Dutch cyber security subsidy for small businesses: Mijn Cyberweerbare Zaak 2026

MCZ is a small subsidy from the Dutch government. It helps business owners protect their company against cybercrime. You pick one or more measures from a fixed list and have them delivered or installed. You pay the invoice. Then you apply for the subsidy.

First you do the free CyberVeilig Check from the Dutch National Cyber Security Centre (NCSC). It gives you advice on which measures matter most for your business. Without that advice, RVO rejects your application.

You can apply if your business meets every condition below:

• You are registered with the Dutch Chamber of Commerce (KvK).
• You have no more than 50 employees.
• Your turnover in the previous financial year was under €10 million.
• Your business is not in primary agriculture, fisheries or aquaculture.
• You are not a supplier whose main business is selling cybersecurity measures.
• With this subsidy added, you stay under the de minimis limit. That limit is €300,000 in state aid over three years.
• You get no other subsidy for the same costs, for example from your municipality.

Only these eight measures count. Each one links to the matching topic in our checklist, with more explanation and concrete questions.

1. Secure network access and Wi-Fi: for example a hardware firewall, access points or a router
   In the checklist: Network
2. Password manager: up to 1 year
   In the checklist: Identity and access
3. Two-factor or multi-factor authentication (2FA/MFA) for internal applications
   In the checklist: Identity and access
4. Patch management: keeping your systems updated on a structural basis. A one-off update does not count
   In the checklist: Cybersecurity
5. Antivirus software: licence and installation for up to 1 year
   In the checklist: Cybersecurity
6. Setting up and testing backups: including installation. The only hardware that counts is a ready-made NAS bundle with hard drives
   In the checklist: Backup
7. Risk inventory and evaluation: does not count if it is part of a certification track such as ISO 27001
   In the checklist: Compliance
8. Cyber awareness training for staff
   In the checklist: Cybersecurity

What is not covered?

• Websites, webshops, online platforms, payment systems and cloud workplaces.
• General subscriptions with security built in, such as Microsoft 365 Premium or Google Workspace.
• One-off updates and general IT management. Updates for software that is no longer supported don't count either.
• Ordinary backup hardware (except the NAS bundle), certification such as ISO 27001 and legal advice.
• Subscriptions or licences you already had. It has to be a new or additional measure.
• More accounts or licences than there are people working in your business.
• A measure in a category for which you already received MCZ funding in 2023, 2024 or 2025.
• Anything you ordered, had installed or paid for before 7 September 2026.

You get 50% of the eligible costs, up to a maximum of €1,250. You pay the other half yourself.

Your costs must add up to at least €400. You can put several invoices in one application, as long as you stay within the maximum.

Each business can submit one application. Linked businesses count as one. Not sure how the maximum works out for your invoices? Check rvo.nl.

1. Do the NCSC CyberVeilig Check and save the advice as a PDF.
2. Pick one or more measures from the list above. You don't have to follow all the advice from the check.
3. Ask your supplier in advance if the invoice will meet the requirements. It must show: your name and address and those of the supplier, a description of the product or service, the invoice and payment dates, and the amounts with and without VAT.
4. Have the measure delivered or installed and pay the full invoice. A bank transfer works best, because a credit card statement can take up to a month to arrive.
5. Get eHerkenning (the Dutch business login) at level 2+ or higher, with an authorisation for RVO services at eH2+.
6. Log in at RVO and submit your application. Include the CyberVeilig Check advice, the invoice or invoices and the matching bank statements. If an invoice refers to an attachment, such as a quote, include that as well.

What happens after you apply?

• You get a decision within 8 weeks of a complete application.
• If your application is approved, RVO pays the full subsidy within 2 weeks.
• If something is missing, RVO emails you to ask for it. Your application then only counts from the date it is complete.
• After approval, you take part in an evaluation of the measures.

• The deadline is Monday 30 November 2026 at 17:00. The budget can run out sooner, because it goes first come, first served. If more applications arrive on one day than there is money left, a lottery decides.
• Don't wait until the last two weeks. RVO warns there may be no time left then to add missing documents.
• Bookkeeping overviews and PayPal statements don't count as proof of payment. You may black out amounts on your bank statement that have nothing to do with the application.