EU Funding & Tenders Portal · EOI-ECCC-2027-DIGITAL-DEPLOY-CYBER-12-CEI-CBCH

Cross-Border Cyber Hubs

Code: EOI-ECCC-2027-DIGITAL-DEPLOY-CYBER-12-CEI-CBCH
Programme: 52395851
Status: Open
Opens: 2026-10-15
Deadline: 2027-03-16 (148 days left; time on the official page)
Budget: 3 000 000 €

Prepare an application Official call page Add to calendar

Key dates

2026-10-15Opens
2027-03-16Deadline

Eligibility check

No verified eligibility rules for this call yet. See the official guidelines.

Description

Objective:

The general objective of “Cross-Border Cyber Hub platforms” is to strengthen capacities to analyse, detect and prevent cyber threats and to support the production of high-quality intelligence on cyber threats, notably through the exchange of data from various sources, public and private, as well as through the sharing of state of-the-art tools and jointly developing cyber detection, analysis, and prevention capabilities in a trusted environment. They should provide new additional capacity building upon and complementing existing SOCs and CSIRTs and other relevant actors.

The platforms should act as a central point allowing for broader pooling of relevant data and CTI, enabling the spreading of threat information on a large scale and among a large and diverse set of actors (e.g., CERTs/CSIRTs, ISACs, operators of critical infrastructures).

Cross-Border Cyber Hub platforms will contribute to enhancing and consolidating collective situational awareness and capabilities in detection and CTI, supporting the development of better performing data analytics, detection, and response tools, through the pooling of larger amounts of data, including new data generated internally by the consortia members.

The Cross-Border Cyber Hub platforms should achieve this general objective through the following specific objectives:

Producing high quality, actionable information and CTI through the use of state-of-the-art tools and advanced tools and technologies (for example artificial intelligence (AI), including machine learning (ML) tools) on the large data sets of collected CTI.

Contributing to better detection and response to threats. They should support quicker detection of cyber threats and incidents and more effective action plans and responses by relevant entities.

Contributing to collective situational awareness. The platforms should contribute to the strengthening of the EU’s common situational awareness and enhanced coordinated detection capabilities by sharing information at three levels: Within individual platforms. Participating actors in a cross-border platform must commit to sharing operationally relevant information between one another within the same consortium. Different levels of sharing and integration of data and tools can be envisaged, ranging from the exchange of intelligence feeds and indicators of compromise (IoC) to more contextualised or sophisticated information on threats, incidents, and vulnerabilities.

Between platforms. Conditions for exchanging information with other platforms are to be decided by each platform. The respective cooperation agreements should, in particular, specify information sharing principles and interoperability. The platforms should inform the Commission about the agreements concluded. As per the Cyber Solidarity Act, ENISA is tasked with developing guidelines on the interoperability of cross-border cyber hubs. Against this background, the selected consortia will be required to collaborate with ENISA on the aspect of interoperability.

With relevant EU entities and networks. Platforms should provide an adequate level of information, as well as early warnings, to responsible networks and entities at EU level, in defined situations (such as in case of large scale cybersecurity incidents relevant information and early warnings must be provided to Member States’ authorities and the Commission through EU-CyCLONe and the CSIRTs network) and subject to appropriate conditions, in order to support common situational awareness and effective crisis management and response.

Improving EU technological sovereignty. Platforms should enhance the EU’s cyber-threat knowledge base, support the development and improvement of the EU tools, and help create and structure a European ecosystem for sharing CTI.

Providing other services and activities. Such services and activities could include the sharing of tools (including commonly procured tools), the creation of one or more data lakes, the provision of cyber range services, and/or the training of cybersecurity analysts. Depending on the activities and conditions agreed by platforms, these services could be offered to the platform members, and, where possible, to the wider EU cybersecurity community, including EU industry and research and academia.

Contribution to the surveillance and protection of critical undersea infrastructure: Cross Border Cyber Hubs could also deploy solutions for the surveillance and protection of critical undersea infrastructure, such as submarine cables, and the detection of malicious activities around them, to improve the resilience and security of this infrastructure, which is critical for global communications. The response to such hybrid threats could also include situational awareness performed through the collection and analysis of in-situ, sea-based sensor data as well as relevant satellite imagery. For this activity, operational synergies with the EU Copernicus Space Programme and in particular with its Security Service are required.

Scope:

The purpose of this call for expressions of interest (CfEI) is to select entities in EU Member States and other eligible countries1 willing to deploy and manage Cross-Border Cyber Hub platforms.

The selected consortia will engage in joint procurement with the ECCC to purchase the necessary tools, infrastructures and services to establish/enlarge/enhance the Cross-Border Cyber Hub platforms. For each joint procurement the EU will contribute up to 75% of the purchasing costs. The number of joint procurements to be conducted will depend on the number of successful applications selected following evaluation of this CfEI.

Separately, a platform has to apply to receive a grant to complement the joint procurement(s)2. The related grant will be awarded if the relevant requirements in the separate call for proposals are met and only if the application is successful at this call for expressions of interest. The EU will contribute up to 50% of eligible costs, such as staff costs or other eligible costs for setting up and running the cross-border platform, its interaction and cooperation with other stakeholders, with the exception of those tools, infrastructures and services that will be purchased through the joint procurement(s). The grant funding for the eligible costs of the cross-border platforms will come from the call for proposals on enlarging existing or launching new Cross-Border Cyber Hub platforms.

In the event of enlargement of an ongoing Cross-Border Cyber Hub, the new consortium will be composed of the coordinator of the ongoing grant plus the new entities that want to join the hosting consortium of the Cross-Border Cyber Hub. In the event of enhancement of an ongoing Cross-Border Cyber Hub, the new consortium will be the same as of the ongoing grant(s).

The deployment of these cross-border platforms is a pivotal component in a wider strategy and set of actions aimed at the stepping – up of monitoring and detection capabilities and the improvement of situational awareness at national, cross-border and EU level, and at paving the way for building a collaborative, interoperable and sustainable pan-European network of infrastructure. The network of infrastructure will link SOC entities at national level forming several Cross-Border Cyber Hub platforms, which will be able to build up shared capacities and exchange information among themselves. Such platforms would together constitute a pan-European network of infrastructure.

Cooperation and exchange of information will be encouraged among the various entities at all levels through the procurement of common equipment, software and services, the development of cooperation frameworks and of specific conditions to ensure a high level of interoperability among the supported projects and infrastructures, which will fit into a common, high-level blueprint architecture.

The purpose of this CfEI is to select entities that can provide the necessary facilities to host and

Text from the official source. Only the official documents are legally binding.

Official data · EU Funding & Tenders Portal · synced 2026-10-19 15:15 · official record · Licence: © European Union. Reuse with attribution (Commission Decision 2011/833/EU).