What does this check do?

With forty questions and no registration, it gives you the eligibility traffic light, a first picture of your cloud and cybersecurity starting point in the five decree categories, the estimated grant on your spending plan and the application checklist. The result stays online through a personal link you receive by email.

Is the result an official answer?

No. The tool applies the rules of the decree and the ministry FAQ and tells you what to check; eligibility and the grant are decided by the Ministry when it reviews the application. The starting point is then confirmed in AtWorkStudio's offer, which under FAQ 48 must describe it together with the guaranteed improvement.

What happens after I complete it?

You receive the personal link to your results by email and, if you wish, you request AtWorkStudio's offer with one click from the same page: AtWorkStudio replies in writing with a proposal in the format the decree requires. No commitment, and you can delete your data whenever you want.

Where do I find the scheme requirements, dates and eligible services?

On the Cloud and Cybersecurity Voucher page on atworkstudio.it, which explains who can apply, how much the grant covers, what can be purchased, the deadlines and the clarifications in the ministry FAQ. This page is only the check tool.

MIMIT 2026 Voucher eligibility check: starting point and estimated grant

You receive a personal link by email: you can come back to edit your answers and review your starting point at any time. No registration.

Contact email *

Requirements

Starting point

Spending plan

Company name or professional name *

Eligibility requirements

The conditions the decree and the Ministry FAQ require of the applicant. Answer with what you know today: where you are unsure, the result will tell you what to check before applying.

Is the business a micro, small or medium-sized enterprise (fewer than 250 employees and turnover up to €50 million or balance sheet total up to €43 million), or a self-employed worker or professional with an Italian VAT number?

EU definition of SME: fewer than 250 employees and annual turnover not exceeding €50 million or balance sheet total not exceeding €43 million. Self-employed professionals with a VAT number and newly founded companies without filed accounts are eligible (beneficiary FAQ 4 and 5). Professional associations and associated firms are excluded (individual professionals are eligible), as is primary agricultural production unless other activities with an active ATECO code exist (beneficiary FAQ 15, 16 and 17).

YesNo

In which region is the office or local unit where the project will be carried out?

Of the €150 million available, €71 million is reserved for plans carried out in Abruzzo, Basilicata, Calabria, Campania, Molise, Puglia, Sardinia and Sicily.

Do you have an internet connectivity contract with a nominal download speed of at least 30 Mbps, active at the time of application?

What counts is the nominal download speed of the contract, not a guaranteed bandwidth (FAQ 49). A data SIM or mobile connection does not qualify: fibre, VDSL, FWA and satellite do (beneficiary FAQ 10). A declaration is enough in the application; the contract is shown at the payment stage and must already be in place on the application date (beneficiary FAQ 11). It may be in another party's name, provided it refers to the premises and comes with a declaration by the holder (beneficiary FAQ 12).

YesNoI don't know

Is the company's social security contribution status (DURC) in good standing?

The DURC is not among the application requirements: the Ministry obtains it directly at the payment stage, for companies (art. 7, paragraph 5, of the directorial decree of 4 August 2026). An irregular position blocks the payment of the grant. The MIMIT application form nevertheless includes a declaration of compliance with social security obligations (fac-simile of 8 October 2026, letter k).

YesNoI don't know

Can you make the declaration of compliance with the mandatory insurance against catastrophic risks required by Law 213/2023?

The declaration is required in the application on pain of inadmissibility (art. 5, paragraph 3, letter i, of the directorial decree of 4 August 2026) and concerns the obligation to insure against damage from catastrophic events under Law 213/2023, which applies to companies: self-employed professionals are not subject to it. The obligation also covers rented, leased or loaned assets used in the business, unless already insured by the owner; the self-declaration (DSAN) on the MIMIT form is attached to the application (beneficiary FAQ 7 and 8).

YesNoI don't know

Does the legal representative have a digital identity (SPID, CNS or CIE), an active certified email (PEC) and a valid digital signature?

They are needed to access the MIMIT online procedure, receive communications and sign the application. Invitalia portal windows: drafting from 12:00 on 20 October 2026, submission from 12:00 on 10 November 2026 to 12:00 on 20 January 2027. Before filling in the application, the legal representative must register the company in Invitalia's Anagrafica e Deleghe (MIMIT webinar of 15 October 2026); self-employed professionals log in directly with their digital identity.

Yes, all threeOnly someNo

Have you checked on the National State Aid Register that you have enough de minimis headroom to receive the grant?

The voucher is de minimis aid: the grant adds to the other aid received in the last three financial years. The check is made on the National Register of State Aid and the ceiling is calculated on the single undertaking, that is the group (beneficiary FAQ 13).

YesNoI don't know

Have you already purchased, ordered or paid for products or services you would like to include in the voucher?

Expenses are eligible only if incurred after the application is submitted. Anything bought earlier loses the grant on those purchases.

YesNo

How many employees does the business have?

Together with turnover, this determines whether the business qualifies as an SME.

What was the annual turnover in the last financial year?

If turnover exceeds €50 million, the business remains an SME only if its balance sheet total does not exceed €43 million.

Is another business at the same premises also applying?

For example another company in the group or a business sharing the offices and the network. Two legally distinct companies may submit separate applications, even within the same group (beneficiary FAQ 13).

YesNo

Requirements

Starting point

Spending plan

For each item, describe your business as it is today. This snapshot is the description of the starting point that the decree requires in the application and in the supplier's offer: be precise: for products give brand and version, for services the provider and the contract.

Cybersecurity hardware

Category A of the decree: firewalls, next-generation firewalls, routers and switches, intrusion prevention systems.

Managed, up-to-date perimeter firewall

In usePartialNot present

Next-generation firewall (NGFW) with application traffic inspection

In usePartialNot present

Segmented network with managed switches and separate VLANs (offices, servers, guests)

In usePartialNot present

Intrusion detection or prevention system (IDS/IPS)

In usePartialNot present

Cybersecurity software

Category B: antivirus and anti-malware, network monitoring, encryption, email protection, strong authentication.

Centrally managed antivirus or anti-malware on all workstations

In usePartialNot present

EDR or XDR for endpoint detection and response

In usePartialNot present

Security log collection and monitoring (SIEM or equivalent service)

In usePartialNot present

Data encryption on disks and mobile devices

In usePartialNot present

Email protection (anti-phishing, attachment filtering, DMARC)

In usePartialNot present

Multi-factor authentication (MFA) for email, VPN and application access

In usePartialNot present

Cloud IaaS and PaaS

Category C: virtual machines, storage, backup, VPN and cloud platform services.

Cloud servers or virtual machines (IaaS)

In usePartialNot present

Cloud backup with periodically tested restore

In usePartialNot present

Cloud file storage and sharing

In usePartialNot present

Secure remote access (VPN or equivalent) for off-site work

In usePartialNot present

Disaster recovery plan with a cloud recovery environment

In usePartialNot present

SaaS software

Category D: subscription applications such as collaboration suites, business software, CRM, phone systems, e-commerce.

Cloud collaboration suite (Microsoft 365, Google Workspace)

In usePartialNot present

Cloud business management software or ERP

In usePartialNot present

Cloud CRM

In usePartialNot present

Cloud phone system (VoIP, UCC)

In usePartialNot present

Website, e-commerce or portal on a managed platform

In usePartialNot present

Professional services

Category E: services delivered by a provider, not products. Configuration, monitoring and ongoing support, eligible only together with new products from categories A–D and up to 30% of the plan. Staff training is excluded. Describe what you have under contract today.

System configuration and management entrusted to a specialised provider

ActivePartlyNot in place

Continuous monitoring and support with defined response times

ActivePartlyNot in place

Regular staff training on information security

Describes the starting point only: staff training cannot be funded by the voucher, not even within the 30% of category E (directorial decree of 4 August 2026, art. 4 par. 2 letter e; Ministerial Decree of 18 July 2025, art. 5). It does not count as a gap and does not go into the spending plan.

ActivePartlyNot in place

Requirements

Starting point

Spending plan

Estimate the amounts you plan for each category, excluding VAT. The tool checks the rules of the decree and calculates the grant. For subscriptions, count the sum of the fees for the first 24 months (beneficiary FAQ 34).

Estimated amount for cybersecurity hardware (category A)

Firewalls, NGFW, routers and switches, IDS/IPS and other security hardware. Not generic hardware such as servers, PCs and NAS devices used as plain infrastructure (supplier FAQ 36 and 58); a NAS or server inside a new backup architecture or an integrated security solution falls under type A9 (supplier FAQ 58 and 59). Also eligible as a subscription, with rented or loaned equipment that remains the supplier's property (supplier FAQ 51).

€

Estimated amount for cybersecurity software (category B)

Antivirus and EDR, network and log monitoring, encryption, email protection, identity management. Also backup and disaster recovery software for a new data protection architecture (types B3 or B9, supplier FAQ 59).

€

Estimated amount for IaaS and PaaS cloud services (category C)

Virtual machines, storage, backup, disaster recovery, VPN and platform services. No consumption-based formulas: pay-per-use, prepaid credits and usage caps are not eligible; fixed fees or a direct purchase are required (supplier FAQ 52).

€

Estimated amount for SaaS software (category D)

Collaboration suites, business software and ERP, CRM, cloud phone systems, e-commerce and websites on managed platforms.

€

Estimated amount for professional configuration, monitoring and support services (category E)

Configuration, monitoring and ongoing support, allowed only together with new products in categories A–D and up to 30% of the plan. The professional and ongoing services typical of a solution delivered as SaaS belong to the solution's category (FAQ 37), not here. Staff training is excluded, even within the 30% (directorial decree of 4 August 2026, art. 4 par. 2 letter e; Ministerial Decree of 18 July 2025, art. 5): platforms to deliver it fall under D, training content does not.

€

Planned purchasing model

The choice between direct purchase and a subscription of at least 24 months is part of the spending plan and cannot be changed after the application is submitted (art. 8, paragraph 4, of the directorial decree of 4 August 2026). What tells the two methods apart is the payment, not the duration: direct purchase without recurring fees, also with deposit and balance after the application; subscription with periodic fees and at least 24 months (supplier FAQ 53 and 54). A SaaS contract, even of 36 months, can be a direct purchase (supplier FAQ 40 and 53). Programme duration to state in the application: 1 to 12 months with direct purchases only, 24 months with a subscription (supplier FAQ 55). Deadlines from the notification of the grant decision: direct purchases incurred and paid within 12 months (art. 4 par. 4 letter a); subscription signed within 30 days and notified within 60 (art. 4 par. 5), with the expenses of the first 24 months, which may also be prepaid by the year (beneficiary FAQ 40 and 42). In the spending plan a subscription counts as the sum of the fees for the first 24 months (beneficiary FAQ 34); consumption-based formulas are not allowed (supplier FAQ 52).

Do the planned measures introduce solutions that are new compared to those in use, rather than licence extensions, version upgrades or additional seats?

The decree excludes four cases: services similar to those already in use, version upgrades without substantial improvement, extensions of licences already held, additional seats or users.

Yes, all newOnly partlyNo

Does the plan include computers, laptops, servers or NAS devices not dedicated to security?

Computers, laptops, servers and NAS devices used as plain infrastructure are not eligible (supplier FAQ 36 and 58): if you counted them in category A, remove them from the amount. A NAS or server that builds a new backup and disaster recovery architecture, or an integrated security solution, is instead cybersecurity hardware (type A9, supplier FAQ 58 and 59): in that case answer no and keep it in category A.

YesNo

Does the project involve configuring or managing equipment the company already owns (for example an existing NAS, firewall or server)?

For example a NAS, firewall or server you already have: configuring them is not covered by the voucher, new services that use them are.

YesNoI don't know

Does the project add functions to business software you already use?

Add-on modules from the same vendor risk counting as an extension of licences you already own; integrations built by another provider are only possible if the software exposes APIs.

Does the project involve using artificial intelligence on documents, emails or personal data?

For example assistants that read email, classify documents or answer questions on customer data. SaaS solutions with artificial intelligence features are eligible (beneficiary FAQ 24). It does not affect eligibility: it helps AtWorkStudio prepare the offer.

YesNo

Where is the company's main data stored today?

Used to describe the cloud starting point (category C) in the offer.

Do you already have an IT provider you rely on?

The voucher can only be used with approved suppliers: knowing how your IT is organised today helps AtWorkStudio propose the right setup.

In a few words, what would you like to achieve with the voucher?

One sentence is enough: it is the most useful thing for preparing a sensible offer.

Estimated grant

0 €

Spending plan: 0 €
Products A–D: 0%
Professional services E: 0%

Estimate based on the decree rules: 50% of the spending, maximum €20,000, minimum €4,000. The grant is awarded by MIMIT in chronological order until funds run out and paid as a reimbursement of paid expenses, in one or two instalments.

Estimated grant 0 €

I have read and accept the Privacy Policy and consent to the processing of my data for the voucher eligibility check, the starting point and the sending of my personal link by email. *

Answers saved

Your personal link has been sent by email. On the results page you will find the requirements traffic light, the estimated grant, the starting point by category and the checklist for the application.

View the results

Save this link, it is your personal access:

What this check is

A free tool by AtWorkStudio, MIMIT approved supplier with code VCCFA2600000145, for anyone applying for the voucher: it applies the rules of the decree and the ministry FAQ to your company and tells you what to check before applying. It is not the scheme page and does not replace the Ministry's assessment: requirements, grant, dates and eligible services are on the AtWorkStudio website.

All about the scheme on atworkstudio.it

Frequently asked questions about the check

What does this check do?: With forty questions and no registration, it gives you the eligibility traffic light, a first picture of your cloud and cybersecurity starting point in the five decree categories, the estimated grant on your spending plan and the application checklist. The result stays online through a personal link you receive by email.
Is the result an official answer?: No. The tool applies the rules of the decree and the ministry FAQ and tells you what to check; eligibility and the grant are decided by the Ministry when it reviews the application. The starting point is then confirmed in AtWorkStudio's offer, which under FAQ 48 must describe it together with the guaranteed improvement.
What happens after I complete it?: You receive the personal link to your results by email and, if you wish, you request AtWorkStudio's offer with one click from the same page: AtWorkStudio replies in writing with a proposal in the format the decree requires. No commitment, and you can delete your data whenever you want.
Where do I find the scheme requirements, dates and eligible services?: On the Cloud and Cybersecurity Voucher page on atworkstudio.it, which explains who can apply, how much the grant covers, what can be purchased, the deadlines and the clarifications in the ministry FAQ. This page is only the check tool.

Check the requirements and prepare your starting point

Eligibility requirements

Cybersecurity hardware

Cybersecurity software

Cloud IaaS and PaaS

SaaS software

Professional services

Spending plan

Answers saved

What this check is

Frequently asked questions about the check