Cyber Resilience Act: all tools and articles
EU funding · SECURE, Open Call 2
The EU pays half of a CRA compliance project, up to €30,000
SECURE's second open call co-funds the Cyber Resilience Act work of micro, small and medium-sized enterprises. Applications close on 11 December 2026.
- Who
- Micro, small and medium-sized enterprises established in an EU member state or EEA country and controlled from one. Your country's National Coordination Centre checks eligibility.
- How much
- 50% of eligible costs as a lump sum, up to €30,000 per grant. A project above €60,000 is still capped at €30,000.
- For what
- Work towards the CRA's requirements, done by your own staff or by external providers as subcontracting, in a project of up to 180 days.
- When
- Applications from 1 October 2026 to 11 December 2026. The call's total budget is €11.5M.
What the call funds, in its own words
| # | Fundable work, ANNEX 1 section 1.2 |
|---|---|
| 1 | compliance activities and audits |
| 2 | support for the conformity assessment procedure |
| 3 | policy definition |
| 4 | vulnerability assessment and pentesting |
| 5 | internal procedures |
| 6 | incident detection, management and notification processes |
| 7 | risk assessments |
| 8 | supply-chain security |
| 9 | product maintenance and update plans |
| 10 | training |
| 11 | procurement of goods and professional services instrumental to the CRA's requirements |
Read from the call page and ANNEX 1 (Open Calls Application Guidelines, Call 2) on 4 October 2026. The call's documents decide eligibility and costs; this page summarises them, and StandardOS has no part in the call. Read the call on secure4sme.eu
Questions
- Who can apply to SECURE's second call?
- Micro, small and medium-sized enterprises established in an EU member state or EEA country and controlled from one. The National Coordination Centre of the applicant's country checks eligibility.
- How much does a grant pay?
- 50% of eligible costs, paid as a lump sum, up to €30,000 per grant. A project costing more than €60,000 is still capped at €30,000.
- Can the grant pay for work by an outside provider?
- The call funds work done by the company's own staff or by external providers as subcontracting, and the procurement of goods and professional services instrumental to the CRA's requirements. Whether a particular cost qualifies is decided under the call's rules.
- When does the call close?
- Applications are open from 1 October 2026 to 11 December 2026. A funded project runs for up to 180 days.