Are penetration tests really eligible?
Yes — focus area A explicitly lists IT infrastructure analyses, penetration tests, remediation of identified vulnerabilities, incident simulations and the creation of emergency response plans. Exactly the work that gives you a reliable picture of your security posture is eligible — including the follow-up remediation.
How does the lottery procedure work?
In two stages: you express your interest in the NRW.BANK customer portal; every month — usually on the first working day — 16 slots are drawn. If your entry is drawn, the application is unlocked automatically and you have 28 days to submit. If not, you take part again the next month without re-registering. That is why it pays to have your quote and documents ready before the draw.
How much funding do we actually get?
50% of eligible costs, with a minimum grant of €4,000 and a maximum of €15,000. That means your project needs at least €8,000 of eligible volume; the cap is reached at €30,000 — higher spending is allowed, funding stops at €15,000. VAT is not eligible.
When is the money paid out?
After the project: the programme works on a cost-reimbursement basis. You commission after approval, pay the invoices yourself first, and submit the proof of use, final report, invoices and payment evidence after completion — then the grant is paid in one sum. Plan for this pre-financing.
Who may deliver the services?
A contractor with proven relevant competence (qualifications or further training) and a registered office in the EU; no specific certification is prescribed. Subcontracting and freelancers are not permitted, and there must be no personal or corporate affiliation. A maximum of two contractors is allowed — the second exclusively for training measures, such as the IT security officer course.
Can we combine this with MID-Digitale Prozesse?
The tracks are separate: each may be used once per company within two years, and the same measure may never be funded twice. A cleanly scoped security project and a separate process digitalisation project are therefore not mutually exclusive in principle — we check the right scoping and your de-minimis headroom in the funding check.
Are any sectors or products excluded?
Yes: hospitals, clinics and medical practices as well as agriculture and forestry businesses (except processing/marketing) are not eligible. In addition, software the BSI warns against under Section 13 BSIG is excluded — we take this into account from the start in the vendor-neutral selection under focus area C.
