity legislation.
• Support may also cover onboarding to the CEF Cybersecurity Core Service Platforms and help industry, especially start-ups and SMEs, to take up opportunities created by the Cyber Resilience Act.

Expected outcomes

Better cooperation, preparedness and resilience in the EU through preparedness, threat and risk assessment services, risk monitoring, improved compliance and vulnerability disclosure, and stronger skills through exercises, training, events and stakeholder consultations.

When is the deadline?

14 January 2027 (69 days)