Penetration Test and Vulnerability Assessment
ClosedDescription
Upon being selected and signing the Sub-Arant Agreement, beneficiaries will receive up to 18 months of tailored support across four key stages: Stage 1: Execution Plan (Month 1) –, the applicant will create an execution plan (or roadmap) based on their application. This plan will guide the implementation, outlining clear goals, KPIs, deliverables, and the necessary mentorship and resources. Stage 2: Developing testing scenarios (Months 2-6): Preparation, Design and Development for Testing of Penetration Testing Activities – During this stage, the Participants must carry out all preparational activities (planning, installing systems, testing, …) for Penetration Testing, Vulnerability Assessments and other supporting activities for the end user. Stage 3: External Assessments with End-Users (Months 7-15): Implementation of Penetration Tests including Vulnerability Assessments for End-Users. At this third stage, the penetration testing and vulnerability assessment for the end users must be done, at least 10 per beneficiary. Stage 4: Outputs and Sustainability Services (Months 16-18): Generating Output including Publications; providing Mitigation Services. Participants will be guided and supported in the awareness creation and/or publication of their results efforts, with assistance in connection to risk monitoring, announcements, and disclosure of the vulnerabilities to the operating organisation and the manufacturer or producer.
Beneficiary & submission
Submission & evaluation process
CYSSDE aims to collaborate with up to 10 selected Penetration Testing organizations to execute a minimum of 100 Penetration Tests and Vulnerability Assessments for Essential Service Operators, SMEs, and other entities. The focus will be on critical infrastructure, with lessons learned adapted to support essential operators and SMEs.
Application Process
- Submission: Applications are submitted online via the FundingBox platform: https://cyssde-pentesting-open-call.fundingbox.com/.
- Eligibility: Individual entities or consortia (up to 2 entities), including SMEs, mid-caps, large companies, research centers, and public bodies from EU Member States are welcome to apply. A minimum of 25% of the budget is reserved for SMEs.
Evaluation Process
- Phase 1: Admissibility & Eligibility Check: Proposals are verified for compliance with eligibility criteria and completeness. Non-compliant applications will be rejected.
- Phase 2: IN/OUT Scope Screening (if needed): Proposals are assessed for alignment with CYSSDE objectives and technical viability. Proposals that fail to meet the scope criteria will be rejected.
- Phase 3: Independent Evaluation: Proposals are evaluated by 2 independent cybersecurity experts on:
Excellence: Technical innovation, relevance, and methodologies.
Impact: Long-term market, societal, and operational improvements.
Implementation: Feasibility, resources, and budget credibility.
- **Phase 4: Consensus Meeting:**The Selection Committee (LSEC, DNSC, TOREON, CEEYU, Cyber Ranges, INCIBE, FBA) will review and finalize the selection based on ranking, alignment with CYSSDE goals, and potential ethical or competitive concerns.
Further information
- Open Call documentation: https://cyssde-pentesting-open-call.fundingbox.com/pages/OCdocuments
- Helpdesk email: helpdesk@cyssde.eu
- CYSSDE Project website: https://cyssde.eu/