50% subsidy for cyber resilience. Make the investment before 30 November.

Mijn Cyberweerbare Zaak (MCZ) is a subsidy administered by the Netherlands Enterprise Agency, RVO. The National Cyber Security Centre, NCSC, provides information and the CyberVeilig Check that you need for your application. This is not a subsidy from the Dutch Data Protection Authority (AP).

For 2026, €1 million is available. The scheme reimburses half of eligible purchase or implementation costs, up to €1,250. For example, €1,000 in eligible costs can yield €500 in subsidy; €2,500 reaches the €1,250 cap. These are calculation examples, not Heldr prices or a promise of approval.

The scheme targets self-employed people and micro and small businesses registered with the Dutch Chamber of Commerce, with no more than 50 employees. RVO's detailed conditions require turnover of less than €10 million in the previous financial year. Eligible costs must be at least €400. You finance the measures upfront and submit one application per enterprise; linked businesses count as one enterprise.

Further conditions apply. You cannot receive another subsidy for the same costs, must remain below the de minimis limit of €300,000 in government support over three years, and cannot primarily supply cyber resilience measures yourself. Primary agricultural production, fisheries and aquaculture are excluded. Check the complete RVO conditions before committing to a purchase.

• Secure network access and wifi
• Password managers
• Two-factor or multi-factor authentication for internal applications
• Structural patch management
• Antivirus software
• Setting up and testing backups
• Risk assessment and evaluation
• Cyber awareness training for staff

These are concrete improvements, not a free budget for everything labelled compliance. Password managers and antivirus software are eligible for a maximum of one year. Patch management must be a structural improvement, not a one-off update. A risk assessment within an ISO 27001 certification programme is excluded. A training must be about cyber risks. An AI literacy course is therefore not automatically eligible.

The scheme focuses on internal business systems. Measures for websites, webshops, online platforms, payment systems and cloud workspaces are excluded. General subscriptions such as Microsoft 365 Premium or Google Workspace, existing licences, general IT management and certification costs are not eligible either.

RVO excludes measures purchased, implemented or paid for before 7 September 2026. Its conditions also state that measures must have been obtained after 7 September, implemented and paid in full. If you already received MCZ support in 2023, 2024 or 2025 for a category, you cannot claim that same category again in 2026. Do not assume a new supplier makes it a new category.

Start with the NCSC CyberVeilig Check and save your personalised advice as a PDF. Without that document, RVO rejects the application. Heldr's own scan does not replace this mandatory check. Then select eligible measures, implement them and pay in full. You do not have to complete every recommendation in the advice to apply.

Apply to RVO with the advice PDF, specified invoices and the corresponding bank statements. Invoices must show supplier and customer details, what was delivered, dates and amounts including and excluding VAT. RVO requires eHerkenning level 2+ with the relevant RVO authorisation. The deadline is 30 November 2026 at 17:00 Dutch time, not midnight.

Do not leave it until the last day. The €1 million budget is allocated in order of receipt; if it is exceeded on a day with several applications, a lottery determines which can still be funded. Missing documents can push your effective receipt date back to when the application is complete. RVO warns that there may be too little time to correct an application submitted in the final two weeks.

Start with the gap in your business, not with the maximum subsidy. Can staff recognise phishing? Do you know which accounts have access to sensitive information? Has anyone tested whether a backup can actually be restored? Choose a measure that addresses a real weakness, with a clear result and evidence of delivery.

Through Training & capacity, you can discuss your cyber resilience needs with Heldr. We first look at your situation and the fit with an eligible category, for example cyber awareness training or a standalone risk assessment. General AI training, temporary staffing and platform subscriptions are not automatically covered. Agree the scope and invoice specification before work starts. RVO assesses eligibility and decides on your application; contacting Heldr is not a subsidy application and does not guarantee reimbursement.