The Voucher Cloud & Cybersecurity supports demand for cloud computing and cyber security services from SMEs and self-employed workers, against the acquisition of technology solutions that are new and additional to those already available and/or more advanced and secure than those in use. The measure is governed by the ministerial decree of 18 July 2025 and funded from the 2014-2020 Development and Cohesion Fund. Dates, requirements and types are also summarised on the measure page.
Grants available
Grants take the form of a non-repayable contribution, under the de minimis regulation, equal to 50% of eligible expenses and for an amount not exceeding EUR 20,000. Expenses connected to the plan must not be below EUR 4,000. A EUR 40,000 spending plan exhausts the ceiling.
The measure is endowed with EUR 150 million, of which EUR 71,065,813.34 is reserved for operations in Abruzzo, Basilicata, Calabria, Campania, Molise, Puglia, Sardinia and Sicily. Access to the reserve depends on the location of the local unit where the spending plan mainly takes effect, as stated in the application.
Ministerial decree of 18 July 2025, articles 3, 5 and 6; directorial decree of 4 August 2026, article 2(2) and (3), and article 4.
Application deadlines and procedures
The directorial decree of 4 August 2026 sets out two phases:
- Compiling the application, from 12:00 on 20 October 2026. You access the procedure with SPID, CNS or CIE, enter the data and attachments, generate the form as a non-editable PDF, apply a digital signature and upload it again, obtaining the application preparation code.
- Submitting the application, from 12:00 on 10 November 2026 to 12:00 on 20 January 2027, by entering that code. On submission the platform issues the unique project code (CUP), which must appear on every expense document.
Grants are awarded through an assessment procedure operated as a rolling window, in chronological order of submission. Each applicant may submit only one application. The procedure is described in detail in the guide to submitting the application.
The application is written in Italian and submitted by the applicant or by a person delegated to compile it, exclusively through the Ministry's online procedure, on pain of invalidity and inadmissibility. If applications exhaust the resources before 20 January 2027, the Ministry announces it and closes the window: applications submitted in the meantime without financial cover are suspended and, absent further resources, are treated as lapsed.
On 8 October 2026 the Ministry published, on the official page of the measure, the documents for the application and its attachments. They are the template of the application form, the template of the supplier's offer and the model self-declaration (DSAN) on catastrophe insurance. The offer template is not mandatory, but the information it contains is: its content is described in the guide to the supplier's offer.
Directorial decree of 4 August 2026, article 5(1), (2), (6) and (7), and article 6(1); ministerial decree of 18 July 2025, article 7(1) and (5), and article 8(1); template of the supplier's offer, opening note.
Beneficiaries and eligibility requirements
Grants are available to SMEs and self-employed workers operating throughout national territory which, when the application is submitted, hold a contract for connectivity services with a minimum download speed of 30 Mbps. All SMEs are eligible regardless of legal and organisational form, as are all self-employed workers regardless of role and activity.
Businesses must also be duly incorporated, registered in the Business Register and active; in full and free exercise of their rights, not in voluntary liquidation nor subject to insolvency proceedings for liquidation purposes; compliant with insurance obligations covering damage directly caused by natural disasters and catastrophic events, under article 1(101) of law 213 of 30 December 2023 and decree-law 39 of 31 March 2025; not recipients of aid identified by the European Commission as unlawful or incompatible and neither repaid nor deposited in a blocked account; and not active in the sectors excluded by the de minimis regulation. Self-employed workers not required to register in the Business Register must hold a VAT number, be enrolled in the relevant professional register where the activity requires it, and meet the other requirements of paragraph 2 insofar as compatible.
The following are excluded in any case: entities subject to the disqualification penalty of article 9(2)(d) of legislative decree 231 of 8 June 2001, or to another penalty barring contracts with the public administration; entities whose legal representatives or directors, on the date the application is submitted, have been convicted by final judgment or irrevocable criminal decree for offences that exclude an operator from public procurement or concession procedures; and entities in other conditions that the law treats as barring them from public financial aid.
Entities on the supplier list may also apply, provided they acquire the services from suppliers other than themselves and included in the list.
In the application form the requirements are declared through formal self-declarations (dichiarazioni sostitutive). For the insurance obligation, SMEs also attach the self-declaration (DSAN) on catastrophe insurance, and compliance is checked again at disbursement: the subject is covered in the guide to catastrophe insurance. The form also requires the applicant to declare that it is up to date with social security contributions, which is checked at disbursement when the DURC certificate is acquired ex officio.
Ministerial decree of 18 July 2025, article 4(1), (2), (3) and (4); directorial decree of 4 August 2026, article 3 and article 7(5)(c) and (d); application form, declarations (e) and (k) and attachments; DSAN on catastrophe insurance, point 4; official MIMIT FAQ, section 2, no. 30.
Eligible products and services
Spending plans must provide for the acquisition of products and services supplied by entities on the official list, across five macro-categories. The macro-categories are exhaustive; the products and services listed under each are examples, not an exhaustive list.
- A. Cybersecurity hardware: firewalls; next-generation firewalls (NGFW); routers/switches; intrusion prevention devices (IDS/IPS).
- B. Cybersecurity software: antivirus and antimalware; network monitoring software; data encryption solutions; security information and event management systems (SIEM); vulnerability management software.
- C. Infrastructure (IaaS) and platform (PaaS) cloud services: virtual machines; storage and backup services; network and security, including VPN connectivity and DDoS services; databases.
- D. SaaS cloud services: accounting; human resources management (HRM); ERP and workflow, including solutions with integrated artificial intelligence features; CMS and e-commerce; CRM, including collaboration and virtual switchboard. Systems that deliver training are also included, with only the costs relating to training content excluded.
- E. Configuration, monitoring and ongoing support services, including professional services, excluding training services for beneficiaries.
Macro-category E services are eligible up to a maximum of 30% of the total spending plan and must be connected to one or more of the other services identified in the plan, being understood as ancillary services serving the aims of the measure.
The official answers to frequently asked questions specify that on-premise software is eligible only in macro-category B, while ERP and CRM are eligible only as SaaS cloud services; that buying generic hardware, such as a server, does not count as a cybersecurity hardware solution; and that professional services in macro-category E are operational and technical services tied to implementing and running the solutions, excluding pure consultancy.
Directorial decree of 21 November 2025, article 5; directorial decree of 4 August 2026, article 4(2); official MIMIT FAQ, section 1, nos. 13, 18, 19, 20 and 36.
Ineligible expenses
Not eligible: products and services performing equivalently to those already in use; version updates that do not simultaneously deliver a substantial improvement, for instance through new automation or artificial intelligence features; extension of a licence already held, or an increase in the number of licensed seats or user accounts.
Ministerial decree of 18 July 2025, article 5(4); directorial decree of 4 August 2026, article 4(3).
Identification codes
Each type of product and service for which an approved supplier is admitted carries an identification code, shown in the published list. The code combines the supplier's identifier with the type abbreviation: in the example given in the official FAQ, supplier VCCFA2600009999 offers services of type C.1 Virtual machine under the code VCCFA2600009999-C1, which may cover several services of the same type.
The identification code must be stated in the application for each chosen service or product, must appear on the offers attached to the application, and must appear on every expense document submitted with the disbursement request.
In the offer template the codes appear in the section "Descrizione prodotti e servizi offerti" (description of the products and services offered) and in the "Quadro economico" (cost breakdown), as explained in the guide to the supplier's offer. The identification codes of our services, built on the identifier VCCFA2600000933, are listed on the measure page. Within the types we are accredited for we also supply other manufacturers' products, including vendors not on the list, always under our own code, as set out in the official MIMIT FAQ (in Italian; section 1, nos. 42, 44, 46 and 50).
Directorial decree of 4 August 2026, article 5(3)(e) and (4)(a), and article 7(4)(a); official MIMIT FAQ, section 1, no. 41; template of the supplier's offer, sections A and C.
Acquisition methods and durations
- Direct purchase. Expenses must be incurred within 12 months from the date of notification of the award; the related payments must also fall within that term. Advance invoices are admitted, provided they come after the application is submitted. A contract for SaaS cloud services may also be treated as a direct purchase.
- Subscription. The term cannot be less than 24 months and eligible expenses correspond to the fees falling within that period; fees beyond it are not eligible.
- The two methods may be combined, but switching the acquisition method between direct purchase and subscription relative to the application is not permitted.
Plans must begin after the date the application is submitted. For a subscription, the contract must be signed after the application is submitted and no later than 30 days from notification of the award; within 60 days of the same date, notification that it has been signed must be transmitted through the online procedure, on pain of forfeiting the grant.
In the application form the applicant declares that it has not yet started the programme on the date of submission. The programme counts as started if any of the following has occurred:
- legally binding commitments have been made, including signing a contract, issuing order confirmations or any other commitment that makes the programme irreversible;
- invoices have been issued for one or more of the items making up the programme;
- payments, including deposits, have been made for one or more of those items.
Expenses incurred before the application is submitted cannot be funded.
Directorial decree of 4 August 2026, article 4(4) and (5), and article 8(4); ministerial decree of 18 July 2025, article 5(3); application form, declaration (i) and note 2; official MIMIT FAQ, section 1, no. 40, and section 2, no. 25.
Assessment, award and disbursement
The Ministry, supported by Invitalia, assesses applications in chronological order, verifying that the documentation is complete, that the requirements are met, that the chosen suppliers appear on the list and that the services match the spending plan. Assessment is completed within 60 days of the date the application is submitted, subject to longer terms where grounds for refusal are notified and to suspensions for further inquiry. The Ministry may request clarifications or additional documents, which must arrive within the stated term, on pain of the application lapsing.
Disbursement is made in no more than two tranches, the first once at least 50% of the plan has been incurred and the second on completion, or as a single tranche on completion. Disbursement cannot be requested earlier than 3 months after notification of the award. The request for the second and final tranche, or for the single tranche, must be submitted within 30 days of the deadline for completing the spending plan. Expense documents must carry the CUP and the identification code assigned to each funded service or product.
Early withdrawal from a subscription and a change of the subscription's supplier must be reported promptly through the online procedure. They interrupt the benefit from the date of withdrawal or change and forfeit any residual contribution connected to that subscription; failing to report them promptly is a ground for revoking the grant. Outside subscriptions, a change of the supplier named in the application is reported with the disbursement request and assessed at that stage.
Ministerial decree of 18 July 2025, articles 8, 9, 10 and 12; directorial decree of 4 August 2026, articles 6, 7 and 8.
The voucher and NIS 2 alignment
Several technical security measures correspond to eligible types: perimeter protection, monitoring of networks and security events, vulnerability management, storage and backup, data encryption. The voucher funds purchases and certifies no regulatory compliance, but it can reduce the cost of the technology component of a NIS 2 alignment programme. The subject is covered in the article on the voucher and the NIS 2 baseline.
Legal references
- Ministerial decree of 18 July 2025, rules governing support for demand for cloud computing and cyber security services.
- Directorial decree of 21 November 2025, formation of the list of approved entities and Annex 1 on certifications by category.
- Directorial decree of 29 July 2026, definition of the list of approved entities.
- Directorial decree of 4 August 2026, application deadlines and procedures.
- MIMIT, templates of the application form and of the supplier's offer, and model self-declaration on catastrophe insurance, published on 8 October 2026.
- MIMIT, official answers to frequently asked questions, section 1 (supplier list) and section 2 (beneficiaries and access requirements).
This article is current as of October 2026 and does not replace the official texts. Check the decrees and the documentation published by the Ministry before submitting an application.
