National Cyber Hubs

What is this call about?

The call supports the setting up or strengthening of national cyber hubs that detect, analyse and share cyber threat information. It combines joint procurement of infrastructure, tools and services with a grant for setting up and running the hub, and is aimed at entities in Member States able to host and operate such hubs.

What does this call fund?

Expected outcomes

• World-class national cyber hubs across the Union, using state-of-the-art technology, that act as clearing houses for detecting, gathering, storing and analysing cyber threat data and for sharing and reporting technical information, taking account of established standards.
• Threat intelligence and situational awareness capabilities, and capacity building that supports stronger cooperation between private and public cybersecurity actors.
• Targeted training based on the European Cybersecurity Skills Framework (ECSF).
• Applications that automatically notify private and public actors about vulnerable or compromised systems.

Objective

When a Member State decides to take part in the European Cybersecurity Alert System, it designates or, where appropriate, sets up a national cyber hub: a single entity acting under the authority of the Member State. The aim is to set up or strengthen national cyber hubs with state-of-the-art tools to monitor, understand and proactively manage cyber events, in close cooperation with CSIRTs, ISACs and similar bodies, and to give early warnings to targeted critical infrastructures on a need-to-know basis. The focus is on continuing activities started in previous years.

Scope

• Capacity for new or existing national cyber hubs, such as equipment, tools and data feeds, and costs related to data analysis and interconnection with cross-border cyber hubs; for example automation, analysis and correlation tools and threat intelligence data sources from field data and SIEM data to higher-level CTI.
• Established standards such as CSAF and IntelMQ should be used where available, and applications should be compatible with European standardisation efforts such as the EU Vulnerability Database (EUVD).
• Hubs should use state-of-the-art technology such as artificial intelligence; SMEs should be considered as end recipients of operational cybersecurity information where relevant.
• Hubs could also deploy solutions to monitor and protect critical submarine infrastructure such as undersea cables, which requires operational synergies with Copernicus and its security service.
• Hubs also have a role in knowledge transfer and in supporting training for cybersecurity roles.
• National cyber hubs must share information with other stakeholders and commit to apply, within the next two years, to take part in a cross-border cyber hub.

Work strands

• Procurement: a joint procurement action with the Member State where the hub is located, covering the main infrastructure, tools and services needed to set it up.
• Setting up and operating the hub: grants covering, among other things, preparatory activities, interaction and cooperation with other stakeholders, and related running costs, for example using the jointly procured infrastructure, tools and services. Milestones and deliverables will be set to monitor progress.
• Applications are submitted under both strands. Grants will be awarded only to applicants that were successful in the joint procurement action.

Expression of interest

A call for expression of interest will select entities in Member States that provide the capacity to host and operate national cyber hubs, with the aim of selecting future contracting authorities for the joint procurement. Applicants should describe the hub's aims and role, its links with CSIRTs and other actors, a detailed plan of activities, services, duration, milestones and deliverables, and the equipment, tools and services to be procured.

When is the deadline?

16 March 2027 (130 days)