← ProgramsOpen until places are filledCDT-CYBER-2026All sectors

Program to support small and medium-sized enterprises in the Republic of Serbia in improving cyber security

Access to experts, financial support and practical solutions that strengthen the cyber security and digital competitiveness of small and medium-sized enterprises.

Apply with your company Public call (PDF)

Deadline20 Novor until places are filled

Up to8,500€

About the program

The overall aim of the Program is to make micro, small and medium-sized enterprises in the Republic of Serbia more competitive and sustainable by supporting the digital transformation of their business, built on the principles of cyber security, risk management and resilience to today's digital threats.

The Program enables companies to:

understand their own level of cyber security maturity, through a structured assessment of their current capacity, practices and business risks;
set a clear direction for further development, through a roadmap for improving the security of their information systems, tailored to the specific needs of each company;
develop concrete projects that improve their digital and security infrastructure, by defining a project brief;
receive financial support for implementing the chosen solutions, as subsidies for buying and introducing digital and security technologies in line with the project brief;
get expert consulting support at no direct cost to the company, as CDT covers the full cost of the certified consultants engaged in the Program;
keep full autonomy over business decisions, including the choice of solutions and suppliers, and responsibility for delivering the project, with expert support throughout the decision-making process.

Financial support

Financial support is granted as a subsidy of up to EUR 8,500.00 per company, paid in the dinar equivalent, excluding VAT.

Support applies to projects with a total value of at least EUR 10,000.00 excluding VAT, and the company covers the difference between the total investment and the approved subsidy. For larger projects the subsidy amount stays the same.

The subsidy is paid as a refund, once the company has fully delivered the project and paid the supplier. Refunds are made only for projects that have been successfully implemented and verified.

Additional benefits for Program participants

free access to the CDT Digital Academy, where staff and management can build their knowledge of digital transformation, business models, modern technologies and artificial intelligence;
the option to attend CDT Training Center courses at a subsidized price, with a 50% discount on courses leading to recognized professional certificates.

Eligible solutions

Eligible solutions are those that set up or improve a working cyber security system, including its technical, organizational and operational parts, rather than single tools or partial measures. In line with the maturity assessment and the improvement roadmap, support can cover the following categories of solutions:

Solutions for managing cyber security, risk and IT assets, including policies and procedures, an information security management system (ISMS), risk assessment, and the identification, classification and management of IT assets;
Identity and access management (IAM) solutions, including access control, multi-factor authentication, privileged account management and central user management;
Solutions for protecting the network, infrastructure and endpoints, including network traffic protection, network segmentation, secure remote access, and protection of workstations, servers and mobile devices;
Solutions for protecting data and business communications, including data classification and encryption, backup and recovery, and protection of email and other communication channels;
Application, cloud and DevSecOps security solutions, including protection of applications, cloud environments and API services, and security controls in software development and maintenance;
Solutions for detecting, monitoring and responding to security incidents, including log management, threat detection, security operations and incident response;
Solutions for incident management and business continuity, including response, recovery and business continuity plans for cyber incidents;
OT and industrial cyber security solutions, including protection of industrial systems, segmentation and risk management in operational technology;
Awareness, training and specialist support services, including staff training, attack simulations, and expert support in implementing and improving security measures.

The company makes the final choice of solution itself, in line with the project brief. Priority goes to integrated solutions that cover several areas of cyber security and help build a complete and sustainable protection system.

Applying and selection

Companies apply to the Public Call online, by filling in the application form. In the application they enter basic business details and then complete a structured questionnaire for a preliminary assessment of their cyber security maturity. The questionnaire is purely diagnostic and is not a criterion for exclusion from the Program.

Selection looks in particular at: how ready the company is to take an active part in the Program, its capacity to implement projects successfully, the level of risk identified and the need to improve cyber security, the potential of the proposed activities to strengthen the company's overall digital resilience, and a balanced mix of sectors, company sizes and types, and regions.

After selection a preparation phase begins, lasting up to 10 days from the day the company is notified. In this phase the selected company is assigned a consultant and submits the documents listed on this page.

The number of companies the Program can include is limited by the funds available.

01 · Who can apply

01A micro, small or medium-sized enterprise registered with the Serbian Business Registers Agency.02Majority privately owned.03Not in bankruptcy or liquidation proceedings.04At least 5 and at most 249 employees on the day of applying to the Public Call.05All tax and social contribution obligations paid in line with current regulations.06Not banned from carrying out its business activity.07Accurate information in the Statement on de minimis state aid received, and the Program does not take the company above the permitted amount of de minimis aid.

02 · Documents

Proof that tax and social contributions are paid (tax certificate)Signed agreement on taking part in the ProgramStatement on de minimis state aid received in the previous three fiscal yearsFor the refund: the supplier's invoice for the solution bought and implementedFor the refund: proof of payment in fullFor the refund: a request for payment of the subsidy

All documents are submitted through My CDT, where the forms can also be downloaded.

03 · 6 phases

01Assessing the company's cyber security maturityA detailed assessment of the current maturity level using the developed methodology. The consultant writes a report with the findings, key risks and initial recommendations.

02Roadmap for improving the company's cyber security maturityThe assessment findings become priority measures matched to the level of risk, regulatory requirements, business needs and the company's resources.

03Choosing and defining the priority projectThe project goals, scope, expected results and technical requirements are defined. The consultant writes the project brief and CDT approves it.

04The company buys the defined solutionThe company buys the solution in line with the project brief and keeps full autonomy in choosing the supplier and the final solution.

05Verifying the purchase and implementationConfirmation that the solution has been bought and implemented in line with the project brief, the assessment priorities and the roadmap.

06Refund of the subsidyThe subsidy of up to EUR 8,500 excluding VAT is paid as a refund, after the project is delivered and the supplier is paid.