--- title: MIMIT cloud and cybersecurity voucher description: "Non-repayable grant of 50% up to EUR 20,000 for SMEs and self-employed workers: deadlines, requirements, eligible products and services." canonical: https://www.aegister.com/en/voucher-cloud-cybersecurity/ url: /en/voucher-cloud-cybersecurity/ lang: en --- ![](https://www.aegister.com/static/images/header.webp) # MIMIT cloud and cybersecurity voucher A non-repayable grant for SMEs and self-employed workers buying cloud computing and cybersecurity services: requirements, deadlines and eligible categories. ## How it works From application to payment: the stages and deadlines set by the decrees, in the two acquisition modes. Direct purchase Subscription The mode stated in the application cannot be changed after submission (decreto direttoriale of 4 August 2026, article 8). Diagram: The voucher stages: compilation, submission in chronological order, istruttoria and concessione; then direct purchase within the set term, or signature of the subscription and notice of signature; finally the request for payment. An illustration of the deadlines set by the decrees. ## Application deadlines and procedures The procedure has two distinct phases: compiling the application and submitting it. 20 October 2026, 12:00 ### Compiling the application Access to the procedure, entry of the data, generation of the form as a non-editable PDF, digital signature and issue of the application preparation code. 10 November 2026, 12:00 ### Submitting the application Entry of the application preparation code and issue of the submission receipt, carrying the unique project code (CUP). 20 January 2027, 12:00 ### Window closure Unless earlier notice is given that the available financial resources are exhausted. Grants are awarded through an assessment procedure operated as a rolling window, in chronological order of submission. Compiling is not submitting: position depends on when the application is sent. Directorial decree of 4 August 2026, article 5; ministerial decree of 18 July 2025, article 7. ### Forms The Ministry has published the template of the application form, the template of the supplier's offer and the model self-declaration on catastrophe insurance to attach to the application. - [Template of the application form](https://www.mimit.gov.it/images/stories/moduli/Fac-simile-Format-Domanda-VCC.pdf) - [Template of the supplier's offer](https://www.mimit.gov.it/images/stories/moduli/Fac-simile-Offerta-Fornitore-VCC.pdf) - [Self-declaration on catastrophe insurance](https://www.mimit.gov.it/images/stories/moduli/DSAN-polizza-catastrofale-VCC.docx) [Full guide to submitting the application](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-how-to-submit-the-application/) ## Grants available 50% of eligible expenses 20,000 euro maximum grant 4,000 euro, minimum eligible expenditure 30% cap on professional services Grants take the form of a non-repayable contribution, under the de minimis regulation, equal to 50% of eligible expenses and for an amount not exceeding EUR 20,000. Eligible expenses must not be below EUR 4,000. A spending plan of EUR 40,000 exhausts the ceiling. The measure is endowed with EUR 150,000,000, of which EUR 71,065,813.34 is reserved for operations in Abruzzo, Basilicata, Calabria, Campania, Molise, Puglia, Sardegna, Sicilia. Ministerial decree of 18 July 2025, articles 3, 5 and 6; directorial decree of 4 August 2026, article 4. ### The 30% limit on professional services Configuration, monitoring and ongoing support services are eligible up to a maximum of 30% of the total spending plan and must be connected to one or more of the plan's other services. The remaining share, at least 70%, therefore covers products and services in the other macro-categories. | Spending plan | Grant | Maximum services (30%) | Minimum other categories (70%) | | --- | --- | --- | --- | | 4,000 € | 2,000 € | 1,200 € | 2,800 € | | 10,000 € | 5,000 € | 3,000 € | 7,000 € | | 20,000 € | 10,000 € | 6,000 € | 14,000 € | | 40,000 € | 20,000 € | 12,000 € | 28,000 € | ## Eligible products and services Spending plans must provide for the acquisition of products and services supplied by the entities on the official list, divided into five macro-categories and 23 types. ### ACybersecurity hardware - A1 Firewall - A2 Next-generation firewall (NGFW) - A3 Router/switch - A4 Intrusion prevention devices (IDS/IPS) - A9 Other Certifications required of the supplier for this category: ISO 9001, ISO/IEC 27001 ### BCybersecurity software - B1 Antivirus and antimalware - B2 Network monitoring software - B3 Data encryption solutions - B4 Security information and event management systems (SIEM) - B5 Vulnerability management software - B9 Other Certifications required of the supplier for this category: ISO 9001, ISO/IEC 27001 ### CInfrastructure and platform cloud services (IaaS and PaaS) - C1 Virtual machines - C2 Storage and backup services - C3 Network and security (including VPN connectivity and DDoS services) - C4 Databases - C9 Other Certifications required of the supplier for this category: ISO 9001, ISO/IEC 27001 con estensione ISO/IEC 27017 (ovvero CSA STAR Level 2) ### DSaaS cloud services - D1 Accounting software - D2 Human resources management solutions (HRM) - D3 Productivity/workflow management systems (ERP), including business productivity solutions with integrated artificial intelligence features - D4 Digital content management (CMS) and e-commerce software - D5 Customer interaction management tools (CRM) including, among others, collaboration services and virtual switchboard (UCC and PABX) - D9 Other Certifications required of the supplier for this category: ISO 9001, ISO/IEC 27001 con estensione ISO/IEC 27017 (ovvero CSA STAR Level 2) ### EProfessional configuration, monitoring and ongoing support services max 30% of the plan - E1 Professional configuration, monitoring and ongoing support services Certifications required of the supplier for this category: ISO 9001, ISO/IEC 27001 ### Ineligible expenses - Products and services performing equivalently to those already in use by the beneficiary. - Version updates of a service or product already in use that do not simultaneously deliver a substantial improvement, for instance through new automation or artificial intelligence features. - Extension of a licence already held, or an increase in the number of licensed seats or user accounts. - Training services for beneficiaries; for systems that deliver training, only the costs relating to the training content are excluded. Directorial decree of 4 August 2026, article 4(2) and (3); directorial decree of 21 November 2025, Annex 1. ## Beneficiaries and eligibility requirements Grants are available to SMEs and self-employed workers operating throughout national territory which, at the time the application is submitted, hold a contract for the supply of connectivity services with a minimum download speed of 30 Mbps. All SMEs are eligible regardless of legal and organisational form, as are all self-employed workers regardless of role and activity. - Duly incorporated, entered in the Companies Register and active; self-employed workers not required to register must hold a VAT number and, where the profession requires it, be registered with the relevant professional body. - In full and free exercise of their rights, not in voluntary liquidation nor subject to insolvency proceedings for liquidation purposes. - Compliant with the obligation to insure against damage caused by natural disasters and catastrophic events (law no. 213 of 30 December 2023, article 1, paragraph 101, and decree-law no. 39 of 31 March 2025). For SMEs, compliance with the insurance obligation is attested by the self-declaration attached to the application and checked again at disbursement. - Not among businesses that have failed to repay aid declared unlawful or incompatible by the European Commission. - Not active in the sectors excluded by article 1 of the de minimis regulation. - Not subject to disqualification sanctions or other sanctions barring contracts with the public administration, with no legal representative or director convicted by final judgment of offences that exclude from public procurement, and in no other condition that the law treats as barring access to public aid. - A connectivity contract with a download speed of at least 30 Mbps, active at the moment of submission. Ministerial decree of 18 July 2025, article 4; directorial decree of 4 August 2026, article 3. [Catastrophe insurance and self-declaration](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-catastrophe-insurance/) The application is rejected if the National State Aid Register shows that the de minimis ceiling has been exceeded. Directorial decree of 4 August 2026, article 6, paragraph 4. In the application form the applicant also declares its size, with headcount, turnover and balance sheet total. It also declares that it has not started the spending programme and that it is up to date with social security contributions, which are checked through the DURC at disbursement. Application form, declarations a), i) and k); directorial decree of 4 August 2026, article 7, paragraph 5. Entities on the official list may also apply, provided the services requested are acquired from suppliers other than the applicant and included in the list. ## Eligible spending plans and acquisition methods ### Direct purchase: 12 months from the award Expenses must be incurred within 12 months from the date of notification of the award; the related payments must also be made within the same term. Advance invoices are admitted, provided they come after the application is submitted. Directorial decree of 4 August 2026, article 4(4) ### Subscriptions: at least 24 months Eligible costs are the fees falling within the 24-month period. For longer subscriptions, the fees beyond it are not eligible. The spending plan states the sum of the fees for the first 24 months as given in the offer. Directorial decree of 4 August 2026, article 4, paragraph 4; official MIMIT FAQ, section 2, no. 34 ### Professional services within 30% Configuration, monitoring and ongoing support services are eligible up to a maximum of 30% of the total spending plan and must be connected to one or more of the plan's other services. Training services for beneficiaries are excluded. Directorial decree of 4 August 2026, article 4(2)(e) ### Signature within 30 days, notification within 60 The subscription must be signed within 30 days of notification of the award and notification that it has been signed transmitted within 60 days, on pain of forfeiting the grant. Directorial decree of 4 August 2026, article 4(5) ### Expenses after the application is submitted Spending plans must start after the application is submitted. The programme counts as started if the company has entered into legally binding commitments, such as a contract or an order confirmation, if invoices have been issued or if payments have been made, deposits included. The acquisition mode stated in the application cannot be switched from direct purchase to subscription or vice versa. Directorial decree of 4 August 2026, articles 4 and 8; application form, declaration i) ### One application per applicant Each applicant may submit only one application. Ministerial decree of 18 July 2025, article 7(5) ## Aegister services and identification codes The codes to enter in the offer and in the application for our services. All of them are delivered through Cyber Console. | Identification code | Service | Type | | --- | --- | --- | | VCCFA2600000933-A1 | [Threat Blocker](https://www.aegister.com/en/solutions/atb/)A1 Firewall | A1 Firewall | | VCCFA2600000933-B2 | [Threat Intelligence](https://www.aegister.com/en/solutions/threat-intelligence/)B2 Network monitoring software | B2 Network monitoring software | | VCCFA2600000933-C3 | [VPN](https://www.aegister.com/en/solutions/vpn/)C3 Network and security (including VPN connectivity and DDoS services) | C3 Network and security (including VPN connectivity and DDoS services) | | VCCFA2600000933-C3 | [Cloud Defender](https://www.aegister.com/en/solutions/cloud-defender/)C3 Network and security (including VPN connectivity and DDoS services) | C3 Network and security (including VPN connectivity and DDoS services) | | VCCFA2600000933-D9 | [NIS 2 incident notification](https://www.aegister.com/en/solutions/compliance/nis2/incident-notification/)D9 Other (SaaS cloud services) | D9 Other (SaaS cloud services) | | VCCFA2600000933-D9 | [NIS 2 compliance](https://www.aegister.com/en/solutions/compliance/nis2/)D9 Other (SaaS cloud services) | D9 Other (SaaS cloud services) | | VCCFA2600000933-D9 | [NIS 2 documentation audit](https://www.aegister.com/en/solutions/compliance/nis2/documentation-audit/)D9 Other (SaaS cloud services) | D9 Other (SaaS cloud services) | | VCCFA2600000933-D9 | [ISO 27001 certification path](https://www.aegister.com/en/solutions/compliance/iso27001/)D9 Other (SaaS cloud services) | D9 Other (SaaS cloud services) | | VCCFA2600000933-D9 | [Integrated ISO 27001 + NIS 2 management](https://www.aegister.com/en/solutions/compliance/)D9 Other (SaaS cloud services) | D9 Other (SaaS cloud services) | | VCCFA2600000933-D9 | [Log analysis](https://www.aegister.com/en/solutions/log-analysis/)D9 Other (SaaS cloud services) | D9 Other (SaaS cloud services) | | VCCFA2600000933-D9 | Integrated assessmentD9 Other (SaaS cloud services) | D9 Other (SaaS cloud services) | | VCCFA2600000933-E1 | [Virtual CISO](https://www.aegister.com/en/solutions/virtual-ciso/)E1 Professional configuration, monitoring and ongoing support services | E1 Professional configuration, monitoring and ongoing support services | Services of type E.1 are eligible up to 30% of the spending plan and must be connected to other products or services in the plan. One code can cover several services of the same type. The type labels reproduce those of the supplier list (our translation) and name the category, not what the service does. ### Products of other manufacturers Besides the services in the table we supply hardware and software from other manufacturers, including vendors not on the list, within the types we are accredited for: for example firewalls and next-generation firewalls, intrusion prevention systems, antimalware, cloud backup and SaaS software. The offer and the application carry our identification code for the corresponding type. This is set out in the [official MIMIT FAQ](https://www.mimit.gov.it/it/assistenza/domande-frequenti/sostegno-domanda-servizi-di-cloud-computing-e-cyber-security-risposta-alle-domande-frequenti-faq) (in Italian): a supplier accredited for a type may offer third-party products and services, including those of vendors not on the list and on their own (section 1, nos. 42, 44 and 46); when the seller and invoicing party is a supplier accredited for that type, the offer and the application carry its code (section 1, no. 50). The measure's limits still apply: no generic hardware such as servers, ERP and CRM only as SaaS, no product with performance similar to what is already in use. Official MIMIT FAQ, section 1, nos. 18, 36, 42, 44, 46 and 50; section 2, no. 22. Services Aegister indicated in its application to the list of authorised suppliers (directorial decree of 29 July 2026); directorial decree of 4 August 2026, article 4, paragraph 2; official MIMIT FAQ, section 1, no. 41. ## The offer for the voucher Aegister S.p.A. is an approved supplier, on the list with identifier VCCFA2600000933 (directorial decree of 29 July 2026). In the application and in the offers, each product or service is given the identification code assigned by the list, which joins the supplier identifier and the type: the official FAQ give the example VCCFA2600009999-C1. The offer attached to the application is signed by the supplier. For each product or service it states the identification code, the description and the cost items, the purchase mode and, for subscriptions, duration and fees. It also describes the applicant's starting position and the guaranteed upgrade, or states that the new product or service is not already available to the applicant. Purchase modes: A direct purchase; B subscription; C combination of the two. Directorial decree of 4 August 2026, article 5, paragraph 4; template of the supplier's offer; official MIMIT FAQ, section 2, no. 35. We prepare the offer in the format the measure requires. The Cyber Check-up describes your current security position and identifies the priorities; at the end you can book a meeting with us, in which we define the services and prepare the offer. [Start the Cyber Check-up](https://www.aegister.com/en/assessment/?source=voucher) [Offer request](https://www.aegister.com/en/contact/?source=voucher) [What the supplier's offer contains](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-supplier-offer/) ## Frequently asked questions ### When can the application be submitted? Pre-compilation opens at 12:00 on 20 October 2026. Submission runs from 12:00 on 10 November 2026 to 12:00 on 20 January 2027, unless resources are exhausted earlier (directorial decree of 4 August 2026, article 5). ### How much is the grant? The non-repayable grant is 50% of eligible expenses and cannot exceed EUR 20,000. Eligible expenses must not be below EUR 4,000; a EUR 40,000 plan exhausts the ceiling (ministerial decree of 18 July 2025, articles 5 and 6). ### How are the resources allocated? Grants are awarded through an assessment procedure operated as a rolling window, in chronological order of submission. There is no comparative assessment between projects (ministerial decree of 18 July 2025, article 7). ### Are professional services fundable? Yes, up to a maximum of 30% of the total spending plan, and they must be connected to one or more of the plan's other services. Training services for beneficiaries are excluded (directorial decree of 4 August 2026, article 4). ### Does the supplier have to be on the official list? Yes. Spending plans must cover products and services supplied by the entities on the list of approved suppliers published by the Ministry (directorial decree of 29 July 2026). ### How long must a subscription run? Not less than 24 months. If the term is longer, eligible expenses are limited to those attributable to the first 24 months of the subscription (ministerial decree of 18 July 2025, article 5). ### When does the 12-month direct purchase period start? From the date the grant award is notified. The related payments must also be made within the same period (directorial decree of 4 August 2026, article 4). ### Which deadlines run from the award? The subscription must be signed within 30 days of notification of the award, and notification that it has been signed must be transmitted within 60 days, on pain of forfeiting the grant (directorial decree of 4 August 2026, article 4). ### Can more than one application be submitted? No. Each applicant may submit only one application (ministerial decree of 18 July 2025, article 7; directorial decree of 4 August 2026, article 5). ### What are the eligibility requirements? SMEs and self-employed workers operating in Italy with a connectivity contract of at least 30 Mbps download, duly incorporated and active, not in voluntary liquidation nor subject to insolvency proceedings aimed at liquidation, compliant with the catastrophe insurance obligation and not excluded by sanctions or convictions (ministerial decree of 18 July 2025, article 4). The application is rejected if the National State Aid Register shows the de minimis ceiling has been exceeded (directorial decree of 4 August 2026, article 6, paragraph 4). ### What is needed to fill in the application? A SPID, CIE or CNS identity, an active certified email (PEC) and the digital signature of the legal representative or of a special attorney. You also need the description of the starting position and of the expected improvement, the suppliers' offers with identification codes and cost items and, for SMEs, the self-declaration on catastrophe insurance (official MIMIT FAQ, section 2, nos. 30 and 32; directorial decree of 4 August 2026, article 5). ### What must the supplier's offer contain? The offer is signed by the supplier. For each product or service it states the identification code assigned by the list, the supplier, the description and the cost items, the purchase mode and, for subscriptions, duration and fees. It also describes the applicant's starting position and the guaranteed upgrade, or states that the new product or service is not already available to the applicant (directorial decree of 4 August 2026, article 5, paragraph 4; template of the supplier's offer; official MIMIT FAQ, section 2, no. 35). ### How is the catastrophe insurance declared? For SMEs, with the self-declaration (DSAN) attached to the application on the Ministry's model, in which the legal representative declares the company's position on the obligation, for example the policy taken out with its number, insurer and date. Compliance is checked again at disbursement (directorial decree of 4 August 2026, article 5, paragraph 3, letter i), and article 7, paragraph 5, letter d); official MIMIT FAQ, section 2, no. 30). ### Must contribution compliance be declared? Yes, with declaration k) of the application form, of being up to date with social security contributions. At disbursement the Ministry obtains the DURC ex officio for businesses (directorial decree of 4 August 2026, article 7, paragraph 5, letter c). ### Can the voucher be combined with other incentives? Grants are awarded under the de minimis regulation and may be combined with other State aid, including de minimis, within the limits set by the relevant European rules (ministerial decree of 18 July 2025, article 6). ### When is the grant paid? The grant is paid on request in two instalments, or in a single instalment once the spending plan is completed. The first instalment can be requested after at least 50% of the approved plan has been spent, and no payment can be requested before 3 months from the notice of the grant decision. The request for the last or single instalment must be filed within 30 days of the deadline for completing the plan (directorial decree of 4 August 2026, article 7). The information on this page is updated to October 2026 and does not replace the official texts. Before submitting the application, always check the decrees and the documentation published by MIMIT. ## Insights on the measure Practical guides on the cloud and cybersecurity voucher and the obligations it funds. [![Small business owner preparing a funding application](https://www.aegister.com/static/images/cms/theme-sme-funding.webp) Made with AI 16 Oct 2026 ### Cloud and cybersecurity voucher: how to check the approved supplier The cloud and cybersecurity voucher funds only purchases from approved suppliers. Who can be one, how the list is consulted, what codes and types tell you, resellers, integrators and linked suppliers, and the questions to ask a supplier before signing the application.](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-approved-supplier-check/) [![Small business owner preparing a funding application](https://www.aegister.com/static/images/cms/theme-sme-funding.webp) Made with AI 14 Oct 2026 ### Cloud and cybersecurity voucher: eligible costs, case by case What the cloud and cybersecurity voucher can buy, case by case: servers, ERP and CRM, SaaS, e-learning, artificial intelligence, professional services, VPNs, third-party products and MSP licences, with the official MIMIT FAQ answer and the condition attached to it.](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-eligible-costs/) [![Catastrophe insurance and the cloud and cybersecurity voucher: the self-declaration to attach](https://www.aegister.com/static/images/cms/theme-policy-binder.webp) Made with AI 08 Oct 2026 ### Catastrophe insurance and the cloud and cybersecurity voucher: the self-declaration to attach For the Cloud & Cybersecurity Voucher, the business declares in its application that it complies with the catastrophe insurance obligation and attaches a self-declaration (DSAN). This guide explains the requirement, the three boxes of the DSAN, the deadlines by business size, leased or rented assets and the check at disbursement stage.](https://www.aegister.com/en/cms/insights/cloud-cybersecurity-voucher-catastrophe-insurance/)