Cross-border Cyber Hubs

What is this call about?

The call supports the setting up of cross-border cyber hubs that pool and analyse cyber threat data across several Member States. It combines joint procurement of infrastructure, tools and services with a grant for setting up and running the hub, and is aimed at entities in Member States able to host and operate such hubs.

What does this call fund?

Expected outcomes

• State-of-the-art cross-border cyber hubs across the Union that pool cyber threat data from several Member States, with highly secure infrastructure and advanced analytics tools to detect, gather, store and analyse threat data and to share and report technical information and analyses.
• Sharing of threat intelligence between national cyber hubs, and information-sharing arrangements with competent authorities and networks, including CSIRTs.

Objective

Cross-border SOC platforms were funded under earlier calls; this cooperation is now foreseen for cross-border cyber hubs. They should add new capacity that builds on and complements existing security operations centres, cyber hubs, CSIRTs, information sharing and analysis centres and other relevant actors. The action is aimed mainly at new cross-border cyber hubs, and support for SOCs already started under the DIGITAL work programmes 2021-2022 and 2023-2024 could be included where needed to ensure cooperation with the hubs. One consortium (ENSOC and ATHENA) is already funded.

Scope

• Processes, tools and services to prevent, detect and analyse emerging cyber attacks, and acquisition or adoption of shared (automated) tools, processes and data infrastructures for managing and sharing actionable cybersecurity information across the EU.
• Well-established open standards should be considered, such as MISP for sharing technical information, CSAF for advisories and IntelMQ for cybersecurity-related messages.
• The platforms should act as a central point that pools data and cyber threat intelligence and spreads threat information widely, for example to CERTs/CSIRTs, ISACs and critical infrastructure operators. In line with the Cyber Solidarity Act, hubs and the CSIRTs network cooperate closely and agree procedural arrangements for information sharing.
• Hubs could also deploy solutions to monitor and protect critical submarine infrastructure such as undersea cables, which requires operational synergies with the EU space programme Copernicus and its security service.
• Where hubs obtain information on a potential or ongoing large-scale cyber incident, they provide relevant information and early warnings to Member State authorities and the Commission through EU-CyCLONe and the CSIRTs network.

Work strands

• Procurement: a joint procurement action with a Member State taking part in the cross-border cyber hub, covering the infrastructure, tools and services needed to set it up.
• Setting up and operating the hub: grants covering, among other things, preparatory activities, interaction and cooperation with other stakeholders, and related running costs, for example using the jointly procured infrastructure, tools and services, and staff. Milestones and deliverables will be set to monitor progress.
• Applications are submitted under both strands. Grants will be awarded only to applicants that were successful in the joint procurement action.

Expression of interest

A call for expression of interest will select entities in Member States that provide the capacity to host and operate cross-border cyber hubs. Applicants should describe the hub's aims, role and links with other cybersecurity actors, a detailed plan of activities and services with main milestones and deliverables, and the equipment, tools and services to be procured and integrated.

When is the deadline?

16 March 2027 (131 days)