--- title: "Cloud and cybersecurity voucher: disbursement and reporting" description: Assessment within 60 days, subscription signed within 30 days of the award, disbursement no earlier than 3 months, variations, controls and revocation. canonical: https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-reporting-disbursement/ url: /en/cms/insights/cloud-cybersecurity-voucher-reporting-disbursement/ lang: en --- ![](https://www.aegister.com/static/images/header-contact.webp) # Cloud and cybersecurity voucher: disbursement, variations and controls The grant is not paid in advance: it is disbursed against completion of the plan and its documentation. This guide covers the assessment deadline, the obligations running from the award, how and when disbursement is requested, the effect of variations on the residual contribution, the controls and the grounds for revocation. September 24, 2026 9 min read ![Auditor working through binders and printed documents with a highlighter](https://www.aegister.com/static/images/cms/theme-audit-desk.webp) Made with AI 60-day assessmentcloud voucher controlsCUP expense documentsMIMIT voucher disbursement Contents 1. [Assessment and award](#assessment-and-award) 2. [Obligations immediately after the award](#obligations-immediately-after-the-award) 3. [The disbursement request](#the-disbursement-request) 4. [Conclusion of the project](#conclusion-of-the-project) 5. [Variations and their effects](#variations-and-their-effects) 6. [Expense documentation](#expense-documentation) 7. [Controls](#controls) 8. [Revocation](#revocation) 9. [References](#references) The grant is not paid in advance: it is disbursed against completion of the spending plan and the related documentation. This guide covers the deadlines and obligations that follow submission and the award, governed by articles 8, 9, 10, 11 and 12 of the ministerial decree of 18 July 2025 and articles 4, 6, 7, 8, 9 and 10 of the directorial decree of 4 August 2026. The measure as a whole is described in the [complete voucher guide](https://www.aegister.com/en/cms/insights/mimit-cloud-cybersecurity-voucher-2026-italian-smes/) and on the [measure's page](https://www.aegister.com/en/voucher-cloud-cybersecurity/). ## Assessment and award The Ministry, supported by Invitalia, assesses applications in chronological order of submission, verifying that the documentation is complete and in order, that the requirements and eligibility conditions are met, that the chosen suppliers appear on the list, and that the approved services correspond to the spending plan submitted. Assessment is completed **within 60 days** of the date the application is submitted. The term is suspended while the Ministry awaits clarifications or additional documents it has requested, and is extended only where grounds for refusal are notified; for applications suspended for lack of funds it runs from notification that funds have become available. Clarifications and additional documents must be sent within the deadline given, **on pain of the application lapsing**. Where the outcome is positive, and once registration in the national aid register is complete, the Ministry issues the award. The 60-day term applies to assessment of the application, not to disbursement of the grant, which follows its own timing described below. *Ministerial decree of 18 July 2025, article 8; directorial decree of 4 August 2026, article 6.* ## Obligations immediately after the award Where the plan includes a subscription, two deadlines run from notification of the award: - the subscription must be **signed** after the application is submitted and **no later than 30 days** from notification of the award; - within **60 days** of that date, the **notification that it has been signed** must be transmitted through the online procedure, using the template published in the measure's area of the Ministry's portal, **on pain of forfeiting** the grant. Failure to comply with article 4(5) is a ground for revocation (directorial decree of 4 August 2026, article 10). For the part carried out by direct purchase, expenses must be incurred within 12 months of the same date, and the related payments must fall within the same term. *Directorial decree of 4 August 2026, article 4(4) and (5); ministerial decree of 18 July 2025, article 8(5).* ## The disbursement request The request is drawn up on the template the Ministry will publish in the measure's area of its portal and transmitted exclusively online through the procedure. In it the beneficiary describes the investment carried out and any variations from what was declared in the application. Disbursement is made in **two tranches** or as a **single tranche** on completion of the spending plan, and **cannot be requested earlier than 3 months** from the date of notification of the award. The first tranche may be requested only once **at least 50% of the approved spending plan** has been incurred. The second and final tranche, equal to the residual contribution, is requested on completion of the plan, with complete documentation of all the expenditure incurred. The grant is paid as a reimbursement: the beneficiary incurs and pays the expenses in full, then submits the request with the expense documents and proof of payment. Instead of requesting the first tranche, the beneficiary may wait for completion and request the whole grant at once. In every case only expenses actually incurred, paid and accepted as eligible are recognised. The request for the second and final tranche, or for the single tranche, must in any case be submitted **within 30 days of the final deadline for completing the spending programme**. The Ministry carries out its checks on the disbursement request within 60 days of submission and, if the outcome is positive, pays into the bank account indicated. If the checks are negative, the Ministry asks for the necessary additional documents: failing to send them, or sending documents unable to remove the grounds for refusal, results in a reduced payment or the partial or total revocation of the grant. *Ministerial decree of 18 July 2025, article 9; directorial decree of 4 August 2026, article 7; official MIMIT FAQ, section 2, nos. 37, 38 and 39.* ## Conclusion of the project The project counts as concluded once the eligible expenses have been incurred, invoiced and paid within the deadlines, for direct purchases and subscriptions alike. For a subscription the 24 months do not need to have elapsed: at reporting the beneficiary shows that the contract, with a minimum term of 24 months, has been signed and that the expenses were incurred on time. Use of the service then continues under the contract. Subscription expenses must be incurred within 24 months of signing and relate to the first 24 months. Paying one or more years in advance is allowed, since the measure sets no fee frequency. In a mixed purchase the overall project lasts at most 24 months from signing the subscription, and expenses for the direct purchases must still be incurred within 12 months of the award. The documentation for the direct purchases may be submitted with the final report, together with that for the subscription. For every acquisition method, the official FAQ state that the final report must be sent within 30 days of the project's conclusion. The decree instead counts the 30 days for the final request from the deadline for completing the plan: the prudent reference is the earlier of the two dates. *Official MIMIT FAQ, section 2, nos. 40, 41 and 42; directorial decree of 4 August 2026, article 4(4) and article 7(3).* ## Variations and their effects Beneficiaries must promptly notify, through the online procedure, variations arising from corporate transactions or transfers of the business, any early withdrawal from the subscription, and any change of the subscription supplier. The last two carry a significant consequence: they cause the **benefit to be interrupted** from the date of withdrawal or change, and the **loss of entitlement to the residual contribution** connected to that subscription. A change of supplier resulting from corporate transactions involving the chosen supplier does not fall within this case. Variations in the breakdown of planned expenditure, or of the supplier in cases other than a subscription, are notified with the disbursement request and assessed at that point. It remains the case that **switching the acquisition method** between direct purchase and subscription relative to the application is not permitted. *Directorial decree of 4 August 2026, article 8; ministerial decree of 18 July 2025, article 10(2).* ## Expense documentation Together with the disbursement request the beneficiary submits: - the expense documentation, consisting of the expense documents for the funded services and the documentation proving they have been paid; - a copy of the contract proving the availability of connectivity services with a minimum download speed of 30 Mbps; - for a subscription, a copy of the contract signed with the supplier; - any further documentation indicated in the request. Connectivity is declared in the application, while the contract is produced at disbursement and must already have been in force and valid on the date the application was submitted. A contract in another party's name is accepted if there is a demonstrable relationship between the parties and the connection serves the site stated in the application: it is submitted with a declaration in which the contract holder states that the service is available to the beneficiary. Each expense document must carry two elements, worth keeping in mind from the application stage: - the **unique project code (CUP)**, issued on submission of the application, in the dedicated field; - the **identification code** assigned by the list to the individual funded product or service and stated in the application. Passing the CUP and the identification codes to suppliers before invoices are issued avoids having to correct them afterwards. *Ministerial decree of 18 July 2025, article 9(3); directorial decree of 4 August 2026, article 7(4); official MIMIT FAQ, section 2, nos. 11 and 12.* ## Controls On the disbursement request the Ministry, supported by Invitalia and Infratel, verifies among other things: - that the documentation is in order and matches what was declared in the application, or that any variations are consistent with the purposes of the measure; - on a sample of requests, with Infratel's support, the availability of connectivity with a minimum download speed of 30 Mbps and that the plan includes solutions that are new and additional, or more advanced and secure, compared with those in use; - the conditions for paying public contributions, including the absence of defaults under article 48-bis of presidential decree 602/1973 and, for businesses, that they are active and compliant on social security contributions, as already declared in the application form, through acquisition ex officio of the DURC certificate; - compliance with the obligation to take out insurance against damage from natural disasters and catastrophic events, under article 1(101) of law 213/2023. The self-declaration (DSAN) on catastrophe insurance attached to the application refers to this check expressly; the subject is covered in the [guide to catastrophe insurance](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-catastrophe-insurance/). *Directorial decree of 4 August 2026, article 7(5)(a) to (d); application form, declarations (e) and (k); DSAN on catastrophe insurance, point 4.* The truthfulness of the declarations made is also verified on a sample basis by the Ministry at every stage of the procedure, under articles 43 and 71 of presidential decree 445/2000. Beneficiaries must allow and facilitate controls, inspections and monitoring, answer requests for information and keep the administrative and accounting records for the expenses reported. *Ministerial decree of 18 July 2025, article 11; directorial decree of 4 August 2026, article 9.* ## Revocation The grant is revoked, in whole or in part, where: - one or more eligibility requirements are found not to be met; - declarations made during the procedure prove false or non-compliant; - the beneficiary fails to notify promptly a withdrawal from the subscription or a change of supplier; - the beneficiary does not allow the controls; - variations are found that are incompatible with keeping the grant; - the obligations of article 4(5) of the directorial decree of 4 August 2026 are not met, that is starting the plan after the application and signing the subscription within the deadline; - additional documents requested at disbursement are not sent or do not remove the grounds for refusal. *Ministerial decree of 18 July 2025, article 12; directorial decree of 4 August 2026, article 10.* ## References - Ministerial decree of 18 July 2025, articles 8, 9, 10, 11 and 12. - Directorial decree of 4 August 2026, articles 4, 6, 7, 8, 9 and 10. - MIMIT, template of the application form and model self-declaration on catastrophe insurance, published on 8 October 2026. - MIMIT, official answers to frequently asked questions, section 2, nos. 11, 12, 37, 38, 39, 40, 41 and 42. This article was reviewed with AI tools for proofreading and error checking. Despite these checks it may contain inaccuracies: for compliance decisions, always refer to the official texts. Self-assessment · NIST CSF 2.0 · ISO 27001 ### Cyber Check-up A self-assessment that returns your company's cyber profile: its security posture and the recommendations to mitigate risks and start your cybersecurity journey. [Start the Cyber Check-up](https://www.aegister.com/en/assessment/?source=voucher) Our service ### Aegister services for the voucher The identification codes of our services to enter in the offer and in the application, and how we prepare the offer in the format the measure requires. [Learn more](https://www.aegister.com/en/voucher-cloud-cybersecurity/#servizi-aegister) Share this post: Self-assessment ### Cyber Check-up Answer the questionnaire and get your company's cyber profile: security posture and recommendations to mitigate risks. [Start the Cyber Check-up](https://www.aegister.com/en/assessment/?source=voucher) ### Aegister services for the voucher The identification codes of our services to enter in the offer and in the application, and how we prepare the offer in the format the measure requires. [Learn more](https://www.aegister.com/en/voucher-cloud-cybersecurity/#servizi-aegister) ## Related news October 29, 2026 ### [Submitting the cloud and cybersecurity voucher application from 10 November: submission code and checklist](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-submission-checklist/) How the cloud and cybersecurity voucher application is submitted from 10 November 2026: the submission code, the certificate and the CUP, chronologic… application preparation code chronological order voucher cloud and cybersecurity voucher +5 October 29, 2026 ### [Cloud and cybersecurity voucher: registration, delegation and who signs the application](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-registration-delegation-signature/) Before submitting the voucher application, the company registers in Invitalia's Anagrafica e Deleghe. Who may fill it in, who signs, how a delegation… cloud and cybersecurity voucher digital signature voucher application Invitalia Anagrafica e Deleghe +4 October 29, 2026 ### [Filling in the cloud and cybersecurity voucher application on the Invitalia platform, section by section](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-application-platform/) The cloud and cybersecurity voucher application is filled in on the Invitalia platform from 20 October 2026 and submitted from 10 November. The form'… cloud and cybersecurity voucher invitalia voucher platform voucher application attachments +5 ## Legal notes 1. Articles reflect the rules and information available on the publication or update date shown. 2. The content of this site is for information only and is not legal or tax advice. 3. Third-party product, company and organisation names and trademarks mentioned on this site belong to their respective owners. We mention them to describe our services and the applicable rules and standards; unless stated otherwise, a mention does not imply affiliation, sponsorship or endorsement. 4. The information on the Voucher Cloud e Cybersecurity summarises the MIMIT decrees and official FAQ: where they differ, the official texts prevail. We are an approved supplier with identifier VCCFA2600000933 and we prepare the offer; submitting the application and meeting the requirements remain the applicant company's responsibility, and the grant depends on the checks the measure provides for and on the funds available. 5. Images labelled “Made with AI” are generated with artificial intelligence tools, are illustrative and do not depict real people or events. 6. The Cyber Check-up is a self-assessment: its results and suggestions depend on the answers given and do not replace a technical review, an audit or a certification.