Cloud and cybersecurity voucher: disbursement, variations and controls

The grant is not paid in advance: it is disbursed against completion of the plan and its documentation. This guide covers the assessment deadline, the obligations running from the award, how and when disbursement is requested, the effect of variations on the residual contribution, the controls and the grounds for revocation.

September 24, 2026 7 min read

Auditor working through binders and printed documents with a highlighter Made with AI
Contents
  1. Assessment and award
  2. Obligations immediately after the award
  3. The disbursement request
  4. Variations and their effects
  5. Expense documentation
  6. Controls
  7. Revocation
  8. References

The grant is not paid in advance: it is disbursed against completion of the spending plan and the related documentation. This guide covers the deadlines and obligations that follow submission and the award, governed by articles 8, 9, 10, 11 and 12 of the ministerial decree of 18 July 2025 and articles 4, 6, 7, 8, 9 and 10 of the directorial decree of 4 August 2026. The measure as a whole is described in the complete voucher guide and on the measure's page.

Assessment and award

The Ministry, supported by Invitalia, assesses applications in chronological order of submission, verifying that the documentation is complete and in order, that the requirements and eligibility conditions are met, that the chosen suppliers appear on the list, and that the approved services correspond to the spending plan submitted.

Assessment is completed within 60 days of the date the application is submitted. The term is suspended while the Ministry awaits clarifications or additional documents it has requested, and is extended only where grounds for refusal are notified; for applications suspended for lack of funds it runs from notification that funds have become available. Clarifications and additional documents must be sent within the deadline given, on pain of the application lapsing. Where the outcome is positive, and once registration in the national aid register is complete, the Ministry issues the award.

The 60-day term applies to assessment of the application, not to disbursement of the grant, which follows its own timing described below.

Ministerial decree of 18 July 2025, article 8; directorial decree of 4 August 2026, article 6.

Obligations immediately after the award

Where the plan includes a subscription, two deadlines run from notification of the award:

  • the subscription must be signed after the application is submitted and no later than 30 days from notification of the award;
  • within 60 days of that date, the notification that it has been signed must be transmitted through the online procedure, using the template published in the measure's area of the Ministry's portal, on pain of forfeiting the grant.

Failure to comply with article 4(5) is a ground for revocation (directorial decree of 4 August 2026, article 10).

For the part carried out by direct purchase, expenses must be incurred within 12 months of the same date, and the related payments must fall within the same term.

Directorial decree of 4 August 2026, article 4(4) and (5); ministerial decree of 18 July 2025, article 8(5).

The disbursement request

The request is drawn up on the template the Ministry will publish in the measure's area of its portal and transmitted exclusively online through the procedure. In it the beneficiary describes the investment carried out and any variations from what was declared in the application.

Disbursement is made in two tranches or as a single tranche on completion of the spending plan, and cannot be requested earlier than 3 months from the date of notification of the award.

The first tranche may be requested only once at least 50% of the approved spending plan has been incurred. The second and final tranche, equal to the residual contribution, is requested on completion of the plan, with complete documentation of all the expenditure incurred.

The request for the second and final tranche, or for the single tranche, must in any case be submitted within 30 days of the final deadline for completing the spending programme.

The Ministry carries out its checks on the disbursement request within 60 days of submission and, if the outcome is positive, pays into the bank account indicated. If the checks are negative, the Ministry asks for the necessary additional documents: failing to send them, or sending documents unable to remove the grounds for refusal, results in a reduced payment or the partial or total revocation of the grant.

Ministerial decree of 18 July 2025, article 9; directorial decree of 4 August 2026, article 7.

Variations and their effects

Beneficiaries must promptly notify, through the online procedure, variations arising from corporate transactions or transfers of the business, any early withdrawal from the subscription, and any change of the subscription supplier.

The last two carry a significant consequence: they cause the benefit to be interrupted from the date of withdrawal or change, and the loss of entitlement to the residual contribution connected to that subscription. A change of supplier resulting from corporate transactions involving the chosen supplier does not fall within this case.

Variations in the breakdown of planned expenditure, or of the supplier in cases other than a subscription, are notified with the disbursement request and assessed at that point.

It remains the case that switching the acquisition method between direct purchase and subscription relative to the application is not permitted.

Directorial decree of 4 August 2026, article 8; ministerial decree of 18 July 2025, article 10(2).

Expense documentation

Together with the disbursement request the beneficiary submits:

  • the expense documentation, consisting of the expense documents for the funded services and the documentation proving they have been paid;
  • a copy of the contract proving the availability of connectivity services with a minimum download speed of 30 Mbps;
  • for a subscription, a copy of the contract signed with the supplier;
  • any further documentation indicated in the request.

Each expense document must carry two elements, worth keeping in mind from the application stage:

  • the unique project code (CUP), issued on submission of the application, in the dedicated field;
  • the identification code assigned by the list to the individual funded product or service and stated in the application.

Passing the CUP and the identification codes to suppliers before invoices are issued avoids having to correct them afterwards.

Ministerial decree of 18 July 2025, article 9(3); directorial decree of 4 August 2026, article 7(4).

Controls

On the disbursement request the Ministry, supported by Invitalia and Infratel, verifies among other things:

  • that the documentation is in order and matches what was declared in the application, or that any variations are consistent with the purposes of the measure;
  • on a sample of requests, with Infratel's support, the availability of connectivity with a minimum download speed of 30 Mbps and that the plan includes solutions that are new and additional, or more advanced and secure, compared with those in use;
  • the conditions for paying public contributions, including the absence of defaults under article 48-bis of presidential decree 602/1973 and, for businesses, that they are active and compliant on social security contributions, through acquisition ex officio of the DURC certificate;
  • compliance with the obligation to take out insurance against damage from natural disasters and catastrophic events, under article 1(101) of law 213/2023.

Directorial decree of 4 August 2026, article 7(5)(a) to (d).

The truthfulness of the declarations made is also verified on a sample basis by the Ministry at every stage of the procedure, under articles 43 and 71 of presidential decree 445/2000. Beneficiaries must allow and facilitate controls, inspections and monitoring, answer requests for information and keep the administrative and accounting records for the expenses reported.

Ministerial decree of 18 July 2025, article 11; directorial decree of 4 August 2026, article 9.

Revocation

The grant is revoked, in whole or in part, where:

  • one or more eligibility requirements are found not to be met;
  • declarations made during the procedure prove false or non-compliant;
  • the beneficiary fails to notify promptly a withdrawal from the subscription or a change of supplier;
  • the beneficiary does not allow the controls;
  • variations are found that are incompatible with keeping the grant;
  • the obligations of article 4(5) of the directorial decree of 4 August 2026 are not met, that is starting the plan after the application and signing the subscription within the deadline;
  • additional documents requested at disbursement are not sent or do not remove the grounds for refusal.

Ministerial decree of 18 July 2025, article 12; directorial decree of 4 August 2026, article 10.

References

  • Ministerial decree of 18 July 2025, articles 8, 9, 10, 11 and 12.
  • Directorial decree of 4 August 2026, articles 4, 6, 7, 8, 9 and 10.

This article is current as of September 2026 and does not replace the official texts.

This article was reviewed with AI tools for proofreading and error checking. Despite these checks it may contain inaccuracies: for compliance decisions, always refer to the official texts.

Self-assessment · NIST CSF 2.0 · ISO 27001

Cyber Check-up

A self-assessment that returns your company's cyber profile: its security posture and the recommendations to mitigate risks and start your cybersecurity journey.

Our service

NIS 2

We guide you to compliance with the NIS 2 Directive: requirements analysis, security measures, incident notification and documentation audit.

Learn more
Share this post:

Related news

September 24, 2026

The cloud and cybersecurity voucher and NIS 2 technical measures

Part of the technical measures common to NIS 2 alignment programmes falls within the eligible product and service types: perimeter protection, monito…

September 24, 2026

Cloud and cybersecurity voucher: beneficiaries and requirements

Eligibility is set by article 4 of the ministerial decree of 18 July 2025 and must be met when the application is submitted. This guide lists each re…

September 24, 2026

Cloud and cybersecurity voucher: composing the spending plan

The spending plan determines the grant, the completion deadlines and what will have to be reported. This guide explains the 30% limit on macro-catego…