Cybersecurity grants in Italy: what they fund and how to choose a supplier

A cybersecurity grant pays part of the cost, but it does not guarantee that the money makes the company any safer. The result depends on three choices that the grant does not make for the business: what to protect first, which tools are really needed, and who configures them and looks after them once the spending has been reported to the funder. Before signing, then, it pays to read carefully what the scheme covers and to ask the supplier a few precise questions. Companies that skip them risk closing the project on paper while remaining as exposed as before.

Which schemes fund cybersecurity?

The picture changes often. The summary below is up to date as of 16 September 2026 and covers the Italian schemes most relevant to small and medium-sized enterprises.

The ministry’s voucher has a total budget of 150 million euros, with a share reserved for the southern regions (the Mezzogiorno). It falls under the de minimis regime, which covers the small amounts of public aid that each company may receive within a ceiling calculated over three years. The maximum amount per company and the minimum spend are set by the decree and should be checked in the official text. These are Italian schemes. For companies based in San Marino the framework is different and must be assessed case by case.

And in groups with several companies? The schemes are designed for small and medium-sized enterprises, and size is not measured on the single company. Under the EU definition of an SME, linked and partner enterprises also count. A small company controlled by a large group is usually not an SME. The de minimis ceiling is also calculated on the “single undertaking”, meaning all the companies linked by relationships of control. Splitting a project artificially across several group companies to stay within the limits is not allowed. The check is done with the adviser handling the application, before it is submitted.

What does the voucher pay for, and what does it not?

The ministry’s voucher is designed above all for buying tools, such as security appliances and software, cloud services and subscription applications. Professional services are eligible up to 30% of the spending plan, and only if they are linked to the tools purchased. The ministry’s FAQs specify that these are operational and technical services, as distinct from consulting. They exclude both pure consulting, meaning theoretical assessments not followed by an installation, and training.

The practical consequence matters. The analysis that should decide which tools are needed is not covered by this scheme. It has to be done beforehand, with the company’s own resources or with other grants, such as the chamber of commerce vouchers that allow consulting and training. Whoever skips this step risks buying what can be funded instead of what is needed.

A typical scenario. A distribution company uses the grant to buy a new firewall and an antivirus subscription. The firewall keeps its factory settings, nobody reads the antivirus alerts, and the data backups sit on the same server they are supposed to protect. The grant paperwork is in order, and the risk is exactly what it was. Doing backups properly is the subject of Grandad’s backup.

Then there is life after the grant. When the funded period ends, the subscriptions are paid in full. The cost of the following years has to go into the budget before signing, rather than being discovered at the first renewal.

Where should you start, before applying?

The right order is the opposite of the one that the rush to the application desk suggests.

1. Understand what cannot stop. Identify which services these are, the longest each can be down and how much data you are prepared to lose. These are the two business continuity measures: RTO, the maximum tolerable downtime, and RPO, the acceptable data loss.
2. Know where you are exposed. Look at systems reachable from the internet, supplier access, privileged accounts and passwords circulating outside the company. The external signals say a great deal even before a test.
3. Choose the tools based on the risks, and only then check which of them can be funded.
4. Choose the supplier using the questions below.
5. Check the result once the installation is complete, with documented tests.

What should you ask the supplier before signing?

Here is a list to print out and take to the meeting.

1. Is the supplier on the list of approved providers for this scheme, and for which categories? The list is public and can be consulted on the Invitalia portal.
2. Who actually does the work? Ask about roles and location, and about what is subcontracted to others.
3. Which analysis is the proposal based on? Ask which systems, data and processes the supplier examined before recommending the tools.
4. What is left with you at handover? Expect documented configurations, administrative accounts in the company’s name, a procedure for handling alerts and verified backups.
5. Who reads the tools’ alerts after installation, how quickly, and with which responsibilities written into the contract?
6. How much do renewals and support cost once the period covered by the grant is over?
7. How will you prove that it works? Examples are a test restore from the backups, or a technical check after installation such as a penetration test on an agreed scope.
8. What evidence can the supplier show? If the supplier mentions certifications, ask for the number, the body that issued them, the activities covered and the expiry date. A certification covers the processes listed on the certificate, not every service the company offers.

How can you tell a project done only for the paperwork?

Some signs come up again and again.

• The proposal is built around the maximum amount of the grant, not around the company’s systems.
• Nobody asks what data is processed, which services are critical or what a day of downtime would cost.
• The delivery consists of an invoice and a sign-off report, with no operational documents.
• No final test is planned.
• After the project closes, nobody is tasked with reading alerts and logs.

The same applies to projects meant to meet the requirements of NIS2, the EU directive on network and information security. A procedures document without checks on the systems remains just a document. There is no certificate attesting that a company meets the directive as a whole.

In brief

• A public grant lowers the cost. Security depends on analysis, configuration and control over time.
• The MIMIT voucher mainly funds tools and cloud services. Related technical services are eligible up to 30% of the plan, while pure consulting and training are excluded.
• The vouchers of the chambers of commerce that take part in the initiative also cover consulting and training, with rules that vary from one chamber to another.
• For the ministry’s scheme, the supplier must be on the public list.
• The risk analysis comes before the application, and the check on the result comes after the installation.
• Eight questions for the supplier separate a useful project from one done only for the paperwork.

Frequently asked questions

Does the ministry’s voucher also cover security consulting?

It covers only technical services linked to the tools purchased, such as configuration and support, up to 30% of the spending plan. The MIMIT FAQs exclude pure consulting, meaning assessments not followed by an installation, and training. The vouchers of the chambers of commerce taking part in the Doppia Transizione call, by contrast, do cover specialist consulting and training.

Can you choose any supplier?

Not for the ministry’s voucher. Products and services must be bought from suppliers on the list of approved providers, which can be consulted on the Invitalia portal, and only within the categories for which they are registered. For chamber of commerce and regional calls, the rules of each call apply, and they should be read before asking for quotes.

Can a company based in San Marino take part?

The schemes described are Italian and are open to companies that meet the requirements set by each call. For companies based in San Marino the framework is different and must be assessed case by case, with your own accountant.

Is a funded project enough to meet NIS2 requirements?

Not on its own. NIS2 requires technical and organisational measures, accountability at the top, oversight of suppliers and procedures for reporting incidents. Tools bought with a grant can cover part of the technical measures, but they have to be built into a plan and checked.

A risk analysis before choosing the tools, a technical check after installation and a plan for handling incidents are all part of the work of Strategic’s Cybersecurity division, which works with the company’s IT team and with the suppliers already in place.

Sources

Consulted on 16 September 2026.

• MIMIT, Sostegno alla domanda di servizi di cloud computing e cyber security (in Italian)
• MIMIT, Directorial Decree of 4 August 2026, terms and procedures for submitting applications (in Italian)
• MIMIT, Directorial Decree of 29 July 2026, list of approved providers (in Italian)
• MIMIT, Risposte alle domande frequenti, FAQs on the cloud computing and cyber security voucher (in Italian)
• Invitalia, list of approved suppliers (in Italian)
• Punto Impresa Digitale, Bando Voucher Doppia Transizione 2026 (in Italian)
• Incentivi.gov.it, the MIMIT incentives portal (in Italian)
• Legislative Decree 138 of 4 September 2024 (Italy’s NIS2 law), Normattiva (in Italian)