Secure Plant: OT security for your plant, with SPRI funding
For Basque industrial companies that cannot stop the line and whose customers already ask for proof of cybersecurity. We prepare the technical project and the application documents, and we do the work without stopping your production.
What we do at your plant
One project, from the first picture to the application, for one plant (one production site in the Basque Country).
- OT inventory using passive listening or tools tested outside production: which equipment and protocols you have and which Purdue model level each one sits at.
- The risks that can stop your production, in order of impact, with an estimated cost to fix them.
- An IT/OT segmentation plan and a plan to control suppliers' remote access.
- A recovery plan: configuration backups kept off the production network and a restore drill.
- Your answer to your customer's security questionnaire, written with real evidence.
- The SPRI application: technical and economic offer with a cost breakdown, and the technical justification of the project.
Technical direction of the roll-out, if you hire it. The OT/ICS audit is a Hodeitek service in its own right, with IEC 62443 and NIST 800-82 as reference standards.
Deliverables
| Deliverable | Format |
|---|---|
| OT asset inventory with Purdue level | Spreadsheet and diagram |
| Prioritised risk report | PDF with an executive summary |
| Segmentation and remote access design | Diagram and rule list |
| Recovery plan and drill report | |
| Answer to the customer questionnaire | Editable document |
| Technical dossier for the SPRI application | Technical and economic offer with a breakdown, as the rules require |
Optional, quoted separately: pentest report and, separately, a retest report (PDF).
Scope
Inside the project
- One plant: one production site in the Basque Country, which the project must affect.
- Assessment, inventory, risk analysis, segmentation design and recovery plan.
- Answer to the customer questionnaire and the SPRI dossier.
Outside, unless contracted separately
- Buying hardware and licences: SPRI does not accept projects that only cover hardware and licences.
- Changes to PLC control logic and to process equipment configuration: your plant's integrator does those.
- IEC 62443 product or plant certification: Hodeitek does not offer it.
- Pentest and retest: both are optional (see below).
Timeline
SPRI's closing date sets the order of the phases: the application dossier comes first, then the assessment.
| Phase | What happens | Duration |
|---|---|---|
| Call and scope | What is protected and which grant fits | 1-2 days |
| SPRI dossier | Technical and economic offer with a breakdown | Before the call closes |
| Assessment and inventory | Passive listening and interviews with maintenance | Set on the scoping call |
| Risks and design | Report, segmentation and recovery | Set on the scoping call |
| Questionnaire and close | Answer to your customer and closing meeting | Set on the scoping call |
We do not promise delivery times without knowing your plant. Phases after the award depend on SPRI's decision and your production calendar.
How the SPRI grant works
Industrial Cybersecurity 2026 programme (SPRI resolution of 27-04-2026, BOPV no. 91, 18-05-2026). Everything below is subject to the rules of the call; always check the official text, which is in Spanish.
| Topic | What the rules say | Article |
|---|---|---|
| Rate and cap | Non-repayable grant of up to 60% of eligible costs, with a maximum of EUR 100,000 per company in the programme. | Art. 7 |
| Eligible costs | Costs incurred or invoiced from 1 January 2026 and during the project's execution period, which may not exceed 12 months from its start. | Art. 6.1.a |
| Who provides the consulting | An «empresa externa experta» (expert external company). | Art. 6.1.b |
| De minimis aid | Regulation (EU) 2831/2023. The limit is EUR 300,000 over the last three years. | Arts. 2.2 and 8.5 |
| Other aid | Not cumulative with other SPRI aid for the same eligible costs. Cumulative with other compatible aid as long as the maximum intensity is respected for those same costs. | Art. 8.1 and 8.2 |
| Who signs | The application must be signed by the person with sufficient power to represent the entity, using an advanced electronic signature. | Art. 9.3 |
| Deadline | Until 23:59 on 23-11-2026. SPRI technical support until 15:00. | Art. 10 |
What it funds, according to SPRI
- Consulting and engineering: initial assessment, master plans, asset inventory, risk assessment, incident response and continuity, disaster recovery and audits.
- OT lines: secure remote access to industrial systems, network segmentation and secure IT/OT architectures.
- SOC and MSSP services, and SaaS for up to 12 months.
Conditions worth knowing
- Every project must include a minimum of consulting or engineering.
- The project must affect a site in the Basque Country.
- Projects that only buy hardware and licences are not funded.
- We do not promise that budget will remain until the closing date: SPRI decides the award.
What Hodeitek does in the process
- Reviews with you whether your plant and project fit.
- Writes the technical and economic offer with a cost breakdown.
- Helps you resolve questions with SPRI.
- After the award, delivers the project and prepares the technical justification.
- Your company signs and files the application, with sufficient power of representation. Hodeitek prepares the documents and delivers the project; it does not act as your representative.
Official sources: Programme at SPRI · Rules in the BOPV · Application portal
Expert external company
Hodeitek is listed in the Libro Blanco de la Ciberseguridad en Euskadi (Basque Cybersecurity White Paper). The rules (art. 6.1.b) require the consulting to be provided by an «empresa externa experta» and presume that status for companies listed in the White Paper, subject to the rules of the call. Check the detail in the official text.
Optional services, quoted separately
- Pentest with an agreed window and scope so production is not put at risk. It is a Hodeitek service in its own right.
- Retest of what was fixed. It is optional and quoted separately.
- 24/7 network monitoring, together with a partner. We help that partner build and maintain the detection rules.
- Staff training and phishing drills.
Who does the work
Hodeitek, certified in ISO 27001 and ENS (Medium category), with verifiable certificate numbers. Scope of both certificates, as printed:
- ISO 27001: 34/5700/26/10159
- ENS, Medium category: 34/5704/26/09103
«The information systems supporting the delivery of the HodeiShield SaaS service (supply chain and compliance management, control, and traceability), penetration testing services (technical security auditing), cybersecurity consulting and technical consulting for ICT systems and services, consulting on AI applied to business, and consulting and design for business process automation including the technological infrastructure, technology services, and personnel required for their delivery in accordance with the current Statement of Applicability.»
A SPRI grant case
We managed AZK Taldea's SPRI cybersecurity grant in January 2024, before the technical roll-out began. AZK is a branding agency, not an industrial plant; we cite it only as proof that we have already managed a SPRI cybersecurity grant. That call is not the 2026 one and we do not carry its amounts over. See the AZK Taldea case
OT and industrial cybersecurity · Cybersecurity in the Basque Country
Before you call: the guide for plant managers
A 25-question self-assessment and a 12-month roadmap, with IEC 62443, NIS2 and the SPRI grant explained for whoever is accountable for production. The PDF is in Spanish.
Frequently asked questions
What does the SPRI grant cover and how much is it?
Do you file the SPRI application for us?
Until when can I apply?
Will you stop my production line?
How much does it cost?
Do you certify IEC 62443?
My plant is outside the Basque Country. Can I apply?
Request your plant assessment
Tell us where your plant is and what is in it. We call you to set the scope and see whether the SPRI grant fits. It is not an order: there is no commitment.