Support for the development of information security | Traficom
Skip to main content
National Cyber Security Center
Report incidents
Report incidents
Report incidents

Support for the development of information security

The application period for support for the development of information security has closed on 31.12.2024. Support for the development of information security, i.e. the information security voucher, could only be granted to businesses in sectors critical to the functioning of society registered in Finland for measures to improve information security in Finland. The support could only be granted for costs that have been generated after the application was submitted and by 31 December 2024 at the latest.

Steps to apply for support for the development of information security

  • Step 1

    Draft a plan for developing the information security of your company

    Assess the current status of information security in your company and draft a plan for measures to improve it. Include in the plan any outsourced services involved and estimate the costs of the development work. You can utilise the Kybermittari tool developed by the National Cyber Security Centre Finland in your assessment.

    Kybermittari – Service and tools for the assessment and development of cyber security in organisations
  • Step 2

    Learn more about eligibility criteria

    Support can be granted, if the following prerequisites are met:

    • The company is registered in Finland.
    • The business is critical in terms of the functioning of society and operates in a sector critical to the functioning of society (food supply, energy supply, financial sector, waste management, chemical industries, logistics, media industry, forest industry, plastics and rubber industry, construction industry, healthcare and social welfare services (incl. pharmaceutical service), military security of supply, technology industry, information society or water management).
    • The measure aimed at developing the company’s information security is directed at the company’s operations in Finland.
    • The company has been operational in the financial period that ended in 2021.
    • The company has not applied for or been granted support for the development of information security previously.
    • The company has the prerequisites for profitable business.
    • The company has no tax debt or the company has a payment plan for the outstanding taxes approved by the Tax Administration.

    Other prerequisites

    • A company may be granted either one voucher of up to EUR 15,000 or one voucher of up to EUR 100,000, not both or several vouchers of up to EUR 15,000 or up to EUR 100,000.
    • Support of up to EUR 15,000 can only be granted to companies with fewer than 250 employees and an annual turnover of up to EUR 50 million or a balance sheet total of up to EUR 43 million. The company must also be independent.
    • Support of up to EUR 15,000 can be obtained for the inspection and assessment of information systems, procurement aimed at improving information security, training of personnel or skills development or any other corresponding measure that develops the information security of enterprise.
    • Support of up to EUR 100,000 can be obtained for an attack prevention test, a test of the readiness level of the main electronic services or a direct measure that improves information security as a result.
    • Support for developing information security is a so-called de minimis form of support, and according to the EU regulation, a company may be granted up to EUR 200,000 of de minimis support during the current and two previous tax years. Any support granted to Finnish companies within the same group or under the same authority are added together.
    • The state budget has appropriations for the payment of the support.
    • The prerequisites for granting support specified in the Government decree on supporting the development of information security (860/2022) and Act on Discretionary Government Transfers (688/2001) are met.
  • Step 3

    Apply for support with Traficom

    Before filling in the application form, you will be asked a series of preliminary questions. After answering them, you will be asked to verify your identity, after which you may fill in the application. The application system requires the use of strong electronic identification means (online bankin details, mobile certificate, or personal or organisation certificate).

    When applying for support on behalf of a company, you must be included in the Trade Register as a person authorised to represent the company or you must have a Suomi.fi mandate ('Applying for information security development support') to apply for the support on behalf of the company.

    After you have submitted your application, Traficom shall reserve funds from the funds allocated to support for the development of information security according to your application. Traficom may always ask for further information to verify matters related to the support application.

    Apply for support for the development of information security

  • Step 4

    Processing, granting and payment of the support

    Support applications are processed in the order of arrival. Traficom will contact the contact person specified on the application, if the information provided on the application needs to be clarified or supplemented.

    After processing the application, Traficom will issue an administrative decision on whether the application has been approved or rejected. The decision will be provided to the company that applied for the support.

    Companies may allocate funds from the information security development support directly after submitting the application, but companies must cover any costs themselves, if their application is rejected or the costs of their measures exceed the support sum granted by the decision.

  • Step 5

    Making purchases related to measures aimed at the development of information security

    When making purchases related to measures aimed at the development of information security, the company receiving the support must comply with the Act on Public Procurement and Concession Contracts (1397/2016). The Act is applied to companies receiving support for the development of information security, if the support applied and granted for exceeds 50% of the value of the procurement and the procurement involves goods, services, public works contracts or concession contracts. As a rule, support for the development of information security is only granted for procurement that involves goods, services or concession contracts. The Act imposes the obligation to subject any procurement whose total value equals or exceeds EUR 60,000, exclusive of VAT, to competitive bidding.

  • Step 6

    What happens after the measures aimed at the development of information security?

    Support recipients must provide the Finnish Transport and Communications Agency with a report on how the support was used and how the measures affected the company’s information security no later than six months after the costs covered by the support arose. In the case of support in the EUR 100 000 category, 30% of the support granted will be paid on the basis of an approved report.

    Instructions for submitting the report can be found in the report form below, and the completed form is sent to the Finnish Transport and Communications Agency.

    The report should be sent by e-mail to kirjaamo@traficom.fi or by post to the Finnish Transport and Communications Agency Traficom, P.O. Box 320, 00059 TRAFICOM. The title of the e-mail should be "Report on support for the development of information security, [name of applicant], [record number of the support decision]". Instructions for sending secure email can be found here.

    Selvitys tietoturvan kehittämisen tuen käytöstä (lomake) (docx, 64 kt)

What is the support for the development of information security all about?

Support for developing information security is direct government support paid to companies in sectors critical to the functioning of society for measures aimed at improving information security.

How much funds have been appropriated for the support?

A total of EUR 6 million has been appropriated for the support. Of this, EUR 2 million can be granted as individual vouchers of EUR 100,000. Because the funds allocated for the support paid out in vouchers of up to EUR 100,000 is limited to EUR 2 million, a minimum of EUR 4 million can be granted to small and medium-sized companies in individual vouchers of up to EUR 15,000.

For whom is the support intended?

The support is intended for companies that are registered in Finland and that operate in sectors critical to the functioning of society in one or more of the following fields: food supply, chemical industries, plastics and rubber industry, technology industry, energy supply, logistics, construction industry, information society, financial sector, waste management, media industry, healthcare and social welfare services (incl. pharmaceutical service) and water management. The companies in question offer basic infrastructure, services and related functions, which are necessary for the maintenance of functions vital to society. Functions vital to society are (social) leadership, international and EU operations, defence, internal security, functional capacity of and services for the population, psychological resilience and the economy, infrastructure and security of supply.

How to apply?

The support is applied for with the Finnish Transport and Communications Agency using an electronic application form. The application form is also available as a PDF file that must be signed by hand or electronically and submitted to the Finnish Transport and Communications Agency via email or post. The application forms are only available in Finnish and Swedish.

What can the support be used for?

The support may be used towards the measures specified below aimed at improving the information security of the company in Finland and the resulting costs that have been generated after the application was submitted and by 31 December 2024 at the latest.

The support may be used towards i) the purchase of tools, devices and service licences supporting the development of information security, ii) training aimed at improving information security expertise, iii) research, development and/or innovation activities supporting the development of information security and/or iv) the purchase of consulting services supporting the development of information security.

Which costs can be covered by the support?

The following costs arising from measures aimed at the development of the information security of the company receiving the support may be covered by the support: 1) costs of tools, devices and service licences for the time when they were used for information security development and for the share of these used for the same; if tools, devices and licences are not used for information security development for the entire duration of their use, only depreciations corresponding to the duration of the information security development measures calculated based on generally accepted accounting principles are deemed eligible for support, 2) costs of training aimed at improving expertise, such as training entities, small competence entities or degree units, 3) costs of research, development and innovation activities, 4) costs of consulting and similar services, when they have been used exclusively for the development of information security, 5) costs directly arising from a project aimed at developing information security, such as costs arising from attack prevention testing, 6) costs of materials, equipment and similar products, travel expenses in Finland and other costs arising directly from information security development projects.

The support may not be used towards costs of applying for support, purchases from associated companies or group companies or the company’s own payroll costs.

What are the responsibilities of support recipients?

Support recipients must provide the Finnish Transport and Communications Agency with a report on how the support was used and how the measures affected the company’s information security no later than six months after the costs covered by the support arose.

What is the support for the development of information security all about?

Support for developing information security is direct government support paid to companies in sectors critical to the functioning of society for measures aimed at improving information security.

How much funds have been appropriated for the support?

A total of EUR 6 million has been appropriated for the support. Of this, EUR 2 million can be granted as individual vouchers of EUR 100,000. Because the funds allocated for the support paid out in vouchers of up to EUR 100,000 is limited to EUR 2 million, a minimum of EUR 4 million can be granted to small and medium-sized companies in individual vouchers of up to EUR 15,000.

For whom is the support intended?

The support is intended for companies that are registered in Finland and that operate in sectors critical to the functioning of society in one or more of the following fields: food supply, chemical industries, plastics and rubber industry, technology industry, energy supply, logistics, construction industry, information society, financial sector, waste management, media industry, healthcare and social welfare services (incl. pharmaceutical service) and water management. The companies in question offer basic infrastructure, services and related functions, which are necessary for the maintenance of functions vital to society. Functions vital to society are (social) leadership, international and EU operations, defence, internal security, functional capacity of and services for the population, psychological resilience and the economy, infrastructure and security of supply.

How to apply?

The support is applied for with the Finnish Transport and Communications Agency using an electronic application form. The application form is also available as a PDF file that must be signed by hand or electronically and submitted to the Finnish Transport and Communications Agency via email or post. The application forms are only available in Finnish and Swedish.

What can the support be used for?

The support may be used towards the measures specified below aimed at improving the information security of the company in Finland and the resulting costs that have been generated after the application was submitted and by 31 December 2024 at the latest.

The support may be used towards i) the purchase of tools, devices and service licences supporting the development of information security, ii) training aimed at improving information security expertise, iii) research, development and/or innovation activities supporting the development of information security and/or iv) the purchase of consulting services supporting the development of information security.

Which costs can be covered by the support?

The following costs arising from measures aimed at the development of the information security of the company receiving the support may be covered by the support: 1) costs of tools, devices and service licences for the time when they were used for information security development and for the share of these used for the same; if tools, devices and licences are not used for information security development for the entire duration of their use, only depreciations corresponding to the duration of the information security development measures calculated based on generally accepted accounting principles are deemed eligible for support, 2) costs of training aimed at improving expertise, such as training entities, small competence entities or degree units, 3) costs of research, development and innovation activities, 4) costs of consulting and similar services, when they have been used exclusively for the development of information security, 5) costs directly arising from a project aimed at developing information security, such as costs arising from attack prevention testing, 6) costs of materials, equipment and similar products, travel expenses in Finland and other costs arising directly from information security development projects.

The support may not be used towards costs of applying for support, purchases from associated companies or group companies or the company’s own payroll costs.

What are the responsibilities of support recipients?

Support recipients must provide the Finnish Transport and Communications Agency with a report on how the support was used and how the measures affected the company’s information security no later than six months after the costs covered by the support arose.

Page was last updated