Cross-Border Cyber Hubs

Description

Cross-Border Cyber Hubs Call: Call for expression of interest - Cyber Hubs 2027 Identifier: EOI-ECCC-2027-DIGITAL-DEPLOY-CYBER-12-CEI-CBCH Call identifier: EOI-ECCC-2027-DIGITAL-DEPLOY-CYBER-12-CEI Kind: bando (topic) Status: aperto Opening date: 2026-10-15 Deadline: 2027-03-16 Deadline model: single-stage Type of action: Call for Expression of Interest Budget: 2026: 3000000 EUR Programme period: 2021 - 2027 Description Objective: The general objective of “Cross-Border Cyber Hub platforms” is to strengthen capacities to analyse, detect and prevent cyber threats and to support the production of high-quality intelligence on cyber threats, notably through the exchange of data from various sources, public and private, as well as through the sharing of state of-the-art tools and jointly developing cyber detection, analysis, and prevention capabilities in a trusted environment. They should provide new additional capacity building upon and complementing existing SOCs and CSIRTs and other relevant actors. The platforms should act as a central point allowing for broader pooling of relevant data and CTI, enabling the spreading of threat information on a large scale and among a large and diverse set of actors (e.g., CERTs/CSIRTs, ISACs, operators of critical infrastructures). Cross-Border Cyber Hub platforms will contribute to enhancing and consolidating collective situational awareness and capabilities in detection and CTI, supporting the development of better performing data analytics, detection, and response tools, through the pooling of larger amounts of data, including new data generated internally by the consortia members. The Cross-Border Cyber Hub platforms should achieve this general objective through the following specific objectives : - Producing high quality, actionable information and CTI through the use of state-of-the-art tools and advanced tools and technologies (for example artificial intelligence (AI), including machine learning (ML) tools) on the large data sets of collected CTI. - Contributing to better detection and response to threats. They should support quicker detection of cyber threats and incidents and more effective action plans and responses by relevant entities. - Contributing to collective situational awareness. The platforms should contribute to the strengthening of the EU’s common situational awareness and enhanced coordinated detection capabilities by sharing information at three levels: - Within individual platforms. Participating actors in a cross-border platform must commit to sharing operationally relevant information between one another within the same consortium. Different levels of sharing and integration of data and tools can be envisaged, ranging from the exchange of intelligence feeds and indicators of compromise (IoC) to more contextualised or sophisticated information on threats, incidents, and vulnerabilities. - Between platforms. Conditions for exchanging information with other platforms are to be decided by each platform. The respective cooperation agreements should, in particular, specify information sharing principles and interoperability. The platforms should inform the Commission about the agreements concluded. As per the Cyber Solidarity Act, ENISA is tasked with developing guidelines on the interoperability of cross-border cyber hubs. Against this background, the selected consortia will be required to collaborate with ENISA on the aspect of interoperability. - With relevant EU entities and networks. Platforms should provide an adequate level of information, as well as early warnings, to responsible networks and entities at EU level, in defined situations (such as in case of large scale cybersecurity incidents relevant information and early warnings must be provided to Member States’ authorities and the Commission through EU-CyCLONe and the CSIRTs network) and subject to appropriate conditions, in order to support common situational awareness and effective crisis management and response. - Improving EU technological sovereignty. Platforms should enhance the EU’s cyber-threat knowledge base, support the development and improvement of the EU tools, and help create and structure a European ecosystem for sharing CTI. - Providing other services and activities. Such services and activities could include the sharing of tools (including commonly procured tools), the creation of one or more data lakes, the provision of cyber range services, and/or the training of cybersecurity analysts. Depending on the activities and conditions agreed by platforms, these services could be offered to the platform members, and, where possible, to the wider EU cybersecurity community, including EU industry and research and academia. - Contribution to the surveillance and protection of critical undersea infrastructure : Cross Border Cyber Hubs could also deploy solutions for the surveillance and protection of critical undersea infrastructure, such as submarine cables, and the detection of ma

Sectors

Source

Source: ec.europa.eu