1 Programme Description 

1.1 The Programme

Digital Security by Design (“DSbD”) challenge was launched by UK Research and Innovation in 2019 to improve the current insecure foundations computing infrastructure.

The Digital Security by Design Technology Access Programme (“DSbD TAP”) is an awareness and acceleration programme that addresses the cybersecurity challenges faced by embedded product and software companies.

The programme provides the tools, resources and expertise needed to assist experimentation with the new CHERI architecture and Morello board for enhanced digital security.

1.2  The Digital Catapult

Digital Catapult is the UK authority on advanced digital technology. Through collaboration and innovation, we accelerate industry adoption to drive growth and opportunity across the economy.

We bring together an expert and enterprising community of researchers, startups, scaleups and industry leaders to discover new ways to solve the big challenges limiting the UK’s future potential. Through our specialist programmes and experimental facilities, we make sure that innovation thrives, and the right solutions make it to the real world.

Our goal is to accelerate new possibilities in everything we do and for every business we partner with the journey – breaking down barriers, de-risking innovation, opening up markets and responsibly shaping the products, services and experiences of the future.

Digital Catapult works with organisations on projects involving at least one of the technologies from its “Advanced Digital Technology Stack”: Artificial Intelligence, Immersive, Internet of Things, Distributed Ledger Technologies and Future Networks.

1.3 The Programme Judges

During the application stage, the judges will be responsible for scoring the applications according to the criteria set out in these Programme Competition Terms. The judges have/will be chosen based on (i) their experience and expertise, and (ii) ability to exercise independent judgement.

Internal Judges

A number of judges from Digital Catapult will help judge the applications.

Challenge Owner Judges 

A number of judges from ARM Ltd. and University of Cambridge may help judge the applications.

Stakeholder Judge

A number of judges from UKRI may help judge applications.

1.4 The Programme Partners

Programme Funders

Digital Catapult is working as Innovate UK’s delivery partner on this UKRI funded programme.  InnovateUK is the UK’s innovation agency, and is part of UK Research and Innovation.

Programme Industry Partners

Arm Ltd. 

University of Cambridge

1.5 Applicants & Participants

You are considered an “Applicant” if you apply to this competition.

You are considered a “Participant” if you are successful with your application and complete all pre-project activities (e.g. signing the Participation Agreement).

There are two tiers to this Open Call.  Tier 1 is for SMEs only. Tier 2 is open to all sizes of business.

2 Programme Benefits 

Participants on the Programme will receive the following benefits:

Tier 1 Exclusive Benefits (SMEs only):

• £15,000 grant funding during the course of the 6 month programme

Tier 1 & Tier 2 Benefits:

• Get access to the Arm designed Morello evaluation board
• Access to CHERI architecture developed by researchers at University of Cambridge
• Be a part of and collaborate with the wider DSbD ecosystem
• Participate in group learning sessions, and focused activities on topics relevant to the programme
• Receive technical guidance from DSbD experts 
• Explore the performance and security benefits of CHERI in real-world scenarios
• Help build an early adopter community within the UK and promote the adoption of DSbD technology in the UK
• Influence the global computer industry, contributing to further improving the CHERI and Morello architecture 
• Receive brand exposure on all Digital Catapult and DSbD platforms by being part of the programme
• Be highly visible as being a company conscious about the security of its products and customers
• Upon successful completion of the Project, there may be opportunity to join the Digital Catapult Alumni Network, or the Digital Catapult DSbD Alumni Network, which keeps them informed of opportunities and relevant updates from the Digital Catapult, and which provides additional opportunities to engage with Digital Catapult and other Alumni.

3 Programme Obligations

3.1 Participants on the Programme must commit to the following obligations:

Tier 1 Participants Only

• Participate in the onboarding day.
• Participate in 5 peer to peer sessions throughout the acceleration programme.
• Alignment and 1:1 tech sessions each month.
• Provide an updated project plan in Month 1, of your intended use-case / experimentation. This should ideally be based on your original application, but we are open to discussion changes to plans.
• Provide an interim technical report in Month 3 based on the experience gained from the project and highlighting your progress so far.
• Present a demo of your solution running on and being hardened by CHERI/Morello at the demo day.
• Provide a final technical report in Month 6 based on the experience gained from the project and the progress of your project.
• Provide a final case study for marketing purposes.
• Participate in the showcase.

Tier 2 Participants Only

• Participate in the onboarding day.
• Provide feedback survey at the end of Month 3 and Month 6 on the use of the technology and the outcomes of your project.
• Participate in the final demo day.

All Participants (Tier 1 & Tier 2)

• Comply with the Morello Board T&Cs, as issued by ARM ltd.
• Comply with Export Control Requirements, in particular by not exporting the Morello Boards outside of the UK, including by providing access to nationals (even if they are employees) from E:1 listed countries.
• Participant agrees to be visibly (name and logo) associated with the Programme, whilst on the Programme and afterwards as a former participant and beneficiary.  This includes marketing collateral, such as website, print and digital materials.
• For a maximum period of five years following the Project end date, Participant shall use its reasonable endeavours to answer specific questions from Digital Catapult relating to its growth and progress to assist Digital Catapult to demonstrate the impact of its activities. This shall include: (i) participation in an annual telephone conversation of up to one hour, and (ii) participation in a two yearly survey issued by Digital Catapult.

4 Applicants

4.1 Minimum Requirements 

Tier 1 Applicants

• Applicants must be eligible to receive £15,000 in Special Drawing Rights/De Minimis Aid (see section “Competition Terms – paragraph 8.2 “State Assistance” for further details).
• Applicants must have a UK business bank account

Tier 1 & Tier 2 Applicants

• Applicants must be a UK based registered company, or prove they have an establishment in the UK and undertake the activity in the UK.

4.2 What we’re looking for

The DSbD Technology Access Programme has been designed for all types of businesses, from early stage startups looking to refine business propositions to mature organisations seeking early access to revolutionary technology before it is fully ready for commercial deployment. 

The CHERI architecture has wide appeal and is not restricted to any particular industry. We are looking at startups, scaleups and mid-size companies who want to make their systems and products more secure from cyber threats and vulnerabilities. 

The architecture is currently only available for:

Linux/Android/CheriBSD Operating Systems. The Morello FVP runs on Linux for testing/PoC purposes. Additional operating system enablement is currently being addressed by a joint development between Arm, University of Cambridge, Microsoft and Google.

5 Key Dates 

1. • Applications Open – 11th January 2023
   • Application Deadline – 26th March 2023
   • Intended notification of all Applicants – April/May 2023
   • Intended public announcement of successful Participants: June 2023
   • Project:
     • Start Date: w/c 22nd May 2023 (programme onboarding day)
     • End Date: November 2023 (exact date TBC)

6 Application 

6.1 What information should my application contain? 

Applicants must answer all required questions in the full online application form relevant to the Tier applied for.  Note: You may only apply for one Tier. 

6.2 Who will see my Application?

Digital Catapult Representatives

Relevant Digital Catapult representatives will see your application in order to assess the application, and otherwise in the administration of your application and, if successful, participation in the Programme.

Programme Funders

Relevant IUK representatives (and other Government representatives) will see your application in order to assess the application, Programme, and otherwise in the administration of your application and, if successful, participation on the Programme, including its statutory duties

Internal Judges

The internal panel of judges will see the complete application.

Challenge Owner Judges 

The challenge owner judges will see the complete application, except for personal information fields.

Stakeholder Judges

The stakeholder judges will see the complete application, except for personal information fields.

6.3 Key contact information 

6.3.1 Applicants will appoint a main contact for the Programme (“Key Contact”). This person will be Digital Catapult’s (as Data Controller) main point of contact for the competition and, if successful, defining the Project activities, including: workshop and event commitments, team members’ availability, ongoing activities, and assessment of progress during and after the Project.

6.3.2 Digital Catapult will use this personal information for the purpose of carrying out due diligence on Applicants prior to the point of selection onto the Programme and to notify successful and unsuccessful Applicants over their submissions. The personal data we collect may be shared with and processed by Programme Partners for the purpose of assessing the Applications and providing benefits to the Participants on the Programme, as set out in these T&Cs.

6.4 Submitting your application

1. 1. 1. You must submit your application via the Submittable form (“Submission Method”).
      2. All applications must be submitted via the Submission Method by the Application Deadline.  
      3. Once your completed application has been received, Digital Catapult will send you a confirmation receipt by email. If you do not get a receipt within twenty four (24) hours of the next working day, please email us at dsbdprogramme@digicatapult.org.uk. with the subject ”DSbD Application Submission”.

7 Selection

7.1 Qualification

The Digital Catapult will undertake an initial assessment of the Applicants against the Programme Requirements.

7.2  Selection process

All qualifying applications in each Tier will be reviewed and scored by the Judges.

7.3 Scoring 

The scoring criteria will be assessed by the Judges based on statements in the areas below. Each criterion will be scored on a range from 0 to 5. 0 being an “Unacceptable or No submission” score for each criterion and 5 being an “Excellent” score for each criterion. This scoring will be applied to all applications and will be equally weighted. A zero score will automatically result in a failed Application.

In Tier 1, there are 5 criteria upon which applicants will be assessed:

Tier 1

Relevance – The proposed use case or experimentation is relevant to DSbD technologies, CHERI, and the capabilities of the Morello Board.

Expertise and commitment of team – The business has the relevant expertise to take part and adequate resources committed to the programme.

Impact and scalability – The proposed use case or experimentation has the potential to scale and create impact beyond the immediate demonstrator.

Technical feasibility – The experimentation and project plan presented is feasible within the timeframe, budget, and resource available.

Innovation – The proposed use case is novel and will provide valuable insights to the DSbD programme.

In Tier 2 there are 2 criteria upon which applicants will be assessed

Relevance – The business, its solutions, and its application are relevant to DSbD applications

Interest – The business clearly states their interest and ambition, and potential areas of exploration with the Morello board

Furthermore, in each case, Digital Catapult will be selecting participants on a portfolio basis to ensure the Programme is able to deliver consistent support and activities that provide value to all Participants.

7.4 Due diligence 

We will carry out due diligence on applicants prior to the point of selection onto the Programme. Applicants must be willing to submit further information or documentation upon request to qualify as ‘successful’. We may also request a direct conversation with you, to be held virtually, to ask any additional questions we may have.

7.5 Successful applicants 

7.5.1 Successful applicants will be notified and provided with a standard agreement for review and execution (“Programme Agreement”).  

7.5.2 The Programme Agreement is a standard agreement and not negotiable.  We do try to ensure these contracts are fair and reasonable.

7.5.3 In order to be accepted onto the Programme, successful applicants must sign the Programme Agreement.

8 Competition Terms – Specific

8.1 Benefits

Any funding provided by Programme Funder(s) either as direct cash grant or otherwise used for the operation of the Programme are subject to its terms and conditions stated in the Programme T&Cs.

All the benefits provided under the Programme by third-party organisations (“Suppliers”) are subject to the Supplier’s terms and conditions stated in the Programme T&Cs (in particular, in respect of the Morello Boards, from Arm Ltd.) 

Any optional benefits provided by third party organisations whose terms and conditions are not contained in the Programme T&Cs will be agreed between the Participant and the Supplier directly.

Digital Catapult reserves the right to amend the list of benefits at its sole discretion.

8.2 State Assistance

Tier 1 Participants

Tier 1 Participants are receiving the grant pursuant to Special Drawing Rights (aka minimal financial assistance), or to the extent applicable under the NI Protocol, the de minimis aid regulations (COMMISSION REGULATION (EU) No 1407/2013), collectively referred to herein as “State Assistance.

The total State Assistance received or due to be received by a Participant (including any associated companies e.g. subsidiaries), originating from a United Kingdom source, must not exceed £315,000 for GB companies, and €200,000 (approximately £165,000) in aggregate across the Participant’s current fiscal year (as at the Agreement Date) and the previous two fiscal years.

This Project has been assessed as providing £15,000 for Tier 1 Participants.

As part of the application process, Tier 1 Applicants will therefore be asked to sign a declaration confirming that they are eligible to receive the State Assistance.

Tier 2 Participants

Not Applicable.

8.3 Applicants

Digital Catapult reserves the right to accept any application which does not fulfil the minimum requirements. 

8.4 Key Dates

Digital Catapult reserves the right to change the Key Dates at its sole discretion. No extension to deadlines will usually be granted, with very limited exceptions where the Applicant requests an extension due to reasonable extenuating circumstances, beyond the Applicant’s control and unforeseen to them, subject to the Applicant providing evidence that proves the extenuating circumstance; and the applicant informing Digital Catapult as soon as reasonably practicable following the extenuating circumstance becoming apparent. Digital Catapult reserves the right to consider the factors and decide whether such circumstances are extenuating and whether granting an extension is fair to other applicants. No extension granted will be for greater than two working days.

8.5 Applications

All information and documents requested must be submitted. Failure to submit all requested information and documents may result in the application being rejected. Digital Catapult will not use outside information in respect of your application unless otherwise indicated, other than to undertake due diligence. Digital Catapult reserves the right to not work with people or an organisation which could impact its reputation.

8.6 Previous Applications

Digital Catapult reserves the right to either (i) reassess an application from a previous competition (together with information gained from an update meeting), or (ii) accept as a successful applicant organisations that was previously successful in a previous competition, but whose participation was deferred to a later Programme.

8.7 Key Contact Information

In submitting the Application, the Applicant confirms that it has made the Key Contact (and any other person whose personal data has been submitted), aware of, and has the lawful grounds to enable Digital Catapult to, process the personal information of the Key Contact (and any other person) as set out in these Competition Terms and Digital Catapult’s privacy policy (https://www.digicatapult.org.uk/privacy-policy/).

8.8 Programme Agreement

Digital Catapult reserves the right to make amendments to the Programme Agreement it issues up until the point of execution by both parties.

8.9 Participant Programmes

Digital Catapult reserves the right to offer Participants access to its Participant Programmes, such as its Platinum Awards.

9 Competition Terms – General

9.1 Data Collection, Storage & Use 

Digital Catapult will store your application and the scoring it has received for the entire duration of the Programme.  If you are a successful Applicant, we shall also store your Application for a period of up to five (5) years following the end of the Programme.  For administration purposes, contracts may be stored for up to seven (7) years, contracts providing State aid for up to eleven (11) years, and deeds for up to thirteen (13) years from the end of the Programme.

9.2 Confidentiality 

9.2.1 The information provided in your Application will be kept confidential and only used and disclosed as reasonably necessary for the purpose of assessing Applications, and, if admitted onto the Programme, for working with you on the Programme. This may include sharing such information with our Programme Partners, as indicated above.

For practical reasons, NDAs will not be signed by Digital Catapult or the Partners as part of this Programme Competition. The activities we provide can only be achieved through trust of the tech community. It is therefore not in our interest to release your sensitive information. Mutual confidentiality provisions are included in the Programme Agreement.

9.2.2 The scoring of your Application will also be treated as confidential information.

9.2.3 As your Application will be transmitted over the Internet, ultimately Digital Catapult cannot guarantee its security.

9.3 Intellectual Property 

9.3.1 We respect the intellectual property of others and we ask our Applicants to do the same. 

9.3.2 In submitting the Application, you promise that you have and continue to have all necessary rights, licences, permissions and consent to provide the content in your application to us, and for Digital Catapult to use the Application as we have set out.

9.3.3 We will not remove from Applications any proprietary labels or copyright assertions. 

9.4 Disclaimers 

9.4.1 We accept no liability for any consequences, whether direct or indirect, that may arise from your participation in the Programme Competition, your reliance on any statements we may have made about the Programme, or its suspension or withdrawal.

1. 1. 1. In any case, to the extent permitted under law, Digital Catapult’s liability shall be limited to one thousand (£1,000) pounds.

10. Jurisdiction

The Programme Competition is governed by English law and the Applicant agrees that any dispute shall be exclusively resolved in the English courts.