--- title: "Cloud and cybersecurity voucher requirements: who can apply" description: "SMEs and professionals: size, 30 Mbps, catastrophe insurance, contributions, excluded sectors, de minimis. What is declared and what is checked later." canonical: https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-requirements-de-minimis/ url: /en/cms/insights/cloud-cybersecurity-voucher-requirements-de-minimis/ lang: en --- ![](https://www.aegister.com/static/images/header-contact.webp) # Cloud and cybersecurity voucher: who can apply, requirements and de minimis Eligibility is set by article 4 of the ministerial decree of 18 July 2025 and must be met when the application is submitted. This guide sets out who can apply, with the cases settled by the official FAQ, lists the requirements and the declarations in the form, including social security compliance checked at disbursement, and explains the de minimis regime. September 24, 2026 11 min read ![Printed policy document open on a desk with a pen and a stamp](https://www.aegister.com/static/images/cms/theme-policy-binder.webp) Made with AI 30 Mbps connectivitycatastrophe insurance covercloud voucher requirementscombining State aid Contents 1. [Who is eligible](#who-is-eligible) 2. [The 30 Mbps connectivity contract](#the-30-mbps-connectivity-contract) 3. [Requirements for businesses](#requirements-for-businesses) 4. [Grounds for exclusion](#grounds-for-exclusion) 5. [Social security compliance](#social-security-compliance) 6. [The de minimis regime and combining aid](#the-de-minimis-regime-and-combining-aid) 7. [The reserve for southern regions](#the-reserve-for-southern-regions) 8. [Checks that cannot be compressed](#checks-that-cannot-be-compressed) 9. [References](#references) Eligibility for the Voucher Cloud & Cybersecurity is set by article 4 of the ministerial decree of 18 July 2025 and referenced by article 3 of the directorial decree of 4 August 2026. The requirements must be met **when the application is submitted** and are declared in the form of a self-certified declaration (*dichiarazione sostitutiva di atto notorio*). A summary is also on the [measure's page](https://www.aegister.com/en/voucher-cloud-cybersecurity/#requisiti). ## Who is eligible Grants are available to **SMEs** and **self-employed workers** operating throughout national territory. The directorial decree clarifies that all SMEs are eligible *regardless of legal and organisational form*, as are all self-employed workers *regardless of role and activity*. **SMEs** are micro, small and medium-sized enterprises meeting the requirements of European Commission Recommendation 2003/361/EC and Annex I of Regulation (EU) No 651/2014 (GBER). A **self-employed worker** is a natural person practising an art or profession within the scope of article 1 of law 81 of 22 May 2017, including professionals registered with a professional body and those practising one of the professions not organised in bodies or colleges under article 1(2) of law 4 of 14 January 2013. In the application form, size is declared by ticking micro, small or medium enterprise and stating the number of employees in annual work units (ULA), turnover and balance sheet total (declaration a)). The thresholds are those of Recommendation 2003/361/EC (official MIMIT FAQ, section 2, no. 2): - **medium enterprise**: fewer than 250 employees and annual turnover not above EUR 50 million, or an annual balance sheet total not above EUR 43 million; - **small enterprise**: fewer than 50 employees and annual turnover or annual balance sheet total not above EUR 10 million; - **micro enterprise**: fewer than 10 employees and annual turnover or annual balance sheet total not above EUR 2 million. The check takes account, where applicable, of partner and linked enterprises. A business that exceeds the thresholds in a single financial year does not automatically lose its SME status; if the excess is confirmed for a second consecutive year, the benefits accrued are revoked (official MIMIT FAQ, section 2, no. 3). For self-employed workers, [Invitalia's interactive guide to filling in the application](https://manuali.invitalia.it/cybersecurity/) (version of 28 October 2026) states how to work out the same data: annual work units are calculated with the parameters of the ministerial decree of 18 April 2005; turnover is the revenue or fees (ricavi/compensi) item for the last tax period available; those not required to draw up financial statements take the balance sheet total from their last tax return and a statement of assets and liabilities, as the same decree provides. On someone who works alone the guide's note on annual work units is not consistent: it says that the owner who carries out the activity is included in the count and, in the same sentence, that someone working alone enters 0. Either way the figure stays within the micro enterprise limit of fewer than 10 employees. Each applicant may submit **only one application**. The spending plan may cover several local units; the application states the one where it mainly takes effect. The limit applies to each legal entity: separate businesses belonging to the same single undertaking may each apply, but the de minimis ceiling is checked on the single undertaking (official MIMIT FAQ, section 2, no. 13). Entities already on the supplier list may also apply, provided they meet the same requirements and acquire the services from suppliers other than themselves and included in the list. ### Cases clarified by the official FAQ The official MIMIT FAQ (section 2) settle a number of recurring cases: - no filed financial statements are needed; newly formed businesses may apply, provided they are duly incorporated, registered in the Business Register, active and meet the other requirements (nos. 4 and 5); - businesses in the primary production of agricultural products are excluded. A farm that also carries out eligible activities, such as processing products or agritourism, may apply for those activities. The plan must relate to them, they must be distinguishable from the excluded ones and the related ATECO code must already be active on the date of the application (no. 15); - professional bodies (Ordini professionali) and their foundations are not eligible (no. 16); - associated professional firms (studi professionali associati) are not eligible; the individual professionals of the firm with their own VAT number are (no. 17); - a tax assistance centre (CAF) is eligible if it is set up as a business (no. 18); - a consortium is eligible if it qualifies as an SME (no. 19); - loan guarantee consortia (Confidi) and businesses in financial and insurance activities are not excluded (no. 20). If a business carries out, besides activities excluded by the de minimis regulation, other admitted activities, the grant can be awarded for the latter (no. 15). Invitalia's guide to filling in the application states the same for self-employed workers and shows where this is declared on the platform: the ATECO code of the admitted activity goes in the "Codice ATECO attività" (activity ATECO code) field of the "Descrizione del piano di spesa" (spending plan description) section. *Ministerial decree of 18 July 2025, article 1(1)(b) and (c), and article 7(5); directorial decree of 4 August 2026, article 3 and article 5(3) and (6); application form, declaration a); official MIMIT FAQ, section 2, nos. 2-5, 13, 15-20; Invitalia's interactive guide to filling in the application.* ## The 30 Mbps connectivity contract The requirement that characterises this measure is holding, at the time of submission, a **contract for connectivity services with a minimum download speed of 30 Mbps**. The application declares possession of the contract; at disbursement stage a copy must be submitted and, on a sample, Infratel verifies that the service is actually available. If the current contract falls short, the upgrade must be completed before the application is submitted and depends on the operator's activation times. This is the check worth starting first. The official MIMIT FAQ (section 2) settle three points. Mobile network connections, such as a data SIM, are not accepted; fibre, VDSL, FWA and satellite connections are, for example (no. 10). Invitalia's guide to filling in the application says the same: a fixed connection is required, with any technology. The contract produced at disbursement must already be in force and valid on the date of the application (no. 11). The contract may be held in another party's name, provided there is a demonstrable relationship and the connection serves the location stated in the application; at disbursement a declaration by the holder that the service is available to the beneficiary is also submitted (no. 12). *Ministerial decree of 18 July 2025, article 4(1); directorial decree of 4 August 2026, article 7(4) and (5); official MIMIT FAQ, section 2, nos. 10, 11 and 12; Invitalia's interactive guide to filling in the application.* ## Requirements for businesses Under article 4(2), businesses must: - be duly incorporated, registered in the Business Register and **active**; - be in full and free exercise of their rights, not in voluntary liquidation nor subject to insolvency proceedings for liquidation purposes; - be compliant with **insurance obligations** covering damage directly caused by natural disasters and catastrophic events, under article 1(101) of law 213 of 30 December 2023 and decree-law 39 of 31 March 2025; for SMEs this is attested by the self-declaration (DSAN) attached to the application; - not be among businesses that received and did not repay, or deposit in a blocked account, aid identified as unlawful or incompatible by the European Commission; - not be active in the sectors excluded by article 1 of the de minimis regulation; - not fall under the grounds for exclusion in paragraph 4 of the same article. **Self-employed workers** not required to register in the Business Register need only hold a VAT number, subject to registration with the relevant professional body where required and to the other requirements where compatible. *Ministerial decree of 18 July 2025, article 4(2) and (3).* ## Grounds for exclusion Paragraph 4 excludes in all cases those subject to the disqualifying sanction under article 9(2)(d) of legislative decree 231 of 8 June 2001, or another sanction entailing a ban on contracting with public administration; those whose legal representatives or directors have been convicted, at the date the application is submitted, by final judgment or by a criminal conviction order that has become irrevocable, of offences constituting grounds for excluding an economic operator from a procurement or concession procedure; and those in other conditions which the law treats as causing incapacity to receive public financial support or as otherwise precluding it. *Ministerial decree of 18 July 2025, article 4(4).* ## Social security compliance The application form published by the Ministry on 8 October 2026 has the applicant declare that it is **up to date with its social security contributions** (declaration k)). It is not among the requirements listed in article 4 of the ministerial decree, but it is a declaration made in the application, so it is worth checking before signing. The check takes place at **disbursement**: the Ministry verifies compliance with the rules on public contributions, including the absence of defaults under article 48-bis of presidential decree 602/1973 and, for businesses, current social security compliance through acquisition *ex officio* of the DURC certificate. For untrue declarations the form recalls the consequences of articles 75 and 76 of presidential decree 445/2000. *Application form, declaration k); ministerial decree of 18 July 2025, article 9(4); directorial decree of 4 August 2026, article 7(5)(c).* ## The de minimis regime and combining aid Grants are awarded under the **de minimis regulation**, Commission Regulation (EU) 2023/2831 of 13 December 2023, and may be combined with other State aid, including de minimis, within the limits set by the relevant European State aid rules. Two practical implications. First, the grant consumes the business's de minimis allowance, so remaining headroom must be checked before deciding how much to claim. Second, if the **national aid register** shows that the ceiling set by the de minimis regulation has been exceeded, the application is not accepted and the Ministry notifies the business of the reasons. *Ministerial decree of 18 July 2025, article 1(1)(f) and article 6(2); directorial decree of 4 August 2026, article 1(1)(h) and article 6(4).* ## The reserve for southern regions Of the EUR 150 million total, **EUR 71,065,813.34** is reserved for operations in Abruzzo, Basilicata, Calabria, Campania, Molise, Puglia, Sardinia and Sicily. This is not a personal requirement: what counts is the location of the local unit where the spending plan mainly takes effect, which is stated in the application. *Ministerial decree of 18 July 2025, article 3(2); directorial decree of 4 August 2026, article 2(3) and article 5(3)(b).* ## Checks that cannot be compressed Among the requirements listed, three involve steps that cannot be completed in a day and must be completed before the application is digitally signed, because the requirements must be met when it is submitted: any **upgrade to the connectivity contract**, taking out the **catastrophe-risk insurance cover**, and verifying **de minimis headroom**. The other registration and status requirements appear in the company registration extract (*visura camerale*); the grounds for exclusion in paragraph 4 require separate checks. The insurance obligation of law 213/2023 applies to businesses required to register in the Business Register; for self-employed workers not required to register, the further requirements apply where compatible. The declaration that the insurance obligation has been met must be made in the application, **on pain of the application being inadmissible**, and is checked again at disbursement stage. For SMEs the self-declaration (DSAN) on catastrophe insurance, on the model published by the Ministry, is also attached to the application (official MIMIT FAQ, section 2, no. 30). The model, its three options and the deadlines it recalls are covered in the guide to [catastrophe insurance](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-catastrophe-insurance/). The declarations still matter after the award: the Ministry verifies their truthfulness on a sample basis at every stage of the procedure, and the grant is **revoked** if it is established that one or more article 4 requirements are not met or if the declarations prove false or non-compliant. *Ministerial decree of 18 July 2025, article 4(1) and (3), and article 12(1)(a) and (b); directorial decree of 4 August 2026, article 5(3)(i), article 7(5)(d) and article 9; application form, attachments section; official MIMIT FAQ, section 2, no. 30.* On the procedural side there remain the digital identity, the digital signature and the PEC mailbox, described in the [guide to submitting the application](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-how-to-submit-the-application/). Filling in the application on the platform is described in the [guide to the application platform](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-application-platform/), the checks before submission in the [guide to submission and checklist](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-submission-checklist/). ## References - Ministerial decree of 18 July 2025, articles 1, 3, 4, 6, 7, 9 and 12. - Directorial decree of 4 August 2026, articles 1, 2, 3, 5, 6, 7 and 9. - Commission Regulation (EU) 2023/2831 of 13 December 2023. - MIMIT, [application form template](https://www.mimit.gov.it/images/stories/moduli/Fac-simile-Format-Domanda-VCC.pdf), published on 8 October 2026. - MIMIT, official answers to frequently asked questions, section 2 (beneficiaries and eligibility). - Invitalia, [interactive guide to filling in the application](https://manuali.invitalia.it/cybersecurity/), version of 28 October 2026 (in Italian). This article was reviewed with AI tools for proofreading and error checking. Despite these checks it may contain inaccuracies: for compliance decisions, always refer to the official texts. Self-assessment · NIST CSF 2.0 · ISO 27001 ### Cyber Check-up A self-assessment that returns your company's cyber profile: its security posture and the recommendations to mitigate risks and start your cybersecurity journey. [Start the Cyber Check-up](https://www.aegister.com/en/assessment/?source=voucher) Our service ### Aegister services for the voucher The identification codes of our services to enter in the offer and in the application, and how we prepare the offer in the format the measure requires. [Learn more](https://www.aegister.com/en/voucher-cloud-cybersecurity/#servizi-aegister) Share this post: Self-assessment ### Cyber Check-up Answer the questionnaire and get your company's cyber profile: security posture and recommendations to mitigate risks. [Start the Cyber Check-up](https://www.aegister.com/en/assessment/?source=voucher) ### Aegister services for the voucher The identification codes of our services to enter in the offer and in the application, and how we prepare the offer in the format the measure requires. [Learn more](https://www.aegister.com/en/voucher-cloud-cybersecurity/#servizi-aegister) ## Related news October 8, 2026 ### [Catastrophe insurance and the cloud and cybersecurity voucher: the self-declaration to attach](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-catastrophe-insurance/) For the Cloud & Cybersecurity Voucher, the business declares in its application that it complies with the catastrophe insurance obligation and attach… catastrophe insurance cover catastrophe insurance DSAN catastrophe insurance self-declaration +5 September 9, 2026 ### [MIMIT cloud and cybersecurity voucher: guide to the measure](https://www.aegister.com/en/cms/insights/mimit-cloud-cybersecurity-voucher-2026-italian-smes/) The measure supports demand for cloud computing and cyber security services from SMEs and self-employed workers with a non-repayable grant of 50% of … approved supplier list MIMIT cloud and cybersecurity voucher cloud voucher requirements +7 October 29, 2026 ### [Submitting the cloud and cybersecurity voucher application from 10 November: submission code and checklist](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-submission-checklist/) How the cloud and cybersecurity voucher application is submitted from 10 November 2026: the submission code, the certificate and the CUP, chronologic… application preparation code chronological order voucher cloud and cybersecurity voucher +5 ## Legal notes 1. Articles reflect the rules and information available on the publication or update date shown. 2. The content of this site is for information only and is not legal or tax advice. 3. Third-party product, company and organisation names and trademarks mentioned on this site belong to their respective owners. We mention them to describe our services and the applicable rules and standards; unless stated otherwise, a mention does not imply affiliation, sponsorship or endorsement. 4. The information on the Voucher Cloud e Cybersecurity summarises the MIMIT decrees and official FAQ: where they differ, the official texts prevail. We are an approved supplier with identifier VCCFA2600000933 and we prepare the offer; submitting the application and meeting the requirements remain the applicant company's responsibility, and the grant depends on the checks the measure provides for and on the funds available. 5. The details of the application platform follow the interactive guide published by Invitalia, which reproduces a demonstration counter and may change: the platform and the official documentation of the measure prevail. 6. Images labelled “Made with AI” are generated with artificial intelligence tools, are illustrative and do not depict real people or events. 7. The Cyber Check-up is a self-assessment: its results and suggestions depend on the answers given and do not replace a technical review, an audit or a certification.