Mittelstand-Digital ITSiWi focus projects

Cybersecurity transfer at scale: focus projects bring practical protection solutions to SMEs, skilled trades and start-ups.

The BMWE funds time-limited focus projects that develop quickly applicable cybersecurity solutions for small and medium-sized companies, skilled trades and start-ups, and carry them out to a wide audience. Consortia of transfer, application and expertise partners can apply. The funding runs through the IT security in business programme (ITSiWi) within the Mittelstand-Digital initiative. The next deadline for project outlines is 1 August 2026; before submitting, confirm the status with the DLR project management agency, as the framework programme runs only to 30 June 2026.

Eligibility

A consortium of at least two partners with complementary roles (mandatory: at least one expertise partner; strongly recommended: one transfer partner and one application partner)
The main target group for the transfer products is SMEs, craft businesses and/or start-ups in Germany
A clear transfer character: at least two thirds of the project term devoted to transfer to the target group; first usable results within 6 months
The project addresses at least one of the topics published in the topic paper for the relevant deadline (for 1 August 2026: the topic paper appears around April 2026 at mittelstand-digital.de), or justifies a free topic convincingly
All consortium partners have their registered office and operating site in Germany
Not an undertaking in difficulty under Art. 2 no. 18 GBER; no outstanding EU recovery order
An explicit delimitation from the offerings of the Transferstelle Cybersicherheit and existing Mittelstand-Digital centres
No early start before the funding decision is received
No double funding of the same cost items through other public programmes

Eligible costs

Staff costs (companies, AZK): IT security specialists, transfer managers, training developers, web developers, association officers, apportioned to the project
Staff expenditure (universities and research institutions, AZA): research staff, transfer management, plus a 20% project flat rate (universities only)
Materials and consumables: printing costs for guides and brochures, training materials, pro rata platform licences
Equipment depreciation (pro rata): test hardware for detection demonstrators, servers for self-assessment platforms
Travel under the BRKG: multiplier workshops, pilot user visits, consortium meetings, conferences (it-sa, the BSI congress and so on)
External services and subcontracts: external penetration tests, designers for transfer materials, translations, platform development, hosting of self-assessment tools, printers, training and coaching providers
Event and transfer costs: room hire, catering (pro rata), speaker fees, webinar licences, roadshows
Communication and marketing costs: social media advertising, newsletter tools, press work, at a moderate level and project-related

Common pitfalls

The deadline missed or suspended

The 1 August 2025 deadline was suspended in 2025. The next known deadline is 1 August 2026; before starting work on an outline, confirm the active status with the DLR project management agency (matthias.hanschke@dlr.de). A missed deadline means a six-month wait.

Too little transfer

Focus projects are transfer instruments, not research projects. At least two thirds of the project term has to be planned for transfer to the target group. Pure tool development or scientific research with no transfer plan leads to rejection.

No concrete transfer product

Vague statements like 'we will publish a guide' aren't enough. The outline has to contain concrete products (a 12-part webinar series, a self-check tool, emergency plan templates) and quantified reach targets (companies reached, multipliers, pilot users).

No delimitation from the Transferstelle Cybersicherheit

The project must not substantially duplicate the offerings of the Transferstelle Cybersicherheit (transferstelle-cybersicherheit.de) or existing Mittelstand-Digital centres. A missing delimitation costs points and can lead to rejection; contacting the Transferstelle in advance is advisable.

An unbalanced consortium

Consortia consisting only of research institutions (with no transfer) or only of associations (with no technical depth) are rejected. At least one expertise partner is mandatory; application partners (SMEs or craft businesses as pilot users) are practically indispensable for a positive assessment.

Starting the work early

No project start — no orders, contracts or hiring for the project — before the funding decision is received. Breaches can lead to full clawback. Submitting the outline and unpaid preparation don't count as starting the project.

The framework programme's end date and the 2027 programme change

The framework programme 'developing digital technologies' runs only to 30 June 2026. Mittelstand-Digital funding is being restructured from 2027. Whether and how focus projects continue is still open as at June 2026, so contact the DLR project management agency before submitting.

The application process

1 – Preparation. Check the current topic paper at mittelstand-digital.de (it appears around 4 months before the deadline). Confirm the deadline's status with the DLR project management agency: matthias.hanschke@dlr.de / 0228 3821-2683. Build a consortium of transfer, application and expertise partners.
2 – Secure multipliers. Obtain letters of intent from at least 3–5 multipliers (chambers, associations, guilds, Mittelstand-Digital centres). The letters should contain concrete transfer commitments and reach figures. Clarify the delimitation from the Transferstelle Cybersicherheit in advance.
3 – Submit the project outline (stage 1). Submit the outline (usually 12–15 A4 pages) through PT-Outline: https://ptoutline.eu/app/md_it-s_fokus. Next deadline: 1 August 2026. Assessment by the ITSiWi steering group, the DLR project management agency, the Mittelstand-Digital accompanying research and the BMWE, taking around 6–8 weeks.
4 – File the full application (stage 2). After a positive outline assessment comes an invitation to apply in full. Submit through easy-Online (foerderportal.bund.de/easyonline/). The deadline is typically 2–3 months after the invitation. Per consortium partner: the form AZK (companies) or AZA (universities and research institutions) with a detailed work and transfer plan, an exploitation plan, an SME declaration (GBER Annex I), a draft consortium agreement and proof of creditworthiness.
5 – Approval and project start. The approval period is around 3 months after the full application. The funding decision comes with ancillary conditions (NKBF 2017 for companies, NABF for universities). The project only starts once the decision has been served: no early start.

How upsmart helps

We match your project against more than 2,000 programmes — including ZIM, KMU-innovativ IKT-SWS and the state lines — and show you whether ITSiWi focus projects are the right instrument or whether a combination makes sense. If the programme fits, we write a draft outline ready for assessment that maps the transfer share, consortium roles and the GBER aid framework (Art. 25 and 31, or de minimis) correctly. We keep an eye on the 1 August 2026 deadline and on the step of confirming with the DLR project management agency.

Combining it with other programmes

No double funding of the same cost items through other programmes (Art. 8 GBER). Complementary funding of other parts of the project through ZIM, KMU-innovativ, the EU Digital Europe Programme or state programmes is possible, provided the costs can be separated. Coordination with the DLR project management agency in advance is recommended.

Frequently asked questions

Consortia of at least two partners can apply. At least one expertise partner (a university, research institution or IT security specialist) is mandatory. One transfer partner (an association, chamber, cluster or guild) and one application partner (an SME, craft business or start-up) are strongly recommended. All partners have to have their registered office and operating site in Germany.

The typical project volume is between €300,000 and €1,500,000. SMEs receive up to 80% of eligible costs, large companies up to 50%. Associations and chambers can receive up to 100% for non-economic transfer work. Universities receive up to 100% of eligible expenditure plus a 20% project flat rate. The funding rates should be confirmed with the DLR project management agency before applying.

The procedure has two stages. First submit a project outline (12–15 pages) through PT-Outline: https://ptoutline.eu/app/md_it-s_fokus. The deadlines are 1 February and 1 August; the next known deadline is 1 August 2026. After a positive assessment, the full application follows through easy-Online. Before starting work on the outline, confirm the deadline's active status with the DLR project management agency.

The topic publication of 13 October 2025 names three priorities: (1) cybersecurity for micro-enterprises with fewer than 10 employees, (2) supply chain security with an NIS-2 angle, and (3) data protection and AI. Outlines on further practical topics can also be submitted where the need is justified particularly convincingly. The topic paper for the 1 August 2026 deadline will be published around April 2026 at mittelstand-digital.de.

ITSiWi focus projects are transfer instruments: at least two thirds of the term has to serve the transfer of cybersecurity knowledge to SMEs, skilled trades and start-ups. ZIM funds market-close R&D with no transfer remit and suits companies wanting to develop their own cybersecurity product. KMU-innovativ IKT-SWS funds leading-edge scientific research into AI and software, not practical transfer.

Read on in the blog

Funding strategy across the innovation process

Primary sources

Mittelstand-Digital — IT security in business (programme overview)— Federal Ministry for Economic Affairs and Energy (BMWE) / Mittelstand-Digital
ITSiWi focus projects — status page and topic publications— Mittelstand-Digital
DLR project management agency — IT security in business (funding offer)— DLR project management agency
Outline submission portal (PT-Outline)— DLR project management agency
Full application submission portal (easy-Online)— Federal Ministry of Finance / BMWE
Transferstelle Cybersicherheit (delimitation and cooperation)— Transferstelle Cybersicherheit (Mittelstand-Digital)
Framework programme for developing digital technologies— Federal Ministry for Economic Affairs and Energy (BMWE)

A 30-minute demo on your actual case. We'll show you how the platform structures funding programmes and makes overlaps with other schemes visible.