EU Funding for CRA Compliance:Up to €30,000 for SMEs

The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, introduces cybersecurity requirements for products with digital elements placed on the European Union market.

For many small and medium-sized enterprises (SMEs), preparing for these requirements involves more than reviewing regulatory documentation. It may require technical security assessments, vulnerability management processes, product architecture improvements, and investments in cybersecurity expertise.

These activities can create significant financial and operational challenges, particularly for smaller manufacturers with limited internal security resources.

The European Union’s SECURE programme offers an opportunity to reduce part of this financial burden by providing up to €30,000 in co-funding for eligible CRA-related cybersecurity projects. Through its second open call, the programme makes €11.5 million available to support European SMEs in strengthening product security and progressing towards CRA compliance.

Understanding the funding conditions, eligible activities, and application requirements can help organisations turn regulatory preparation into a structured cybersecurity improvement project.

1. What Is the SECURE Funding Programme?

SECURE (Strengthening EU SMEs Cyber Resilience) is an EU-funded initiative established under the Digital Europe Programme to support micro, small, and medium-sized enterprises in addressing the cybersecurity requirements of the Cyber Resilience Act.

The programme provides financial support through competitive open calls, enabling eligible businesses to propose and implement cybersecurity improvement projects. Rather than providing a general-purpose business grant, SECURE focuses on practical activities that contribute to CRA readiness and stronger cybersecurity capabilities.

The second SECURE Open Call provides:

• Total funding allocation: €11.5 million
• Maximum EU contribution: €30,000 per approved project
• Co-financing rate: 50% of eligible project costs
• Application period: 1 October to 11 December 2026
• Target beneficiaries: Eligible micro, small, and medium-sized enterprises

The funding is competitive and subject to application assessment, eligibility conditions, and the programme’s official guidelines. Importantly, the €30,000 represents the maximum available contribution, not an automatic payment or a guarantee of funding. For example, a project with €60,000 in eligible costs could potentially receive €30,000 in EU funding, with the remaining €30,000 financed by the applicant, subject to the applicable budget rules.

2. Which Companies Can Apply?

The SECURE programme targets European SMEs whose activities fall within the scope of the Cyber Resilience Act and the funding call.

Depending on their role and the products concerned, potentially relevant businesses may include:

• Connected device manufacturers: Companies developing IoT devices, smart appliances, connected industrial equipment, or other products with digital elements
• Embedded software developers: Businesses creating firmware or software integrated into connected products
• Digital product manufacturers: Companies developing software products or digital solutions within the CRA’s scope
• Importers and distributors: SMEs with relevant responsibilities in the supply chain for products with digital elements
• Technology suppliers: Eligible businesses seeking to improve cybersecurity practices associated with their own in-scope products

Applicants must satisfy the geographical, organisational, ownership, and activity-related eligibility conditions established in the official SECURE call documentation. Under the EU SME framework, SMEs generally have fewer than 250 employees and annual turnover not exceeding €50 million and/or an annual balance sheet total not exceeding €43 million.

However, eligibility is not determined by employee numbers alone. Partner and linked enterprises may need to be considered when calculating company size. Being an SME does not automatically establish funding eligibility. Applicants should verify their status, the relevance of their products, and the proposed activities against the official call guidelines before submitting an application.

3. Which CRA Compliance Activities Can Be Supported?

CRA readiness involves multiple technical and organisational disciplines. Depending on the project’s objectives and the programme’s eligible expenditure rules, funding may support activities such as the following.

CRA Gap Analysis and Cybersecurity Risk Assessment

An effective compliance programme begins by understanding how existing products and development practices compare with applicable CRA requirements. Relevant activities may include:

• Defining the scope of products with digital elements (PwDE)
• Identifying applicable cybersecurity obligations
• Reviewing product architecture and security controls
• Conducting cybersecurity risk assessments and threat modelling
• Identifying compliance gaps and prioritising remediation activities
• Developing a documented CRA readiness roadmap

A structured gap analysis helps organisations focus resources on measurable cybersecurity improvements rather than isolated compliance activities.

Penetration Testing and Vulnerability Assessment

Technical testing is an important part of identifying security weaknesses before products are placed on the market and throughout their support lifecycle. Depending on the product architecture, testing may cover:

• Embedded firmware and connected hardware
• Mobile applications interacting with connected products
• Cloud services, backend systems, and APIs
• Authentication and access control mechanisms
• Communication protocols and update mechanisms
• Third-party software components and dependencies

These assessments can provide technical evidence to support risk-based remediation and product security improvements.

Secure-by-Design Development

The CRA places significant emphasis on cybersecurity throughout product design, development, and maintenance. Eligible project activities may therefore involve improvements to:

• Secure software development practices
• Product security architecture
• Cryptographic controls and key management
• Secure boot and firmware integrity
• Software and firmware update mechanisms
• Security testing within development pipelines
• Protection against unauthorised access and exploitation

Integrating security earlier in the development lifecycle can reduce remediation costs and improve long-term product resilience.

Vulnerability Handling and Incident Response

CRA compliance also requires manufacturers to establish appropriate processes for identifying, handling, and addressing vulnerabilities. Potential improvement activities include:

• Establishing coordinated vulnerability disclosure procedures
• Implementing vulnerability intake and triage workflows
• Defining remediation and escalation responsibilities
• Preparing incident response procedures
• Improving vulnerability tracking and reporting capabilities
• Developing operational readiness for applicable CRA reporting obligations

The CRA’s mandatory reporting requirements for actively exploited vulnerabilities and severe incidents affecting product security began applying on 11 September 2026. Funding-supported improvements in this area can therefore address an existing operational requirement, rather than only preparing for future obligations.

Software Supply Chain Security

Modern connected products frequently depend on third-party software libraries, open-source components, external development partners, and cloud services. Cybersecurity improvement projects may include establishing Software Bill of Materials (SBOM) processes, identifying and assessing third-party dependencies, reviewing supplier cybersecurity practices, monitoring known vulnerabilities in software components, improving dependency and patch management, and defining security requirements for external suppliers.

These activities can help manufacturers maintain visibility into cybersecurity risks across their wider product ecosystem. The eligibility of specific tools, services, equipment, or subcontracted activities must be verified against the SECURE programme’s official eligible activities and budget guidelines.

4. How Does the 50% Co-Financing Model Work?

SECURE operates through a co-financing model rather than covering the entire cost of a cybersecurity project. Under the published funding structure, the EU contribution can cover up to 50% of eligible costs, subject to a maximum grant of €30,000.

Eligible Project Costs	Potential EU Contribution	Applicant Contribution
€20,000	€10,000	€10,000
€40,000	€20,000	€20,000
€60,000	€30,000	€30,000
€80,000	€30,000	€50,000

These figures are illustrative and assume that all stated project costs qualify as eligible expenditure. Actual funding depends on the approved project budget, applicable financial rules, and grant agreement. SMEs should carefully assess their available budget, internal resources, and implementation capacity before applying.

5. How Can SMEs Structure a Strong CRA Funding Proposal?

A successful funding proposal should clearly explain the cybersecurity challenges being addressed, the activities required, and the expected outcomes. The SECURE programme evaluates proposals against criteria covering excellence and relevance, impact and clarity, and implementation.

Work Package 1: Product Scope and CRA Gap Assessment

Identify the relevant products, technical architecture, existing cybersecurity controls, and gaps against applicable CRA requirements.

Expected outcome: A documented cybersecurity gap assessment and prioritised remediation roadmap.

Work Package 2: Technical Security Assessment

Conduct targeted vulnerability assessments, penetration testing, or architecture reviews based on the identified risks.

Expected outcome: Technical findings, risk classifications, and documented recommendations.

Work Package 3: Security Improvements and Remediation

Implement selected technical or organisational improvements, such as strengthening authentication, improving firmware security, or establishing vulnerability management procedures.

Expected outcome: Documented corrective actions and measurable security improvements.

Work Package 4: Validation and CRA Readiness Evidence

Verify implemented changes, review remaining risks, and organise relevant technical evidence.

Expected outcome: Security validation results, updated risk documentation, and a clearer path towards CRA conformity.

Projects should establish measurable indicators, including the number of products or components assessed, cybersecurity gaps addressed, completed testing activities, implemented vulnerability handling procedures, verified security improvements, and delivered technical documentation. Applicants should adapt work packages, budgets, and deliverables to the official SECURE application requirements.

6. Can SMEs Work with External Cybersecurity Experts?

Not every SME has the internal expertise required to conduct specialised penetration testing, embedded security assessments, or CRA-related cybersecurity risk analysis.

The SECURE funding framework allows for external expertise and subcontracted activities, subject to the programme’s eligibility, procurement, and budget conditions. This creates an opportunity for applicants to combine internal product knowledge with specialist cybersecurity capabilities.

For example, an eligible manufacturer could develop a project involving internal product architecture and compliance scoping, independent embedded device penetration testing, mobile application and API security assessment, support for vulnerability management process development, and technical validation of implemented security improvements.

External specialists can contribute to clearly defined technical work packages while the applicant retains responsibility for its proposal, project management, and applicable CRA obligations. Proposed subcontracting arrangements and associated costs should be reviewed against the official call documentation.

7. Why Should SMEs Act Before the Application Deadline?

The second SECURE Open Call closes on 11 December 2026. The available preparation period should be used to establish a realistic project scope and identify the cybersecurity activities that would deliver the greatest benefit.

The CRA’s vulnerability reporting obligations have applied since 11 September 2026, while the regulation’s main product cybersecurity requirements generally become applicable on 11 December 2027. Manufacturers should distinguish between immediate operational obligations and the broader technical requirements for products placed on the EU market.

A practical preparation approach includes:

• Identify relevant products: Determine which products and associated digital components may fall within CRA scope.
• Assess existing cybersecurity capabilities: Review security testing, risk management, vulnerability handling, and development practices.
• Define a focused improvement project: Select activities with clear deliverables and measurable results.
• Establish the project budget: Calculate eligible expenditure and the required applicant contribution.
• Prepare the application: Review the SECURE guidelines, complete the required documentation, and submit through the official platform before the deadline.

8. How to Apply for SECURE Funding

Applications for the second SECURE Open Call are managed through the programme’s official application platform. Interested SMEs should review the official call; confirm company size, geographical eligibility, ownership conditions, and proposed-project relevance; establish objectives, technical work packages, expected outcomes, and implementation responsibilities; identify eligible costs and co-financing; then complete the required forms and submit the proposal through the SECURE platform.

Application deadline: 11 December 2026.

Official programme information and application documents are available at SECURE – Second Open Call. Applicants should rely on the latest official guidelines for definitive eligibility, submission, and funding conditions.

How CyberWhiz Can Help

At CyberWhiz, we help manufacturers translate Cyber Resilience Act requirements into practical cybersecurity improvements across connected products, embedded systems, mobile applications, cloud services, and third-party components.

For SMEs considering the SECURE funding opportunity, our cybersecurity specialists can support the technical assessment and implementation activities that may form part of an eligible CRA readiness project.

Our Purple Team, Red Team, and Blue Team capabilities cover:

• CRA Gap Analysis and Risk Assessment: Identifying applicable cybersecurity requirements, assessing product security maturity, and developing risk-based improvement roadmaps.
• Embedded and IoT Security Testing: Evaluating firmware, device interfaces, communication protocols, and embedded security controls.
• Mobile Application and API Security: Identifying vulnerabilities in connected mobile applications, backend services, and product-related APIs.
• Penetration Testing and Security Validation: Conducting targeted assessments and validating the effectiveness of cybersecurity improvements.
• Software Supply Chain Security: Supporting SBOM processes, third-party component visibility, and vulnerability risk assessment.
• Vulnerability Management and Disclosure: Establishing structured processes for vulnerability intake, triage, remediation tracking, and coordinated disclosure.
• CRA Technical Documentation Support: Organising relevant cybersecurity evidence and assessment outputs to support manufacturers’ compliance activities.

Our CyberWhiz VDP Manager also supports manufacturers in managing vulnerability disclosure and handling workflows throughout the product lifecycle. Where permitted by the programme rules, CyberWhiz can contribute specialist technical expertise to defined cybersecurity work packages.

Funding applications, eligibility assessments, and grant decisions remain subject to the SECURE programme’s official requirements and evaluation process. EU funding can help reduce the cost of CRA preparation. The lasting value comes from building stronger, demonstrable cybersecurity capabilities into your products.

Contact our team at [email protected] to discuss your CRA readiness priorities, technical security assessment needs, and potential cybersecurity project scope.

Regulatory and Programme References

• Regulation (EU) 2024/2847 — Cyber Resilience Act
• Commission Recommendation 2003/361/EC — Definition of micro, small, and medium-sized enterprises
• SECURE — Strengthening EU SMEs Cyber Resilience, Grant Agreement No. 101190325
• SECURE Second Open Call — Official Programme Information

Disclaimer: This article provides general information about the Cyber Resilience Act and the SECURE funding opportunity as of October 2026. It does not constitute legal, financial, or grant application advice. Funding availability, eligibility, eligible expenditure, and application conditions are governed by the official SECURE programme documentation. CyberWhiz is not the funding authority and does not guarantee application approval or grant awards.