Cyber security subsidy: up to € 1,250 for freelancers and SMEs, and why your building counts too

Small businesses are an easy target for cybercriminals. Not because they are so interesting, but because their security is often less well organised than at a large company. A hacked email account, an encrypted laptop or a fake invoice can shut a small business down for days.

That is why the Dutch government now pays part of the cost. With the My Cyber Resilient Business subsidy, self-employed professionals and small businesses get half of the cost of simple measures back, such as a password manager, back-ups or a good firewall. In this article you can read who can get the subsidy, which measures count and how to apply. And we show what the subsidy does not see: the building you work in.

What is the My Cyber Resilient Business subsidy?

Mijn Cyberweerbare Zaak (MCZ) is a subsidy from the Dutch government. The National Cyber Security Centre (NCSC) provides the information, and the Netherlands Enterprise Agency (RVO) runs the scheme. The main facts:

• For whom: self-employed professionals and SMEs with up to 50 employees and less than € 10 million in turnover in the last financial year, registered with the Dutch Chamber of Commerce (KVK)
• How much: 50% of the costs, up to € 1,250 per business
• Minimum costs: € 400
• Applications: from 7 September 2026, 09:00 to 30 November 2026, 17:00
• Budget: € 1 million in total, first come, first served
• Number of applications: one application per business
• Required: the advice (PDF) from the NCSC CyberVeilig Check

An example: you buy € 1,800 worth of measures. You then get € 900 back. If the measures cost € 3,000, you get the maximum of € 1,250.

Please note: € 1 million is enough for about 800 businesses that apply for the maximum. So do not wait until the end of November. Check the RVO website for the current state of the budget.

Which measures count?

You can get the subsidy for one or more of these eight measures:

1. Secure network access and WiFi. For example a firewall, access points or a router that protects your network well.
2. A password manager. A program that stores strong, unique passwords for you.
3. Two-step verification. A second check on top of your password, for example a code on your phone (2FA or MFA).
4. Updates. Software or a service that makes sure your computers and programs always have the latest security updates.
5. Antivirus. Software that stops viruses and other harmful programs.
6. Back-ups. Setting up and testing back-ups, so you get your data back after an attack or a failure.
7. A risk assessment (RI&E). An assessment of the digital risks of your business. This does not count if it is part of a certification such as ISO 27001.
8. Training. Courses for you and your employees, for example on recognising phishing.

For the exact conditions per measure, always read the information from RVO.

How to apply, in three steps

1. Do the CyberVeilig Check. This free check by the NCSC takes a few minutes. You get advice with the actions that matter most for your business. Download the advice as a PDF: you need it for your application. Go to the CyberVeilig Check (in Dutch).
2. Buy and put the measures in place. Choose the measures from your advice. Buy them, have them installed and pay for them in full. Keep the invoices and the bank statements.
3. Apply to RVO. Upload the advice, the invoices and the proof of payment. You will hear within eight weeks whether you get the subsidy. Go to the application at RVO.

Avoid these mistakes:

• Measures you bought or paid for before 7 September 2026 do not count.
• Only apply once everything has been paid. A quotation is not enough.
• A payment through PayPal or a printout from your accounts is not valid proof of payment. Use a bank statement.
• Without the advice from the CyberVeilig Check, your application will be rejected.

What the subsidy does not see: your building

The subsidy and the CyberVeilig Check are about your business: your laptops, your accounts, your employees. That is a good start. But your network does not start at your desk. It starts where the internet cable enters the building.

Most small businesses rent their space. An office in a multi-tenant building, a practice above a shop, a unit on a business park. Then part of your security is not in your own hands. Think of these situations from practice:

• The cable from your internet provider runs through a meter cupboard or patch cabinet that is not locked, or that all tenants can open.
• The building has one WiFi network for everyone, and you share it with your neighbours and their guests.
• The cameras, the access gates and the heating are on the same network as the tenants.
• When something fails, nobody knows who is responsible: the landlord, the property manager or the provider.

A new firewall then only helps in part. Anyone who can physically reach your cable or the patch cabinet can get around your security. Read more in who can physically reach your network?

The subsidy protects your business. The IT-Label shows whether the building you work in does the same.

Six questions for your landlord

Are you using the subsidy for measure 1, secure network access and WiFi? Then first ask your landlord or property manager these six questions. That way you know whether your investment fits the building.

1. Who can access the meter cupboard, the patch cabinet and the server room? Are they locked, and who has the key?
2. Is my network separate from that of other tenants? The WiFi too?
3. Are the building systems on their own network? Think of access control, cameras, lifts and climate control.
4. May I use my own internet connection and equipment? And where may it be placed?
5. Who do I call in case of a failure or a break-in on the network? Is that in the lease?
6. Does the building have an IT-Label? Then the digital quality of the building has been assessed independently.

Your landlord does not know the answer? That is nothing to be ashamed of, but it is a signal. Read who arranges what in rented property in who arranges the IT in rented property? and in IT in the ROZ lease agreement.

How the IT-Label helps you

The IT-Label is the independent standard for the digital infrastructure of buildings. Where the CyberVeilig Check looks at your business, the IT-Label looks at the building: the connection, the cabling, the technical rooms, the WiFi, the building systems and how they are secured. That is how they complement each other.

• Are you moving or renting a new space? Look up the property in Find your IT-Label. If the building has an IT-Label, you know in advance which digital level you get. See also the IT-Label for tenants.
• Do you want to know where your current space stands? In an IT-Label Pre-inspection, a Certified Partner looks at the digital infrastructure of your space and the building. You get a report with the strong points and the points for attention.
• Need help with the measures? Our Certified Partners are IT companies that can help with the measures from the subsidy, such as a firewall, secure WiFi or back-ups. Because they work with the IT-Label method, they also look at the building: where your cable comes in and who can reach it.

To be honest about one thing: an IT-Label Pre-inspection or certification is not one of the eight measures of the subsidy. The subsidy is for the measures in your business. The IT-Label is the next step, for the building.

Frequently asked questions

Am I eligible for the subsidy?

Yes, if you are registered with the Dutch Chamber of Commerce (KVK), have up to 50 employees and had less than € 10 million in turnover in the last financial year. Self-employed professionals can apply too.

Does a new router or firewall count?

Yes, they fall under measure 1, secure network access and WiFi. Access points count too. The purchase must have been made and paid for after 7 September 2026.

Can I combine several measures?

Yes. You make one application per business, but you can include several measures in it. Together they must cost at least € 400. You get half back, up to € 1,250.

What if the budget runs out?

Then you can no longer get the subsidy, even if the application period is still open. If more applications come in on the day the budget runs out, there is a draw. So apply in time.

Do I get the subsidy for an IT-Label Pre-inspection?

No. An IT-Label Pre-inspection is not one of the eight measures. The subsidy is for the security of your business; the IT-Label is about the digital quality of the building. They complement each other, but they are two separate steps.

Where can I find the full conditions?

On the RVO website, where you also apply. There is a summary in English on business.gov.nl. For questions, you can call RVO on +31 88 042 44 00.

Start today

The subsidy is a good chance to get the basics of your security in order, with half of the cost paid. Do the CyberVeilig Check, put the measures in place and apply in time. And do not forget the building: ask your landlord the six questions.

Want to stay up to date on new schemes, legislation and the digital security of buildings? Sign up for the newsletter.

Sources: NCSC, Mijn Cyberweerbare Zaak subsidy; RVO, Mijn cyberweerbare zaak (MCZ); business.gov.nl. Checked on 14 October 2026. The conditions of RVO always prevail.