CYSSDE aims to collaborate with up to 10 selected Penetration Testing organizations to execute a minimum of 100 Penetration Tests and Vulnerability Assessments for Essential Service Operators, SMEs, and other entities. The focus will be on critical infrastructure, with lessons learned adapted to support essential operators and SMEs.

Upon being selected and signing the Sub-Arant Agreement, beneficiaries will receive up to 18 months of tailored support across four key stages:

Stage 1:

Execution Plan (Month 1) –, the applicant will create an execution plan (or roadmap) based on their application. This plan will guide the implementation, outlining clear goals, KPIs, deliverables, and the necessary mentorship and resources.

Stage 2:

Developing testing scenarios (Months 2-6): Preparation, Design and Development for Testing of Penetration Testing Activities – During this stage, the Participants must carry out all preparational activities (planning, installing systems, testing, …) for Penetration Testing, Vulnerability Assessments and other supporting activities for the end user.

Stage 3:

External Assessments with End-Users (Months 7-15): Implementation of Penetration Tests including Vulnerability Assessments for End-Users. At this third stage, the penetration testing and vulnerability assessment for the end users must be done, at least 10 per beneficiary.

Stage 4:

Outputs and Sustainability Services (Months 16-18): Generating Output including Publications; providing Mitigation Services. Participants will be guided and supported in the awareness creation and/or publication of their results efforts, with assistance in connection to risk monitoring, announcements, and disclosure of the vulnerabilities to the operating organisation and the manufacturer or producer.