Note: the figures reported in the performance sheet for the Digital Europe Programme should be treated with caution.
The observations of the European Court of Auditors invite at least that caution.
It focused on the cybersecurity component, endowed with around €1.4 billion for 2021-2027. The allocation of this envelope relies primarily on calls for proposals.
When the data reported do not match the data collected
Within the framework of each project, quantitative data must be reported on four aspects:
- Infrastructures and/or cybersecurity tools that are the subject of joint public procurement
- Infrastructures and/or cybersecurity tools deployed
- Users and user communities having access to European cybersecurity facilities
- Support measures to prepare and respond under the emergency mechanism established by the cyber solidarity regulation
The European Cybersecurity Competence Centre (ECCC) is the manager of this strand of the programme. As such, it must collect and verify the data in question. It is supposed to incorporate them into the grant management system before mid-term project reviews as well as before the final review.
That is not done systematically, notes the European Court of Auditors. In the sample of projects it audited, this was the case for only 3 of the 7 mid-term projects. Furthermore, the data were incorrect in two cases. In one, they did not pertain to the right indicator. In the other, they matched the target values rather than the actual results.
To compile the indicators, the ECCC does not use the grant management system. It prefers questionnaires addressed to beneficiaries. In any case, the data collection methods and overall quality leave room for improvement. The data gathered simply do not correspond to the values shown in the performance sheet. The Court of Auditors does not know how they were calculated. There is no evidence that the ECCC verified their accuracy, it asserts.
Co-financing, tendering… Several projects running into trouble
Even before monitoring, the implementation of projects poses problems. The 11 examined here are spread across three axes: cross-border cyber hubs, national coordination centres*, and the development of SOC capabilities. All funded for the period 2022-2025, they benefited from EU subsidies ranging from €1 to €7 million, for a total of about €38 million.
Among those facing difficulties is ILG-SOC. Launched in October 2023 for 3 years, it aimed to establish a central SOC for 31 local authorities in Ireland. Several procurement procedures failed or were delayed.
Another project that did not progress as planned: EL-SOC. Launched in January 2024 for 3 years, it was to culminate in a global SOC gathering the information from sectoral SOCs in Greece. The process of publishing the technical specifications of the call for proposals delayed the procurement of equipment and services. The project also struggled to obtain national cofinancing.
Ownership checks, a heavy-handed approach
For security reasons, it is possible to restrict the beneficiaries of funding to entities established in the EU and controlled by EU Member States or EU citizens. This can add to operational difficulties. Moreover, the obligation to exercise control also applies to subcontractors.
In 3 of the 11 projects, at least one beneficiary or consortium was excluded on this basis. Two members of NG-SOC were excluded. The announcement came about a month before the deadline for signing the grant agreement. Lacking time to find a new partner, the coordinator “recovered” the portion of work. One of the two excluded members operating in a sector where the pilot project was to be conducted could not carry out that component as planned.
Indicators often too numerous or poorly defined
Beyond what appears in the performance sheet for the Digital Europe Programme, most projects have inappropriate monitoring frameworks.
Few projects comply with guidelines on the number of milestones and deliverables. Many also fail to provide clear wording. As a result, they generate progress-tracking elements that are of little use (for example, “meeting to start drafting the research call” or “official project meeting minutes”). At the same time, many performance indicators are not measurable and/or lack a target or baseline.
The audit report offers a positive note: two projects delivered tangible results for SMEs. One (GR-SME-SOC) aims to establish, in Greece, a SOC that will offer them free solutions for a year before commercializing them. The other (NCC-IE) will have disbursed around €1.8 million in subsidies to about fifty Irish SMEs. Specifically, companies that underwent a cybersecurity review managed by the government agency Enterprise Ireland. The subsidies cover 80% of the implementation costs of the recommendations (up to €60,000).
* National coordination centres are located in the 27 Member States as well as Iceland and Norway. They provide support to the ECCC.
