Topic updates

14 November 2025
Submissions to call HORIZON-CL3-2025-02-CS-ECCC

The call HORIZON-CL3-2025-02-CS-ECCC closed on 12 November 2025.

A total of 265 proposals has been submitted under this call, distributed per topics as follows:

HORIZON-CL3-2025-02-CS-ECCC-02 - New advanced tools and processes for Operational Cybersecurity: 65 proposals

The evaluation of these proposals will be organized in Q1-2026.

27 June 2025
Updates regarding the call HORIZON-CL3-2025-02-CS-ECCC Annexes

As mentioned in the Work Programme document under the call HORIZON-CL3-2025-02-CS-ECCC topics Eligibility conditions, in order to achieve the expected outcomes, and safeguard the Union’s strategic assets, interests, autonomy, and security, participation in this topic is limited to legal entities established in specific countries.

Furthermore, in order to guarantee the protection of the strategic interests of the Union and its Member States, entities established in an eligible country as described in the Topic Eligibility conditions, but which are directly or indirectly controlled by a non-eligible country or by a non-eligible country entity, shall not participate in the action.

In this context the applicants are requested to fill in the Annex - Ownership Control Declaration.

This request applies to all the HORIZON-CL3-2025-02-ECCC topics excepting the topic HORIZON-CL3-2025-02-ECCC-03.

New advanced tools and processes for Operational Cybersecurity

TOPIC ID: HORIZON-CL3-2025-02-CS-ECCC-02

Type of grant: Call for proposals

General information

Programme:

Call: Indirectly Managed Action by the ECCC (HORIZON-CL3-2025-01-IM-01)

Type of action: HORIZON-IA HORIZON Innovation Actions

Type of MGA: HORIZON Lump Sum Grant [HORIZON-AG-LS]

Status: Forthcoming

Deadline model: single-stage

Planned Opening Date: 12 June 2025

Deadline dates: 12 November 2025 17:00 (Brussels time)

Topic description

Expected Outcome:

Expected Impact: Action launched by the ECCC to incorporate ‘expected impact’ language set out in the ‘Destination – Increased Cybersecurity’ section of this work programme part.

Expected Outcome: The use of and dependence on information and communication technologies have become fundamental aspects in all sectors of the economy. Public administrations, companies and citizens are more interconnected and interdependent across sectors and borders than ever before. This higher uptake of digital technologies increases exposure to cyber security incidents, vulnerabilities and their potential impacts. At the same time, Member States are facing growing cybersecurity risks and an overall complex threat landscape, with a clear risk of rapid spill-over of cyber incidents from one Member State to others.

Moreover, cyber operations are increasingly integrated in hybrid and warfare strategies, with significant effects on the target. In particular, the current geopolitical context is being accompanied by a strategy of hostile cyber operations, which is a game changer for the perception and assessment of the EU’s collective cybersecurity crisis management preparedness and a call for urgent action. The threat of a possible large-scale incident causing significant disruption and damage to critical infrastructure and data spaces demands heightened preparedness at all levels of the EU’s cybersecurity ecosystem. In recent years, the number of cyberattacks has increased dramatically, including supply chain attacks aiming at cyberespionage, ransomware, or disruption. The vulnerability landscape is also threatening. The ENISA Threat Landscape Report 2024^[1] counts a total of 19,754 vulnerabilities. This amount of vulnerabilities can’t be manually managed by humans. There is a need for automated management of vulnerabilities based on established standards like the Common Security Advisory Framework (CSAF)^[2].

As regards detection of cyber threats and incidents, there is an urgent need to increase the exchange of information and improve our collective capabilities in order to reduce drastically the time needed to detect cyber threats and mitigate, before they can cause large-scale damage and costs. While many cybersecurity threats and incidents have a potential cross-border dimension, due to the interconnection of digital infrastructures, the sharing of relevant information among Member States remains limited. Proposals are expected to address this emerging threat landscape with the development of advanced frameworks, services tools, and processes, in line with relevant EU legislation (NIS2, Cyber Resilience Act, Cyber Solidarity Act).

Lastly, focus should be given to developing innovative frameworks, technologies, tools, processes, and services that reinforce cybersecurity capabilities for operational and technical cybersecurity cooperation, in line with relevant EU policy, with particular focus on NIS2, Cyber Solidarity Act and the EU Cybersecurity Strategy, as well as legal and ethical requirements.

Proposals should address at least two of the following expected outcomes:

• Enhanced Situational Awareness through advanced Cyber Threat Intelligence frameworks, tools, and services as well as cybersecurity risk assessments of critical supply chains made in the EU,
• Frameworks, tools, and services for preparedness against Cyber and Hybrid Threats in information and communication technology (ICT) and operational technology (OT), including cybersecurity exercises,
• Expanded Security Operations Centre/Computer Security Incident Response Teams (SOC/CSIRT) functionality through advanced tools and services for detection, analysis, incident handling including response and reporting as well as remediation,
• Development of testing and experimentation facilities for advanced tools and processes for operational cybersecurity, including the creation of digital twins for critical infrastructures and essential and important entities as defined in NIS2,
• Development and pilot implementation of cross-sector and/or cross-border cyber crisis management frameworks, services, and tools,
• Frameworks, services, and tools aimed at mechanisms and processes for enhanced operational cooperation between public sector entities (CSIRT network, EU-CyCLONe). Extension of the above to essential and important entities as defined in NIS2^[3], would be an advantage.

Scope:

Proposals are expected to demonstrate the developed frameworks, tools, services, and processes through pilot implementations involving the participation of relevant national cybersecurity authorities and/or essential and important entities as defined in NIS2, implemented with the participation of leading European cybersecurity industry. Proposals should consider the impact of forthcoming legislation, in particular the Cyber Resilience Act.

Real world applications and the usability of the solutions developed should feature predominately in the proposals.

The participation of the following types of entities is highly encouraged: innovative European cybersecurity start-ups and SMEs with a proven track-record in cybersecurity innovation at EU level (e.g. active participation in successful EU funded projects including cybersecurity projects under Horizon Europe, Digital Europe Programme cybersecurity projects or EIC Pathfinder or Accelerator projects), European start-ups and SMEs that can demonstrate established operational cooperation with relevant National Cybersecurity Authorities, European start-ups and SMEs that have received equity investments by national, European or private Venture Capital funds for cybersecurity activities etc. The participation of these start-ups and SMEs with an active role in the implementation of the proposed action (project coordination, technical coordination, lead of pilot implementation etc) would be considered an asset.

[1] The ENISA Threat Landscape Report 2024: ENISA Threat Landscape Report 2024: https://www.enisa.europa.eu/publications/enisa-threat-landscape-2024

[2] Common Security Advisory Framework (CSAF): https://csaf.io/

[3] Directive on measures for a high common level of cybersecurity across the Union: https://eur-lex.europa.eu/eli/dir/2022/2555

Start submission

The submission system is planned to be opened on the date stated on the topic header.

Get support

Please read carefully all provisions below before the preparation of your application.

Online Manual is your guide on the procedures from proposal submission to managing your grant.

Horizon Europe Programme Guide contains the detailed guidance to the structure, budget and political priorities of Horizon Europe.

Funding & Tenders Portal FAQ – find the answers to most frequently asked questions on submission of proposals, evaluation and grant management.

Research Enquiry Service – ask questions about any aspect of European research in general and the EU Research Framework Programmes in particular.

National Contact Points (NCPs) – get guidance, practical information and assistance on participation in Horizon Europe. There are also NCPs in many non-EU and non-associated countries (‘third-countries’).

Enterprise Europe Network – contact your EEN national contact for advice to businesses with special focus on SMEs. The support includes guidance on the EU research funding.

IT Helpdesk – contact the Funding & Tenders Portal IT helpdesk for questions such as forgotten passwords, access rights and roles, technical aspects of submission of proposals, etc.

European IPR Helpdesk assists you on intellectual property issues.

CEN-CENELEC Research Helpdesk and ETSI Research Helpdesk – the European Standards Organisations advise you how to tackle standardisation in your project proposal.

The European Charter for Researchers and the Code of Conduct for their recruitment – consult the general principles and requirements specifying the roles, responsibilities and entitlements of researchers, employers and funders of researchers.

Partner Search help you find a partner organisation for your proposal.