Cloud and Cybersecurity Voucher: a practical guide for Italian SMEs and professionals

The Cloud and Cybersecurity Voucher is an Italian incentive, one of the few in 2026 designed specifically for small businesses and professionals who want to secure their data and services. It is managed by Invitalia on behalf of the Italian Ministry of Enterprises and Made in Italy (MIMIT), and it is open to companies and professionals operating in Italy.

One point matters more than any other: applications are assessed in order of arrival. Those who reach 10 November with their project already prepared have a real advantage over those who only start thinking about it on the day.

What it funds and how much it is worth

The grant is non-repayable and covers 50% of eligible costs, up to a maximum of €20,000 per beneficiary. The total budget is €150 million, of which around €71 million is reserved for the regions of Southern Italy. The spending plan must be at least €4,000.

Eligible costs include:

• cybersecurity hardware and software, as long as it is new or additional to what is already in use;
• cloud services (IaaS, PaaS and SaaS);
• configuration, monitoring and ongoing support services linked to the products purchased, accepted up to 30% of the spending plan.

Staff training is excluded, even when it is part of the same offer.

Who can apply

SMEs and self-employed professionals anywhere in Italy can apply, provided that, at the time of application, they have an internet connection contract with a download speed of at least 30 Mbps. Companies must also be compliant with the mandatory insurance against catastrophic risks introduced by Italian Law 213/2023. The grant falls under the de minimis regime, so it is worth checking with your accountant how much room is left after any other aid already received.

Key dates

• From 20 October 2026 (12:00): the online application form can be filled in.
• From 10 November 2026 (12:00): applications can be submitted.
• Until 20 January 2027 (12:00), unless funds run out earlier.

To apply you need an Italian digital identity (SPID, CNS or CIE), a digital signature and a certified email address (PEC).

Direct purchase or subscription: a choice to make beforehand

Costs can be incurred in two ways. With a direct purchase, the plan must be completed within 12 months of the grant being awarded. With a subscription, services must last at least 24 months. The option chosen cannot be changed after the application, so it is worth thinking it through calmly with your supplier and your advisor.

The supplier must be on the Ministry’s list

Products and services can only be bought from suppliers on the approved list kept by the Ministry and published on the Invitalia portal. The offer must be signed by the supplier and clearly describe the starting situation and the expected improvement: this is one of the points on which applications are most often challenged.

Why so many companies put it off (and why this year they shouldn’t)

When it comes to IT security, the so-called optimism bias often kicks in: we think attacks happen to others, to larger or more exposed companies. The figures tell a different story: according to the 2026 Clusit Report, in 2025 Italy suffered 507 serious incidents, 9.6% of those recorded worldwide, a 42% increase on the previous year.

The voucher lowers the cost of the work, but its real advantage is another: it forces you to take stock of backups, access rights and cloud services, with a clear deadline.

How to prepare by 10 November

1. Take an inventory of what you have today: servers, backups, antivirus, firewall, cloud services.
2. Set your priorities: where would downtime cost you the most?
3. Ask for an offer from a supplier on the list, with the starting point and the improvement clearly described.
4. Check with your accountant the de minimis position, the catastrophic risk policy and the purchase option.
5. Fill in the application in advance, so that on 10 November you only have to submit it.

If you are considering a project, we can help you work out which measures make sense for your business and how to describe them clearly. Checking the eligibility requirements and the tax aspects remains the job of your advisor.

Frequently asked questions

How much is the Cloud and Cybersecurity Voucher worth?

A non-repayable grant covering 50% of eligible costs, up to €20,000 per beneficiary, with a minimum spending plan of €4,000.

Who can apply for the voucher?

SMEs and self-employed professionals in Italy with an internet connection of at least 30 Mbps download at the time of application. Companies must also hold the mandatory catastrophic risk insurance. The grant falls under the de minimis regime.

When can applications be submitted?

The form can be filled in from 12:00 on 20 October 2026; applications can be submitted from 12:00 on 10 November 2026 until 12:00 on 20 January 2027, unless funds run out earlier. Applications are assessed in chronological order.

Is staff training covered?

No. Training is excluded from eligible costs, even when it appears in the same offer.

Can I choose any supplier?

No. Products and services must be bought from suppliers on the list kept by the Ministry, published on the Invitalia portal.

Is direct purchase or subscription better?

It depends on the project. A direct purchase must be completed within 12 months of the award, while a subscription requires services lasting at least 24 months. The choice cannot be changed after applying, so it should be assessed beforehand with your supplier and advisor.