---
title: "Approved supplier for the cloud voucher: how to check"
description: "The cloud and cybersecurity voucher supplier list: who can be on it, how to consult it, codes, resellers and the questions to ask a supplier."
canonical: https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-approved-supplier-check/
url: /en/cms/insights/cloud-cybersecurity-voucher-approved-supplier-check/
lang: en
---

![](https://www.aegister.com/static/images/header-contact.webp)

# Cloud and cybersecurity voucher: how to check the approved supplier

The cloud and cybersecurity voucher funds only purchases from approved suppliers. Who can be one, how the list is consulted, what codes and types tell you, resellers, integrators and linked suppliers, and the questions to ask a supplier before signing the application.

October 16, 2026
12 min read

![Small business owner preparing a funding application](https://www.aegister.com/static/images/cms/theme-sme-funding.webp)
Made with AI

cloud and cybersecurity vouchercloud cybersecurity voucher supplier listhow to check a voucher supplierlinked supplier voucher

Contents

1. [In brief](#in-brief)
2. [Who is an approved supplier](#who-is-an-approved-supplier)
3. [How the list is consulted](#how-the-list-is-consulted)
4. [The identification code and the types](#the-identification-code-and-the-types)
5. [Resellers, integrators and the MSP model](#resellers-integrators-and-the-msp-model)
6. [Linked suppliers and business networks](#linked-suppliers-and-business-networks)
7. [Questions to ask the supplier before signing](#questions-to-ask-the-supplier-before-signing)
8. [References](#references)

The [cloud and cybersecurity voucher](https://www.aegister.com/en/voucher-cloud-cybersecurity/) funds only products and services bought from an approved supplier (*soggetto abilitato*), that is a supplier on the list kept by the Ministry of Enterprises and Made in Italy, and only for the products and services admitted on that list. This guide describes what you can check from the buyer's side: who can be an approved supplier, how the list is consulted, what codes and types tell you, which cases need attention and which questions to put to the supplier.

## In brief

- Only products and services supplied by parties on the list, under the identification codes the list assigns, are eligible; during the assessment the Ministry checks suppliers, codes and their match with the spending plan.
- A supplier becomes approved with services qualified by ACN at level QC1 or higher, or with the certifications required for the category; it may be based outside Italy.
- The list is consulted on a portal linked from the Ministry's website, with digital identity access, and it cannot be changed.
- The types associated with a supplier depend on its certifications, not on what it sells: ask what it actually offers under each code.
- Whoever signs the contract with you and invoices you must be on the list; a mere commercial intermediary need not be.
- A supplier linked to your company or in the same network contract is allowed only if it is a distinct legal entity and on the conditions set out in the official FAQ.

## Who is an approved supplier

To implement article 5, paragraph 2, of the ministerial decree of 18 July 2025, the directorial decree of 21 November 2025 set up the list of parties approved to supply the eligible products and services. Registration enables the supplier to deliver them and gives the products and services the status required for eligibility (article 4, paragraph 1). The list was defined by the directorial decree of 29 July 2026.

The spending plan must provide for products and services supplied by parties on the list (directorial decree of 4 August 2026, article 4, paragraph 2). The application states the identification codes of the chosen products and services and the names of the suppliers, which must be on the list (article 5, paragraph 3, letters e) and f)). During the assessment the Ministry checks that the suppliers and the products and services are on the list and that they match the spending plan (article 6, paragraph 1, letters c) and d)).

Two kinds of supplier can be approved (official MIMIT FAQ, section 1, no. 1):

- suppliers with services qualified by the National Cybersecurity Agency (ACN) at level QC1 or higher, in the catalogue of digital infrastructure and cloud services;
- alternatively, suppliers that prove they hold the certifications listed in Annex 1 to the directorial decree of 21 November 2025 for the category of the products and services they offer.

The QC1 qualification is therefore not mandatory. The same supplier may offer qualified services and services without the qualification, but for the latter it must prove it holds the Annex 1 certifications (official MIMIT FAQ, section 1, no. 2).

| Macro-category | Certifications required (Annex 1) |
| --- | --- |
| A) Soluzioni hardware cybersecurity (hardware cybersecurity solutions) | ISO 9001 and ISO/IEC 27001 |
| B) Soluzioni software cybersecurity (software cybersecurity solutions) | ISO 9001 and ISO/IEC 27001 |
| C) Servizi cloud infrastrutturali e di piattaforma (IaaS e PaaS) (infrastructure and platform cloud services) | ISO 9001 and ISO/IEC 27001 with the ISO/IEC 27017 extension, or ISO 9001 and CSA STAR Level 2 |
| D) Servizi Cloud SaaS (SaaS cloud services) | ISO 9001 and ISO/IEC 27001 with the ISO/IEC 27017 extension, or ISO 9001 and CSA STAR Level 2 |
| E) Servizi professionali di configurazione, monitoraggio e supporto continuativo (professional configuration, monitoring and ongoing support services) | ISO 9001 and ISO/IEC 27001 |

The category names are the decree's Italian wording; the English in brackets is our translation.

The certifications are cumulative requirements: each category needs all those listed (official MIMIT FAQ, section 1, no. 33). They concern the supplier and need not necessarily cover the individual product or service in their scope (no. 11). They had to be valid on the date of the registration request, with no provisional admission (no. 12).

An approved supplier need not be based in Italy. It may be an EU or non-EU entity, provided its certifications are issued by a body accredited by a national accreditation body of a Member State, or by one that has a mutual recognition agreement with the Italian body (official MIMIT FAQ, section 1, no. 10). No. 29 accepts certifications issued by bodies accredited by members of EA, IAF and ILAC.

*Ministerial decree of 18 July 2025, article 5, paragraph 2; directorial decree of 21 November 2025, article 4 and Annex 1; directorial decree of 4 August 2026, articles 4, 5 and 6; official MIMIT FAQ, section 1, nos. 1, 2, 10, 11, 12, 29 and 33.*

## How the list is consulted

The list can be consulted on the platform reached from the measure's section of the Ministry's website, by those who intend to apply and log in with the identification systems provided. The directorial decree of 29 July 2026 describes it as unmodifiable and valid only for the purposes of this measure (sole article, paragraphs 2 and 3). Registration requests closed at 12:00 on 27 May 2026.

The portal is at [vcc-elencofornitori.npi.invitalia.it](https://vcc-elencofornitori.npi.invitalia.it/). When we consulted it, access required SPID or CIE.

For each supplier the list shows the categories and types for which it is admitted, with the related identification codes in the last column (official MIMIT FAQ, section 1, no. 41). Price is not part of the registration: the supplier portal did not ask for it (no. 30). The cost items are in the offer.

Before attaching an offer, it is worth finding on the list the supplier, with its identifier, and each identification code the offer states. If a service is supplied by another accredited party, the code and the name are those of the original supplier, and that is the supplier to check (official MIMIT FAQ, section 2, no. 28).

## The identification code and the types

The identification code joins the supplier's identifier and the type: in the official FAQ example, VCCFA2600009999-C1 indicates type C.1 Virtual machine (official MIMIT FAQ, section 1, no. 41). Where it must be entered is explained in the [supplier offer guide](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-supplier-offer/) and in the [spending plan guide](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-spending-plan/).

The types associated with a supplier do not say what it sells. In the official MIMIT FAQ (section 1, no. 41) a supplier asks why it is associated with categories it had not requested; the answer is that the association is correct, because the admitted types are those enabled by the Annex 1 certifications or by the ACN qualification. In no. 42 a supplier that had stated a single category E service is accredited for categories A and B as well. No. 41 adds that a supplier may leave unused the codes assigned to it that are of no interest to it.

For the same reason the list does not describe the supplier's catalogue. The offer is not limited to the products stated at registration and may include other products and services, its own or other suppliers', provided they fall within a type for which the supplier is accredited (official MIMIT FAQ, section 1, no. 46). A code on the list shows that the supplier may offer that type, not that it does.

So ask which products or services the supplier actually offers under each code you will enter in the application: according to the official MIMIT FAQ (section 1, no. 41) the codes are stated according to the services the beneficiary actually requests. Check too that the type matches what you are buying, because during the assessment the Ministry checks the match between the products and services on the list and the spending plan (directorial decree of 4 August 2026, article 6, paragraph 1, letter d)).

## Resellers, integrators and the MSP model

Whoever sells and invoices you a product must be an approved supplier, even when the product is made by another manufacturer. The reseller had to register by stating at least one product or service of its own, for example category E services, while the vendor's products are registered by the vendor itself. A system integrator that configures third-party products or services had to register for category E (official MIMIT FAQ, section 1, nos. 7 and 8).

A commercial partner acting as an intermediary need not be on the list when the contract is concluded directly between you and the approved supplier, the invoice is issued only by the latter, and the partner has no contractual or invoicing relationship with you (official MIMIT FAQ, section 1, no. 9). Conversely, if the offer, and therefore the invoice, lists and prices the services of a third party, for example a hosting company or a cloud provider, that third party must be on the list too (no. 24).

The other cases are described in the [eligible costs guide](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-eligible-costs/); the rule is enough here:

- an approved supplier may offer products of vendors that are not on the list, even on their own, if they fall within a type for which it is accredited (official MIMIT FAQ, section 1, nos. 16, 17 and 44); the offer and the application then carry its own code, even when the vendor is itself on the list (no. 50);
- it may include in the offer services for which it is not accredited, if another party accredited for that type supplies them: the offer and the application state the original supplier's code and name, while invoicing and delivery remain with the supplier presenting the offer (section 2, no. 28);
- licences sold under the MSP model can be considered compatible with category D if the partner that resells and invoices them is accredited on the list, the type is registered on the list for the supplier or the vendor, and the service is delivered as SaaS (section 1, no. 43).

## Linked suppliers and business networks

Buying from a supplier linked to the beneficiary or belonging to the same corporate group is not automatically excluded, provided the beneficiary and the supplier are distinct legal entities, the transaction is genuine and economically justified, and all the conditions of the measure are met (official MIMIT FAQ, section 2, no. 26).

Belonging to the same network contract (*rete-contratto*) without legal personality and without a common fund does not by itself make the investment ineligible either. The beneficiary and the supplier must still be legally distinct and autonomous, and the contractual relationship must be effective, traceable and compliant with the rules of the measure. The Administration reserves the right to check during the assessment that the parties involved are actually autonomous (official MIMIT FAQ, section 2, no. 27).

A party on the list may itself apply, if it meets the eligibility requirements, provided it buys from another supplier on the list (directorial decree of 4 August 2026, article 3, paragraph 3; official MIMIT FAQ, section 1, no. 6). The requirements are described in the [requirements and de minimis guide](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-requirements-de-minimis/).

## Questions to ask the supplier before signing

These questions are for before the application, to which the offer is attached, is digitally signed. Contracts, orders and payments come after submission, as the [offer guide](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-supplier-offer/) explains.

1. **Under what name and identifier does it appear on the list?** With these details you can find it on the portal.
2. **Under which identification code does it offer each product or service, and which type does the code indicate?** The type must match what you are buying.
3. **What does it actually supply under each code?** The types on the list depend on certifications, not on the catalogue (official MIMIT FAQ, section 1, nos. 41 and 42).
4. **Is the product its own, a vendor's that is not on the list, or another approved supplier's?** In the last case the application carries the original supplier's code and name (section 2, no. 28).
5. **Who signs the contract and who issues the invoice?** It must be an approved supplier; an intermediary that neither contracts nor invoices is not one (section 1, no. 9).
6. **Does the offer price third-party services, such as hosting or cloud?** If so, the third party must be on the list too (section 1, no. 24).
7. **For a subscription, will the same supplier deliver the service for its whole term?** A change of the subscription's supplier interrupts the benefit and forfeits the residual contribution, unless it results from corporate transactions involving the supplier (directorial decree of 4 August 2026, article 8, paragraph 2). Variations are described in the [disbursement and variations guide](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-reporting-disbursement/).
8. **Will the offer contain all the information in the Ministry's template and be signed by the supplier?** The content is described section by section in the [supplier offer guide](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-supplier-offer/) (section 2, no. 35).

Aegister S.p.A. is an approved supplier: you will find it on the list under the identifier VCCFA2600000933 (directorial decree of 29 July 2026), and the codes of our services are on the [page about the measure](https://www.aegister.com/en/voucher-cloud-cybersecurity/#servizi-aegister). The [Cyber Check-up](https://www.aegister.com/en/assessment/?source=voucher) describes your situation and identifies the priorities; at the end you can book a meeting with us, in which we define the services and prepare the offer in the format the measure requires. If you already know what you need, you can ask us for an offer from the [contact page](https://www.aegister.com/en/contact/?source=voucher). Our part is the offer: the application remains yours, and you submit it directly or through a delegate of your own.

## References

- Ministerial decree of 18 July 2025, article 5, paragraph 2.
- Directorial decree of 21 November 2025, article 4 and Annex 1, table of certifications by category.
- Directorial decree of 29 July 2026, definition of the list of approved suppliers, sole article.
- Directorial decree of 4 August 2026, article 3, paragraph 3; article 4, paragraph 2; article 5, paragraph 3; article 6, paragraph 1; article 8, paragraph 2.
- MIMIT, [answers to frequently asked questions on the measure](https://www.mimit.gov.it/it/assistenza/domande-frequenti/sostegno-domanda-servizi-di-cloud-computing-e-cyber-security-risposta-alle-domande-frequenti-faq) (in Italian), section 1, nos. 1, 2, 6, 7, 8, 9, 10, 11, 12, 16, 17, 24, 29, 30, 33, 41, 42, 43, 44 and 46; section 2, nos. 26, 27, 28 and 35.
- MIMIT, [supplier offer template](https://www.mimit.gov.it/images/stories/moduli/Fac-simile-Offerta-Fornitore-VCC.pdf), published on 8 October 2026 (in Italian).
- [Portal of the list of approved suppliers](https://vcc-elencofornitori.npi.invitalia.it/) (digital identity access).
- [The measure's page on the Ministry's website](https://www.mimit.gov.it/it/incentivi/sostegno-alla-domanda-di-servizi-di-cloud-computing-e-cyber-security) (in Italian).

This article reflects the decrees and the official FAQ published as of 8 October 2026 and does not replace the official texts.

This article was reviewed with AI tools for proofreading and error checking. Despite these checks it may contain inaccuracies: for compliance decisions, always refer to the official texts.

Self-assessment · NIST CSF 2.0 · ISO 27001

### Cyber Check-up

A self-assessment that returns your company's cyber profile: its security posture and the recommendations to mitigate risks and start your cybersecurity journey.

[Start the Cyber Check-up](https://www.aegister.com/en/assessment/?source=voucher)

Our service

### Aegister services for the voucher

The identification codes of our services to enter in the offer and in the application, and how we prepare the offer in the format the measure requires.

[Learn more](https://www.aegister.com/en/voucher-cloud-cybersecurity/#servizi-aegister)

Share this post:

Self-assessment

### Cyber Check-up

Answer the questionnaire and get your company's cyber profile: security posture and recommendations to mitigate risks.

[Start the Cyber Check-up](https://www.aegister.com/en/assessment/?source=voucher)

### Aegister services for the voucher

The identification codes of our services to enter in the offer and in the application, and how we prepare the offer in the format the measure requires.

[Learn more](https://www.aegister.com/en/voucher-cloud-cybersecurity/#servizi-aegister)

## Related news

October 14, 2026

### [Cloud and cybersecurity voucher: eligible costs, case by case](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-eligible-costs/)

What the cloud and cybersecurity voucher can buy, case by case: servers, ERP and CRM, SaaS, e-learning, artificial intelligence, professional service…

cloud and cybersecurity voucher
cloud cybersecurity voucher eligible costs
cloud voucher ERP CRM
+7

October 08, 2026

### [Cloud and cybersecurity voucher: the supplier's offer, section by section](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-supplier-offer/)

The supplier's offer is a mandatory attachment to the application. This guide follows the template the Ministry published on 8 October 2026: the part…

24-month subscription voucher
cloud and cybersecurity voucher
cloud and cybersecurity voucher quote
+7

September 24, 2026

### [Cloud and cybersecurity voucher: how the application is submitted](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-how-to-submit-the-application/)

The procedure has two phases three weeks apart. From 20 October 2026 the application is filled in, the PDF form generated, digitally signed and the p…

application compilation 20 October 2026
application preparation code
cloud and cybersecurity voucher
+7