CIPHER Open Call 1

Purpose

Research and innovation

R&D relevance

2 of 3

Poland eligible

Yes

Country limit

—

Region

Any

Consortium

Unclear

Readiness level (TRL)

—

Topics

• Cybersecurity testing
• NIS2 compliance
• Automated threat detection
• Vulnerability assessment
• Cyber ranges
• Infrastructure as code

Machine-classified from the call text; check eligibility at the source. 23 Oct 2026

Typed facts extracted from the source documents by Scindu's grant-data review. Each value keeps its own conditions. Unknown means unstated, not zero or unlimited.

Applicant restrictionCIPHER Open Call 1

The call requires an Ownership and Control Declaration from each applicant at proposal submission, electronically signed by an authorized legal representative using a qualified e-signature, except public bodies validated as such in the EC Participant Register. Annex4 requests full ownership/control information, including owners at 5% or more of capital/voting rights, special rights and indirect ownership layers. The separately published assessment procedure says the consortium assesses ownership and control, including decisive influence, governance, financial/contractual relationships and ultimate owners, and may request further evidence. It is an organizer’s call procedure, not itself a generalized legal rule; eligibility depends on the referenced Digital Europe call conditions and applicant-specific facts, not checked here.

No applicant’s ownership/control status adjudicated; Annex4 disclosure threshold is not itself stated as an exclusion threshold.

Application restriction

Submission is through F6S; all mandatory answers/documents must be present or the application is disqualified. Documents must be English; unless otherwise agreed the Guide says electronic PDF without printing restrictions, yet Table 4 specifies Word for Annex 3 and XLSX for the budget. Acronym/naming restrictions apply and post-closure resubmission is not accepted. Before closure, resubmission is possible but guaranteed only when requested at least two business days before deadline. Selected applicants complete KYC and legal/financial checks, provide valid VAT/PIC, legal-existence/tax proof, bank details and signed declarations; consortium/SME records apply where relevant. The final tripartite agreement is non-alterable, e-signed unless otherwise agreed, with contracting documentation deadlines normally concluded within two weeks; failure in time results in rejection. The eligible-country VAT branch and contracting VAT requirement are both explicit.

Consortium allowedCIPHER Open Call 1

Yes

Guide permits either one legal entity or a consortium; consortium composition is limited to three independent legal entities and has role requirements.

Consortium members, maximumCIPHER Open Call 1

3 independent legal entities

Applies only when applying as a consortium; single legal-entity applications are separately eligible.

Eligible project scope

K1 is a documentation-only NIS2/IEC 62443 audit of CIPHER’s toolset, not active testing. The minimum framework is a capability-vs-Article 21(2) coverage matrix, severity-rated gap analysis and next-phase requirement recommendations; negative findings/no-gap areas require rationale and delivery uses the agreed template. KPIs include 100% of in-scope Article 21(2) measures assessed, distinct severity-rated gaps, each high/medium gap mapped to at least one next-phase requirement, and traceability to a clause/component. The applicant must have structured, traceable audit capability and the K1 core team must include a qualified certified auditor; this role remains a challenge qualification, not a salary or hiring vacancy. Expected applicant profile: Certified auditor (e.g. ISO 27001 Lead Auditor / IEC 62443 assessor) with demonstrable NIS2 compliance-assessment experience in critical sectors.

Eligible project scope

K2 is a methodology/documentation challenge: define repeatable OT-safe pre-exploitation-to-safe-validation method, tools and techniques; map the method to applicable NIS2/IEC 62443 rules; benchmark CIPHER T4.3 coverage; severity-rate technical gaps; and make actionable next-phase requirements. Negative findings need rationale. High/medium gaps must map to at least one requirement. Any methodology demonstration is in the applicant’s own laboratory; there is no active testing against CIPHER. Preserve the source’s descriptive gap-count KPI as a measured count, not a specified minimum number of gaps. Expected applicant profile: Offensive-security specialist with ICS / OT pentest experience (e.g. GICSP / OSCP-class, documented critical-infrastructure engagements).

Eligible project scope

P1 automates one or more CIPHER-listed technologies, with idempotent version-controlled IaC and/or maintainable Helm, CI/CD, SBOM and artifact scan plus a recorded risk decision for unowned components, and a runbook. The work is delivered by pull request into CIPHER repositories and validated only in a dedicated non-production environment with time-boxed least-privilege credentials, no production access and no committed secrets. Minimum deliverables include unattended clean-environment reproducibility and one portability redeploy; KPI requires successful redeploy across at least two target environments. The applicant retains ownership of delivered automation and grants CIPHER use/deploy/extend/maintain rights; reused generic modules remain applicant-owned under a CIPHER-use licence. For each selected technology, reproducibility means an unattended clean-environment rebuild with a documented one-command bootstrap; a portability KPI requires redeployment to at least two target environments. Re-application must cause no drift and a rollback path must be demonstrated. Work must use the dedicated non-production environment and scoped, time-boxed least-privilege credentials; changes go through pull request and consortium review/merge, with no direct apply to shared infrastructure. Secrets and credentials are stored in the platform secret store and never committed. For findings in components CIPHER does not own, the required action is visibility and a documented risk decision, not upstream remediation. The expected applicant profile is platform/DevSecOps engineering experience with demonstrable IaC (Terraform/OpenTofu, Ansible), Kubernetes/Helm, CI/CD (GitLab CI/GitHub Actions/Argo-class), container and multi-architecture build familiarity; experience with monolithic or poorly packaged apps is a strong plus.

Eligible project scope

R1 must provide and deploy/federate one applicant-owned NIS2-relevant range, with synthetic/emulated assets and no live operator or personal data, domain-realistic readiness scenarios mapped to NIS2 measures, and deployment/extension documentation. It must demonstrate at least one comparable readiness-assessment run; pure CTF/training-only ranges do not meet scope. Unlike the general CIPHER-owns-output rule, the applicant retains the contributed range and pre-existing scenarios and licenses CIPHER to deploy, operate, extend and maintain it for the project and sustainability; CIPHER owns only integration artifacts, evaluation outputs and co-developed domain scenarios. Expected applicant profile: Provider / maintainer of a cyber-range or sector-emulation platform (open-source preferred) with NIS2-relevant domain depth (OT, healthcare, energy, telco, etc.), able to grant deployment and extension rights.

Eligible project scope

T1 requires all three scan views (SBOM/software component, endpoint and network/host) to be run within the isolated CIPHER cyber range using OT-safe profiles. Every scan proof is supplied to WORM storage as native and normalized data plus a hashed JSON manifest, followed through Dependency-Track/DefectDojo, with latency, false-positive, deduplication and friction results and regulatory mapping. On pipeline/platform failure, stored evidence must be replayable and at least one replay demonstrated. KPI modalities include ingestion success %, deduplication accuracy, range-asset coverage across all three views, false-positive rate, pipeline latency and reproducibility %; these are measures, not fixed numerical targets beyond the explicit deliverables. Expected applicant profile: VM / security-engineering profile with hands-on experience operating scanners (OpenVAS / Trivy / Nmap / Nuclei-class) and aggregation platforms (DefectDojo / Dependency-Track-class).

Eligible project scope

T2 requires onboarding agents across agreed host/OS types and integrating the agreed SIEM input set, including at least one OT appliance; exercise agreed agent capabilities and validate data fidelity/connectivity. The Annex says each selected testing entity/use case SHOULD execute and document at least two distinct threat/risk scenarios or analysis cycles, using injected, replayed, synthetic or suitably controlled real-world data as appropriate. Failure recovery must demonstrate agent-side buffering and re-delivery on manager unavailability with no data loss. CIPHER is processor and applicant is controller for applicant telemetry; a DPA is mandatory, collection must be minimized and limited to OC1 validation, and appliance/credential handling stays applicant-side. Minimum sizing is agreed during onboarding; no numeric host/OS quota is stated. Expected applicant profile: SOC / detection-engineering profile with Wazuh (or equivalent XDR) and SIEM-integration experience; controls a representative environment including IDS/IPS and/or OT security appliances.

Eligible project scopeCIPHER Open Call 1

Open Call 1 solicits six named challenges: K1 regulatory capability gap assessment of NIS2 Article21(2)/IEC62443; K2 offensive/OT pentest methodology and T4.3 gap assessment; T1 vulnerability-management pipeline validation across SBOM, endpoint and network/host views; T2 CIPHER XDR onboarding/data collection; R1 sector cyber-range contribution; and P1 DevSecOps/platform automation. Development is deferred to a later CIPHER call. K1 is documentation-only and does not include active testing. T1 active scanning is confined to CIPHER’s cyber range. T2 can include applicant-controlled environments only under its stated scoped, applicant-owned conditions. R1 generic CTF/training-only ranges are out of scope. Challenge-specific annex requirements and outputs govern; applicant proposal must select one challenge.

Call materials name six challenges; no promise of specific selection count per challenge.

Other condition

Annex 2 physical page 4 says OC1 opens five challenges but then enumerates K1, K2, T1, T2, R1 and P1 (six named challenges), including a Platform/Enablement mode for P1. The detailed challenge pages and Guide also describe all six. Retain this source inconsistency without omitting P1 or silently editing the “five” statement.

Other conditionCIPHER Open Call 1

F6S is the single entry point. The mandatory proposal package is the F6S form, Annex 3 technical proposal (12-page maximum for Sections 1–5, excluding cover, summary and Ethics/Security), CIPHER FSTP XLSX budget, and Annex 4 ownership/control declaration QES-signed for every applicant entity except validated public bodies. One application per entity is allowed; only the first application is considered if an entity files multiple applications. This rule concerns distinct applications; a resubmission of the same application is possible before call closure, but is guaranteed only if requested from F6S at least 2 business days before the deadline. All applicants/consortium partners need a 9-digit PIC; valid VAT is required for EU-country entities and mandatory again at contracting. Selected applicants supply legal existence/tax/VAT proof, PIC validation, KYC/ID/residence proof, Declaration of Honour, bank information, and where applicable consortium and SME declarations. Non-autonomous SME applicants may be asked for upstream/downstream balance sheet and profit/loss evidence. The selected beneficiary executes the final, non-alterable tripartite sub-grant agreement by electronic signatures unless otherwise agreed; contracting deadlines are normally within two weeks and failure to complete in time results in rejection. Submission instructions say all documents in all phases must be electronic PDF unless otherwise agreed, while Table 4 specifies Annex 3 as Word and the budget template as XLSX; preserve this format conflict. Applications and programme communication are in English; subcontracting is ineligible. Applicants must agree to the application terms. Required documents should include the project acronym and contain no special characters; unreadable/corrupted naming may cause disqualification, with no resubmission accepted after call closure. Failure to submit by the deadline, including because of network or browser issues, is not an extenuating circumstance. Resubmission before closure is possible, but guaranteed only when requested through F6S support at least two business days before the deadline. The deadline may be extended only for unforeseen F6S platform technical issues, with all applicants notified. A list of applicants containing basic information is created for statistical/transparency purposes and shared with the European Commission. The Annex 1 Guide is binding if it conflicts with information given through other open-call channels.

Some legal/KYC documents are required only in contracting phase; not all are submission-phase attachments.

Other conditionCIPHER Open Call 1

Operative Annex 1 Guide states an application deadline of 6 January 2027 at 17:00 CET/CEST (Brussels time), a single-stage final submission; it also says the deadline is final and calls itself binding over information communicated through other open-call channels. The live official Open Call 1 web page captured in this review instead displays “January 6, 2026 (17:00 CET)”, a date before the call’s displayed 26 October 2026 opening and in conflict with the Guide. Preserve this source conflict and check the official call page for correction; this packet does not silently normalize the webpage date.

Material source conflict: captured website has a deadline year before its own displayed opening date; Guide provides a 2027 date. Live submission acceptance was not tested.

Other conditionCIPHER Open Call 1

The guide lists six challenge codes: K1, K2, T1, T2, R1 and P1. It says CIPHER expects 25 applications in total; target applicant ranges by challenge are K1 1–3, K2 3–5, T1 8–10, T2 8–10, R1 1–2, P1 4–5. These are applicant targets, not an exact number of funded projects, and ranges total 25–35, which does not resolve against the 25 total-expectation statement. No expected grant count is typed.

Material source inconsistency: call-wide expected applications 25 versus challenge target ranges that can sum above 25; not an award-count assertion.

Other condition

All applicants submit the proposal-template ethics self-assessment; potential issues require Helpdesk contact and are checked for consistency, and failure to address ethics/privacy adequately can result in rejection. Applicants must have no actual/potential conflict in selection or implementation; conflicts are assessed case-by-case. Evaluators sign confidentiality commitments before application access. Selected applicants keep project data/documents/invoices/material confidential during implementation and for five years after project completion, extendable by agreement; participant information is confidential only if CIPHER confirms it in writing within 15 days; confidential information is used only for implementation unless agreed otherwise, while application-stage information is treated as confidential. F6S is data controller for its platform; project records are stored in F6S/Google Drive and EVIDEN Teams repository. Consortium data retention runs five years after CIPHER project balance payment, longer through ongoing procedures. EC/OLAF/ECA checks may occur during implementation and up to five years after subproject end; beneficiaries must cooperate, with suspension/reduction/recovery possible. The Guide says no cost-incurrence audit because no cost documentation is required, but technical implementation reviews and required periodic technical/financial reports remain. Beneficiaries must promote project/results and EU funding including on an official third-party website.

Other conditionCIPHER Open Call 1

At least two independent experts review each proposal. The Guide contains an unresolved scoring-scale conflict: physical page 17 says independent experts score 0–10, while physical pages 19 and 30 define each criterion on 0–5; page 19 lists four weighted criteria (30/30/20/20) but states an overall threshold of 10/15. The individual minimum is 3/5. Preserve these statements without calculating a substitute total or treating the /15 denominator as resolved. For committee scoring, individual expert half-points are not given; criterion averages are rounded to nearest point or half-point before weighted overall score is rounded to nearest integer. The management team checks differences strictly over 2 points per criterion, seeks evaluator discussion/consensus, and may invite a third expert only if agreement is not reached. Ranking uses average overall score and the stated 1–4 criterion tie order. The six Annex 2 challenge definitions and thresholds are challenge-specific; all listed KPIs should retain their precise measurement modality and no new funding or hiring quotas are inferred. Appeals are procedural only and must be filed within 3 working days.

Guide lists 4 criteria and thresholds 10/15; this apparent denominator inconsistency is intentionally unresolved.

Other conditionCIPHER Open Call 1

The grant is a milestone-based FSTP lump sum, not cost reimbursement. Sprint 1/M1 triggers 20% (€12,000) following onboarding and an Architecture Definition Report containing architecture, scenario descriptions, target KPIs, data-handling and failure-recovery plan. Sprint 2/M5 triggers 40% (€24,000) on approval of the Mid-term Technical Execution & Integration Report, including initial gap analyses or integration results, preliminary KPI data and monthly technical-sync participation. Sprint 3/M9 triggers 40% (€24,000) on approval of the Final Validation, Regulatory Mapping & Exploitation Report and live Demo Day, including end-to-end validation, minimum two distinct threat/risk cycles or other scoped challenge outputs, recovery proof, KPI results, regulatory traceability and exploitation/sustainability information. Reports are submitted at least one week before review; beneficiary should send the corresponding payment request within five working days after each successful review. Payments are preferably made no later than 30 calendar days after receipt of the financial statement. These are three different clocks and the last is preferential, not a hard guarantee. No financial cost audit is stated, but technical implementation checks, reports, EC/OLAF/ECA review and suspension/recovery powers remain.

Payments are milestone-triggered lump sums; percentage co-funding and entity lifetime ceiling also apply.

Other condition

The nine-month programme has three consecutive sprints: M0–M1 onboarding; M2–M5 execution/integration; M6–M9 validation/refinement. D1 is an onboarding/architecture report with architecture, scenarios, target KPIs, data-handling and failure recovery; D2 reports mid-term technical progress, initial gap/integration results, preliminary KPIs and monthly sync participation; D3 includes full validation/KPIs, recovery proof, regulatory mapping, exploitation and a live Demo Day. At least two phase/sprint reviews occur. Reports are provided at least one week before review; beneficiary should send the payment request within five working days after each successful review. Payment itself is preferably no later than 30 calendar days after receipt of the financial statement. These are separate lead-time/request/payment clocks; preserve “should” and “preferably” modalities.

Other conditionCIPHER Open Call 1

Challenge-specific environment, data and intellectual-property terms apply. K1 is a read-only documentation review using sanitized architecture/toolset material, with no active testing or real client/personal data. K2 is methodology/documentation review; demonstrations, if any, run in the applicant’s own lab, not against CIPHER. T1 active scans are confined to the isolated CIPHER cyber-range, with all three views’ scan evidence sent as native, normalized and hashed-manifest bundles to WORM storage, ingested through Dependency-Track/DefectDojo and with at least one storage replay demonstrated. T2 uses range synthetic data and/or an applicant-controlled representative segment; the applicant remains controller of applicant telemetry, CIPHER is processor, a DPA is mandatory, and agent-side buffering/re-delivery must recover without data loss; appliance/credential handling remains applicant-side. R1 uses synthetic/emulated domain environments, no live operator/personal data; applicant retains ownership of its contributed range and pre-existing scenarios and licenses CIPHER to deploy, operate, extend and maintain it for the project and sustainability; CIPHER owns only integration artifacts, evaluation outputs and co-developed domain scenarios. P1 has the same applicant-retains-ownership posture as R1: applicant retains delivered automation and grants CIPHER use/deploy/extend/maintain rights; reused pre-existing generic modules remain applicant-owned and licensed for CIPHER use. The general Guide rule that CIPHER owns challenge outputs is subject to these specific R1 and P1 Annex 2 exceptions.

Challenge-specific scope is governed by Annex 2; T2 has an express applicant-environment branch.

Partner requirementCIPHER Open Call 1

Eligible applicants are legal entities (including startups/micro-SMEs, SMEs, mid-caps, research organisations and higher-education institutions) established in EU Member States (including OCTs) or EEA countries. A consortium may have at most three independent entities and should provide a technology provider (mandatory), an end-user/technology adopter (mandatory) and optionally a certified cybersecurity auditor/compliance assessor. Certified auditor applications require demonstrable NIS2 compliance experience in critical sectors. The Guide references DIGITAL-ECCC-2024-DEPLOY-CYBER-07 coverage, eligibility and exclusions as taking precedence. Applicant-level entity/country/ownership eligibility was not assessed.

Single legal entity or consortium. Potential precedence/reference to an earlier Digital Europe call needs applicant-level review; not interpreted as broader permission.

Expected project durationCIPHER Open Call 1

9 months

Programme structure described as nine months; Sprint 1 one month, Sprint 2 four months, Sprint 3 four months. Calendar dates and actual grant duration are specified by selected project agreement.

Indicative budget

€4,320,000

Topic budget as stated in the portal's budget table. Lump-sum and per-project limits are in the call conditions.

Funding per beneficiary, maximumCIPHER Open Call 1

€60,000

Aggregate FSTP received by one legal entity across the full CIPHER project, not just this application; applies to an entity whether participating alone or in consortia.

Funding intensity, maximumCIPHER Open Call 1

50 %

Maximum FSTP share of total eligible project costs; applicants must cover the remaining eligible-cost share and comply with cumulative ceiling.

Indirect cost flat rateCIPHER Open Call 1

7 %

Guide also describes this as 7% of personnel and other direct costs; the budget lists travel and equipment separately, without clearly specifying whether these categories fall within “other direct costs”. Apply the official budget-template formula; denominator ambiguity is retained.

Own contribution, minimumCIPHER Open Call 1

50 %

Minimum non-grant share is 50% of total eligible project costs when drawing the full maximum 50% grant rate; denominator is total eligible project cost, not grant amount.

Project funding, maximumCIPHER Open Call 1

€60,000

Per selected sub-grant project; subject also to the 50% maximum co-funding rate, the EUR60,000 cumulative per-entity lifetime ceiling and approved eligible costs.

• For an application to K1, the core team is to include a certified auditor with documented NIS2 Annex I/II critical-sector or OT experience. This is a challenge-specific qualification requirement, not a salary amount, grant-funded position, or universal requirement for other challenges.

  Technical staff · Required staff

• CIPHER Open Call 1 — Annex 1 Guide for Applicants (November 2026)

  cipher-eu.com

• CIPHER Open Call Procedure for Ownership and Control Eligibility Assessment (November 2026)

  cipher-eu.com

• CIPHER official Open Call 1 page

  cipher-eu.com

• CIPHER Open Call 1 — Annex 4 Ownership Control Declaration (November 2026)

  cipher-eu.com

• CIPHER Open Call 1 — Annex 2 Technical Requirements (November 2026)

  cipher-eu.com

Opens

26 Oct 2026

Deadline model

Single-stage

Programme

Digital Europe · 2021 - 2027

Call

CIPHER Open Call 1

Types of action

—

Source

ec.europa.eu

Checked

24 Oct 2026

Portal updated

22 Oct 2026

Review status

Partial review

Reviewed

23 Oct 2026