Before asking for an offer, it is worth knowing whether the purchase you have in mind falls within the cloud and cybersecurity voucher. The official FAQ (in Italian) of the Ministry of Enterprises and Made in Italy answer many concrete cases. This guide groups them by type of expense: for each one it gives the answer, the condition attached to it and the source.
In brief
- The voucher funds products and services in the five macro-categories of the list, new or improving on those in use.
- A generic server is not eligible; ERP and CRM are eligible only as SaaS cloud services.
- Professional services in macro-category E stay within 30% of the plan and must be connected to another product or service in the plan.
- An approved supplier may resell products of vendors that are not on the list, if they fall within a type for which it is accredited.
- Only expenses incurred after the application is sent are eligible.
What the voucher funds
The voucher funds cloud computing and cybersecurity products and services supplied by the parties on the list, provided they are new and additional to those available or improve on those in use. They fall into five macro-categories, from A (cybersecurity hardware solutions) to E (professional configuration, monitoring and ongoing support services), divided into the 23 types listed on the page about the measure. The macro-categories are binding while the products named in each are examples, so many cases are clarified by the Ministry's answers; how to compose the plan is explained in the spending plan guide.
Category and type labels in this article are our translation; the Italian wording of the decrees is the legal text.
Ministerial decree of 18 July 2025, article 2(2); directorial decree of 4 August 2026, article 4(1) and (2); official MIMIT FAQ, section 1, no. 13.
Hardware and infrastructure
A new server with virtualisation and Windows Server
No. Generic hardware, such as a server, is not among the eligible cybersecurity hardware solutions, even when it comes with virtualisation systems and an up-to-date Windows Server (official MIMIT FAQ, section 1, no. 36). Macro-category A covers firewalls, next-generation firewalls (NGFW), routers/switches and intrusion prevention devices (IDS/IPS). Virtual machines appear instead in macro-category C, among infrastructure cloud services (directorial decree of 4 August 2026, article 4(2)(a) and (c)).
An infrastructure service built partly with third-party products
It is allowed within the limits of the categories. The official FAQ answer that products and services on the list may be combined, including with third-party products, to make up even a complex service, but that the limits set by the categories remain (official MIMIT FAQ, section 1, no. 32). Each component must therefore fall within a macro-category, with the delivery model that macro-category requires.
Software and cloud services
SaaS software, ready-made, configured or developed for you
Yes, in all three forms, provided it is delivered as SaaS (official MIMIT FAQ, section 1, no. 15). The same answer requires the solutions to be registered by the supplier on the list; no. 46 adds that the supplier may also offer products not declared at registration, provided they fall within a type for which it is accredited. Software not delivered as SaaS is eligible in macro-category B only if it is a cybersecurity solution; alternatively, the professional days spent developing it may fall within macro-category E (no. 35).
ERP and CRM in the cloud or installed on premises
Only in the cloud. ERP and CRM are eligible only in macro-category D, as SaaS cloud services, and the only types of software eligible on premises are those of macro-category B, cybersecurity software solutions (official MIMIT FAQ, section 1, no. 18). An ERP installed in the client's data centre is therefore not eligible (no. 32). Cybersecurity software in macro-category B is eligible both installed and in the cloud (no. 39).
Power BI dashboards
Yes, in macro-category D, SaaS cloud services. The types named in macro-categories A to D are an illustrative, non-exhaustive list (official MIMIT FAQ, section 1, no. 19).
Cybersecurity e-learning software
Only the platform, without the content. Training or skills services are excluded, even when delivered through cloud e-learning platforms; only e-learning platforms without training content, offered in the cloud, are eligible (official MIMIT FAQ, section 1, no. 25). The decree places systems for delivering training in macro-category D, excluding the cost of training content. It excludes training of the beneficiaries from macro-category E (directorial decree of 4 August 2026, article 4(2)(d) and (e)).
Solutions based on artificial intelligence
Yes, when they fall within the services eligible under the measure, for example SaaS solutions that integrate artificial intelligence features to support business processes and productivity (official MIMIT FAQ, section 2, no. 24). Type D.3 says so explicitly: "productivity/workflow management systems (ERP), including business productivity solutions integrated with artificial intelligence features" (our translation). For software already in use, a version update without a substantial improvement is not eligible. The decree gives the introduction of new automation or artificial intelligence features as an example of such an improvement (directorial decree of 4 August 2026, article 4(3)).
Professional services (macro-category E)
What falls within macro-category E
Operational and technical services directly linked to implementing and running the solutions, as opposed to mere consultancy. Training courses and pure consultancy, meaning theoretical assessments not followed by implementation, remain excluded (official MIMIT FAQ, section 1, no. 20). These services must relate to one or more products or services of the other macro-categories on the list (no. 38) and are eligible up to 30% of the plan (directorial decree of 21 November 2025, article 5; directorial decree of 4 August 2026, article 4(2)(e)).
Configuration and support only, without the product
The service can be bought on its own, but the product it relates to must be in the plan. A supplier admitted for macro-category E may offer the configuration, support and maintenance service alone. In the official FAQ example the service concerns an ERP of type D.3. The beneficiary includes the software in the plan as well, for at least 70% of its value, with its identification code, from the same supplier or another one (official MIMIT FAQ, section 1, no. 45). Composition examples are in the spending plan guide.
Services needed to run macro-category B software
They may stay in macro-category B, outside the 30% limit, provided the solution is delivered as SaaS. The official FAQ give the example of a security monitoring service based on antimalware technology. Alternatively, these services can always be classified in macro-category E (official MIMIT FAQ, section 1, no. 37).
Configuring a VPN on a firewall or router you already own
No. The activity is a professional service of macro-category E, which must be connected to products or services of macro-categories A, B, C or D, themselves eligible only if new or improving on those in use. Equipment the beneficiary already has is not in the spending plan, so configuring it is not eligible (official MIMIT FAQ, section 1, no. 47).
Third-party products, resellers and MSPs
Products of a vendor that is not on the list
Yes, if an approved supplier offers them and they fall within a type for which it is accredited. The third-party product may also be sold on its own: a supplier admitted for type A.1 may offer just the firewall of a third-party manufacturer (official MIMIT FAQ, section 1, no. 44). Accreditation allows the supplier to resell products and services of parties that are not on the list (no. 42), and answers nos. 16 and 17 tie this to the categories for which the supplier is certified.
A supplier may also include in the offer services for which it is not accredited, provided they are supplied by another party accredited for that type. In that case the offer states the original supplier's identification code and name, and that code goes into the application, even though invoicing and delivery remain with the supplier whose offer you signed (official MIMIT FAQ, section 2, no. 28). The case is described in the supplier offer guide.
Licences held by the MSP partner
Yes, on three conditions. Eligibility does not depend only on who formally holds the licence, but on the contractual set-up and on how the service is delivered to the beneficiary. The MSP model is compatible with macro-category D, SaaS cloud services, if (official MIMIT FAQ, section 1, no. 43):
- the MSP partner that resells and invoices the licences to the end client is an accredited supplier on the list;
- the type of service is registered on the list of products and services of the supplier or the vendor;
- the service is actually delivered to the SME as SaaS.
Purchase timing
Services already bought, activated or renewed
No, if the expense has already been incurred or if the new purchase performs like what is already in use. The official FAQ exclude expenses for products or services with performance similar to those in use and version updates without a substantial improvement. The extension of a licence already held and an increase in seats or user accounts are excluded too (official MIMIT FAQ, section 2, nos. 23 and 25; directorial decree of 4 August 2026, article 4(3)).
Activating services before the application
No. Only expenses incurred after the application is sent are eligible, and those made before cannot be funded (official MIMIT FAQ, section 2, no. 25; directorial decree of 4 August 2026, article 4(5)). In the application the applicant also declares that it has not yet started the programme. A contract, an order confirmation, an invoice or a payment, including a down payment, starts it (application form template, in Italian, declaration i) and note 2). The order of the steps is described in the supplier offer guide, the procedure in the guide to submitting the application.
A SaaS service bought directly
Yes. A contract for SaaS cloud services may also be treated as a direct purchase, with expenses and payments within 12 months of the notice of the grant decision, as well as a subscription of at least 24 months (official MIMIT FAQ, section 1, no. 40; directorial decree of 4 August 2026, article 4(4)).
What is not eligible
The official FAQ sum up the principle: the voucher funds only solutions that are new or significantly better than those already in use (section 2, no. 22). The table lists the exclusions, including those from the cases above.
| Ineligible expense | Source |
|---|---|
| Products or services with performance similar to those already in use | Ministerial decree of 18 July 2025, article 5(4); directorial decree of 4 August 2026, article 4(3) |
| Extensions of licences already held | Directorial decree of 4 August 2026, article 4(3) |
| More seats, users or user accounts on services already in use | Directorial decree of 4 August 2026, article 4(3) |
| Version updates without a substantial improvement | Directorial decree of 4 August 2026, article 4(3) |
| Work that only maintains the existing infrastructure, without new features or higher security levels | Official MIMIT FAQ, section 2, no. 22 |
| Generic hardware, such as a server | Official MIMIT FAQ, section 1, no. 36 |
| ERP and CRM installed on premises | Official MIMIT FAQ, section 1, nos. 18 and 32 |
| Training courses and content, including on e-learning platforms | Directorial decree of 4 August 2026, article 4(2)(d) and (e); official MIMIT FAQ, section 1, no. 25 |
| Pure consultancy, meaning theoretical assessments not followed by implementation | Official MIMIT FAQ, section 1, no. 20 |
| Configuration of equipment already owned | Official MIMIT FAQ, section 1, no. 47 |
| Expenses incurred before the application is sent | Directorial decree of 4 August 2026, article 4(5); official MIMIT FAQ, section 2, no. 25 |
Which expense to include depends on your starting position, which the offer must describe together with the expected improvement. The Cyber Check-up describes your situation and identifies the priorities; at the end you can book a meeting with us, in which we define the services and prepare the offer in the format the measure requires, as an approved supplier under the identifier VCCFA2600000933 (directorial decree of 29 July 2026). If you already know what you need, you can ask us for an offer from the contact page. Our part is the offer: the application remains yours, and you submit it directly or through a delegate of your own.
References
- Ministerial decree of 18 July 2025, articles 2 and 5.
- Directorial decree of 21 November 2025, article 5.
- Directorial decree of 29 July 2026, list of approved suppliers.
- Directorial decree of 4 August 2026, article 4.
- MIMIT, application form template, declaration i) and note 2, published on 8 October 2026 (in Italian).
- MIMIT, answers to frequently asked questions on the measure (in Italian), section 1, nos. 13, 15, 16, 17, 18, 19, 20, 25, 32, 35, 36, 37, 38, 39, 40, 42, 43, 44, 45, 46 and 47; section 2, nos. 22, 23, 24, 25 and 28.
- The measure's page on the Ministry's website (in Italian).
This article reflects the official FAQ as published on 8 October 2026 and does not replace the official texts.
