This autumn the Dutch government covers half the cost of basic measures such as a password manager, MFA and backups, up to 1,250 euros per organisation. The Mijn Cyberweerbare Zaak scheme runs until 30 November, but its one-million-euro budget is allocated on a first-come basis. What qualifies, what does not, and how to apply.
A password manager for the whole team, MFA on every internal application, a backup that is actually tested. These are measures everyone agrees are sensible, and yet they often get postponed because the bill for them never quite fits a tight annual budget. This autumn that excuse holds up less well. Through the Dutch grant scheme Mijn Cyberweerbare Zaak, the Netherlands Enterprise Agency reimburses half the cost of such measures, up to 1,250 euros per organisation.
The scheme is not an alternative to the Cyberbeveiligingswet, the Dutch Cybersecurity Act that has imposed a statutory duty of care and a reporting duty on more than 8,000 larger and critical organisations since 15 August. Mijn Cyberweerbare Zaak is aimed at self-employed professionals and small businesses that fall outside that law, but are targeted by phishing, ransomware and account takeovers more often than their size would suggest. For an organisation that structurally has little room for security spending, this is a direct way to close that gap.
Mijn Cyberweerbare Zaak has been open for applications since 7 September and closes on 30 November at five in the afternoon. The available budget is one million euros, allocated in order of arrival. That matters: anyone who waits until the final week risks finding the pot already empty before the formal closing date. The reimbursement is fifty percent of the purchase and implementation cost of one or more measures, with a maximum of 1,250 euros per applicant and a minimum of 400 euros in eligible costs to qualify at all.
The target group is narrowly defined: self-employed professionals and micro and small businesses with at most fifty employees and annual turnover up to ten million euros, registered with the Dutch Chamber of Commerce. One application per business is allowed, and related businesses count as one. A de minimis ceiling of 300,000 euros in government support over three years also applies, which will not be a practical obstacle for most small organisations.
The scheme names eight categories. Secure network access, think of a firewall, a business access point or a router that goes beyond a provider's default settings. A password manager, for up to a year of subscription costs. Two-factor or multi-factor authentication for internal applications. Patch management, aimed at structural, automatic updating rather than occasional manual work. Antivirus software, also for up to a year. Setting up and testing backups, including a NAS with hard drives if purchased for that purpose. A risk assessment, unless it forms part of a certification track. And a cyber awareness training for staff, often the measure with the highest return per euro spent.
The exclusions matter as much as the eligible categories. Measures for websites, webshops, online platforms, payment systems and cloud workspaces do not qualify, the scheme targets an organisation's internal baseline security, not customer-facing systems. Certification costs such as for ISO 27001 are excluded, as are ongoing subscriptions you already had, such as Microsoft 365 or Google Workspace. A measure for which you already received a grant in an earlier round does not qualify again.
The application follows a fixed order, and that order is not optional. First you complete the free CyberVeilig Check from the Dutch National Cyber Security Centre, which produces a personal action list. That list must be submitted with the application, without it the application is rejected. Next you purchase the measures, implement them and pay for them in full, only then can you apply. Invoices and proof of payment from before 7 September do not count, so anyone who already bought a password manager earlier this year cannot claim those costs retroactively. The application itself runs through RVO and requires eHerkenning at a minimum of level eH2+ with authorisation for RVO services. RVO decides within eight weeks, and on a day when several applications together exceed the remaining budget, a draw decides who still gets a slot.
The timing is not a coincidence. Now that larger organisations are required under the Cyberbeveiligingswet to assess their own supply chain, the baseline digital security of smaller suppliers is increasingly becoming part of the conversation around a contract or an assignment. In late September, the first IT service providers earned the new Digitale Basisveiligheid MKB mark, a certification that shows whether a supplier actually applies the National Cyber Security Centre's basic principles. That mark is a separate initiative from this grant, but both point the same way: baseline measures are no longer only an internal choice, they are increasingly becoming a condition for staying in business with others.
For anyone wondering which measures deliver the most for the available budget: a password manager and MFA are usually the cheapest step with the biggest impact, since most incidents at small organisations start with a taken-over account. A working, tested backup then determines whether a ransomware infection is an annoying hour or a week of downtime. Zarioh helps organisations choose and set up exactly these measures, and is happy to help gather the invoices and documentation the application requires. Feel free to get in touch to find out where your organisation gets the fastest result from the available budget.
Zarioh Digital Solutions
IT specialists from Utrecht, the Netherlands. We help businesses with Microsoft 365, AI agents, hosting and telephony, and share what we learn in practice. Follow us on LinkedIn
