Competition Terms

Digital Security by Design Technology Access

Programme: Cohort 6

August 2024

…………………………………………………………………………….

1) DIGITAL CATAPULT

Digital Catapult is the UK authority on advanced digital technology. Through collaboration and innovation, we accelerate industry adoption to drive growth and opportunity across the economy.

We bring together an expert and enterprising community of researchers, startups, scaleups and industry leaders to discover new ways to solve the big challenges limiting the UK’s future potential. Through our specialist programmes and experimental facilities, we make sure that innovation thrives, and the right solutions make it to the real world.

Our goal is to accelerate new possibilities in everything we do and for every business we partner with throughout the journey – breaking down barriers, de-risking innovation, opening up markets and responsibly shaping the products, services and experiences of the future.

Digital Catapult works with organisations on projects involving at least one of the technologies from its “Advanced Digital Technology Stack”: Artificial Intelligence, Immersive, Internet of Things, Distributed Ledger Technologies, 5G/Future Networks and Quantum Technologies.

2) PROGRAMME DESCRIPTION

2.1 The Programme

Digital Security by Design (“DSbD”) challenge was launched by UK Research and Innovation in 2019 to improve the current insecure foundations of computing infrastructure.

The Digital Security by Design Technology Access Programme is an awareness and acceleration programme that addresses the cybersecurity challenges faced by industry.

The programme provides the tools, resources and expertise needed to assist experimentation with the new CHERI architecture, and Morello, and Sonata Boards for enhanced digital security. (“Programme”)

There are two tiers to this Open Call. Tier 1 is open to startups and SME’s (up to 250 employees). Tier 2 is open to larger business, with over 250 employees.

This Programme is designed to give UK-based companies access to new secure systems, for them to trial these technologies within their business, products, and applications, to experiment with and validate these new cyber security technologies and feedback their findings to influence its future development.

The Programme is support by the following Programme Partners:

• University of Cambridge, The Old Schools, Trinity Lane Cambridge, CB2 1TN (“University of Cambridge”)
• ARM LIMITED, 110 Fulbourn Road, Cambridge, Cambridgeshire, CB1 9NJ, 02557590 (“Arm Ltd”)

(“Industry Partners”)

• LOWRISC C.I.C., 7 Hills Road, Cambridge, CB2 1GE, 09272283 (“LowRisc”)

(“Programme Collaboration Partner”)

• Innovate UK, UK Research and Innovation, Polaris House, North Start Avenue, Swindon, SN2 1FL,  (“IUK”)

(“Programme Funder”)

……………………………………………………………………………….

2.2 Programme Objectives

The Programme objectives include:

• Convene an ecosystem of early adopters and potential end users
• Upskill a core group of developers to experiment with the DSbD technologies, and find compelling uses of them in addressing security challenges
• Disseminate knowledge and benefits of the capability to the wider market

2.3 Programme Judges

During the application stage, the judges will be responsible for scoring the applications according to the process and criteria set out in these Competition Terms. The judges will be chosen based on (i) their experience and expertise, and (ii) ability to exercise independent judgment. The Programme Judges comprise:

Internal Judges: A number of judges from Digital Catapult will help judge the applications.

And may include any of the following:

Programme Collaboration Partner Judges: LowRISC

Industry Partner Judges: A number of judges from ARM Ltd and University of Cambridge

Programme Funder Judges: A number of judges from Innovate UK.

2.4 The Programme Partners

The following organisations are partnering with Digital Catapult to deliver the Programme:

Programme Funders: Digital Catapult is working as InnovateUK’s delivery partner on this IUK funded programme.  InnovateUK is the UK’s innovation agency, and is part of UK Research and Innovation. 

Programme Collaboration Partners: e.g. Digital Catapult is working in collaboration with lowRISC on this cohort of the Programme. LowRISC will support reviewing applications and cohort companies to use the Sonata system. This may take the form of direct engagement, online sessions/workshops, or through other online support channels (eg: GitHub).

Industry Partners During the Project, Programme industry partners may include industry organisations that support the Project through delivery of relevant workshops, hosting office hours, and/or through providing discounted services or products.

2.5 Applicants & Participants

You are considered an “Applicant” if you apply to this competition.

You are considered a “Participant” if you are successful with your application and complete all pre-Project activities (e.g. signing the Programme Agreement).

• Where you are applying on behalf of a consortium:
• Applicant shall mean each of the members of the applying consortium, for which the Lead Applicant (the party submitting the application) is responsible for each “Applicant”.
• Participant shall mean each of the members of the successful consortium, for which the Lead Participant (the party submitting the application) will be responsible for each “Participant”.

3) PROGRAMME BENEFITS

Tier 1 Exclusive Benefits (SMEs only):

• £15,000 cash funding during the course of the Programme.

Tier 1 & Tier 2 Benefits:

• Get access to the Sonata evaluation board, with the potential to keep it following successful completion of the programme
• Access to CHERI architecture developed by researchers at University of Cambridge
• Be a part of and collaborate with the wider DSbD ecosystem
• Participate in group learning sessions and focused activities on topics relevant to the programme. These will be led by Digital Catapult, but may be attended by experts on CHERIoT and the Sonata Boards.
• Receive technical guidance from DSbD experts.
• Explore the performance and security benefits of CHERI against product code.
• Help build an early adopter community within the UK and promote the adoption of DSbD technology in the UK.
• Contribute to further improving the CHERI and Sonata architecture and ecosystem.
• Receive brand exposure on Digital Catapult and DSbD platforms by being part of the programme.
• Be highly visible as being a company conscious about the security of its products and customers
• Upon successful completion of the Project, there may be opportunity to join the Digital Catapult Alumni Network, or the Digital Catapult DSbD Alumni Network, which keeps members informed of opportunities and relevant updates from the Digital Catapult, and which provides additional opportunities to engage with Digital Catapult and other Alumni.

4) PROGRAMME OBLIGATIONS

Tier 1 Participants Only

• Participate in the onboarding day, to be held in-person at the Digital Catapult office in London on 31^st October 2024.
• Participate in 5 online peer to peer sessions throughout the Programme. These will be led by Digital Catapult and may also be attended by experts in CHERIoT and Sonata systems.
• Alignment and 1:1 tech sessions each month (a member of your technical team will be required to join these).
• Provide an updated project plan in Month 1, of your intended use-case / experimentation. This should ideally be based on your original application, but we are open to discussing changes to plans. Such changes will need to be approved by Digital Catapult before work commences.
• Provide an interim technical report in Month 3 based on the experience gained from the project and highlighting your progress so far.
• Present a demo of your solution running on and being hardened by CHERI/CHERIoT/Sonata.
• Provide a final technical report in Month 5 based on the experience gained from the project and the progress/outcomes of your project.
• Provide a final case study for marketing purposes.
• Participate in the showcase at the end of the programme, to be held in-person at the Digital Catapult office in London in March 2025.

Tier 2 Participants Only

• Participate in the onboarding day, to be held in-person at the Digital Catapult office in London on 31^st October 2024.
• Provide a feedback survey at the end of Month 3 and Month 5 on the use of the technology and the outcomes of your project.
• Participate in the final showcase, to be held in-person at the Digital Catapult office in London in March 2025.

All Participants (Tier 1 & Tier 2)

• Where applicable, comply with the Morello Board T&Cs, as issued by ARM ltd. These will also be in the A4 leaflet that comes in the box with the Morello Board. (Note: only new members to TAP will be able to receive a Morello board)
• Comply with Export Control Requirements, in particular by not exporting the Morello Boards outside of the UK or by attempting to provide access to nationals (even if they are employees) from sanctioned countries.
• All projects must make use of the Sonata board.
• Where relevant, if you no longer require your Morello board, please support the Morello Rehoming Programme by returning your Morello Board for future use by other interested parties. For more information, see here.
• Participant agrees to be visibly (name and logo) associated with the Programme, whilst on the Programme and afterwards as a former participant and beneficiary. This includes marketing collateral, such as website, print and digital materials.
• For a maximum period of five years following the Project end date, Participant shall use its reasonable endeavours to answer specific questions from Digital Catapult relating to its growth and progress to assist Digital Catapult to demonstrate the impact of its activities. This shall include: (i) participation in an annual telephone conversation of up to one hour, and (ii) participation in a two yearly survey issued by Digital Catapult.

5) APPLICANTS

5.1 Minimum Requirements

Tier 1 Applicants

• Applicants must be eligible to receive £16,690 in Special Drawing Rights/De Minimis Aid (see section “Competition Terms – paragraph 9.2 “State Assistance” for further details).
• Applicants must have a UK business bank account

Tier 2 Applicants

• Applicants must be eligible to receive £1,690 in Special Drawing Rights/De Minimis Aid (see section “Competition Terms – paragraph 9.2 “State Assistance” for further details).

Tier 1 & Tier 2 Applicants

• Applicants must be a UK based registered company, or prove they have an establishment in the UK and undertake the activity in the UK.

• Applicants must make use of the Sonata board within their projects.

5.2 What we’re looking for

The DSbD Technology Access Programme has been designed for all types of businesses, from early stage startups looking to refine business propositions to mature organisations seeking early access to revolutionary technology before it is fully ready for commercial deployment.

The CHERI architecture has wide appeal and is not restricted to any particular industry. We are looking at startups, scaleups and mid-size companies who want to make their systems and products more secure from cyber threats and vulnerabilities.

The architecture currently supports:

• Linux/Android/CheriBSD operating systems.

There is also the Morello Instruction Emulator (IE) and Fixed Virtual Platform (FVP) available, both of which can be used for porting, testing, and demonstration.

With regards to CHERIoT:

• CHERIoT could involve C/C++, MicroPython, Verilog and RUST.
• CHERIoT RTOS is recommended, but businesses are free to repurpose the FPGA is required.
• CHERIoT LLVM toolchains are currently available. Additional operating system enablement is currently being addressed by a joint development between Arm, University of Cambridge, Microsoft and Google.
• There is also a Verilator-based simulator for CHERIoT: cheriot-safe.

6) KEY DATES

• Applications Open – 19th August 2024
• Application Deadline – 22nd September 2024
• Intended notification of all Applicants – by 7th October 2024
• Intended public announcement of successful Participants: November 2024
• Project:
  • Start Date: 31st October 2024 (Programme onboarding day)
  • End Date: March 2025

Digital Catapult reserves the right to change the Key Dates at its sole discretion. No extension to deadlines will usually be granted, with very limited exceptions where the Applicant requests an extension due to reasonable extenuating circumstances, beyond the Applicant’s control and unforeseen to them, subject to the Applicant providing evidence that proves the extenuating circumstance; and the applicant informing Digital Catapult as soon as reasonably practicable following the extenuating circumstance becoming apparent. Digital Catapult reserves the right to consider the factors and decide whether such circumstances are extenuating and whether granting an extension is fair to other applicants. No extension granted will be for greater than two working days.

7) THE APPLICATION

7.1 What information should my application contain?

Applicants must answer all required questions in the full online application form.

7.2 Who will see my Application?

The following people will see your application:

Catapult Representatives: Relevant Catapult representatives will see your application in order to assess the application, and otherwise in the administration of your application and, if successful, participation in the Programme.

Programme Funders: Relevant IUK representatives will see your full application in order to assess the application, and otherwise in the administration of your application and, if successful, participation in the Programme.  This includes undertaking its statutory duties.

The Programme Judges will see your full application, except for your company name and personal information fields.

Programme Participation

Programme Partners: For selected Participants, in order to provide bespoke support during the Programme including 1:1 office hours, mentorship, and.or workshops, the Programme Collaboration Partners and Programme Industry Partners will see your full application, along with your company name, key contact name and key contact email . Note that Technology Partner and Sponsor Judges will not see your personal information fields when judging applications.

7.3 Key contact

Applicant will appoint a main contact for the Programme (“Key Contact”). This person will be Digital Catapult’s main point of contact for the competition and, if successful, Applicant’s Programme activities, including: workshop and event commitments, team members’ availability, ongoing activities, and assessment of progress during and after the Programme.

Digital Catapult will use this personal information for the purpose of carrying out due diligence on Applicants prior to the point of selection onto the Programme and to notify successful and unsuccessful Applicants over their submissions. The personal data we collect may be shared with and processed by (i) Programme Judges for the purpose of assessing the Applications; and (ii) Programme Partners and third party service providers for the provision of benefits to the Participants in the Programme, as set out in these Competition Terms.

The Programme Funder will additionally use the personal information for grant administration purposes, programme evaluation, and to perform its statutory duties. 

7.4 Submitting your application

You must submit your application via the Skipso form (“Submission Method”).

All applications must be submitted via the Submission Method by the Application Deadline.

Once your completed application has been received, Digital Catapult will send you a confirmation receipt by email. If you do not get a receipt within twenty four (24) hours of the next working day, please email us at dsbdprogramme@digicatapult.org.uk with the subject ”DSBD Programme Application Submission”.

7.5 Digital Catapult’s Equality Diversity and Inclusion Survey

In addition to your application, you will be required to complete Digital Catapult’s Equality Diversity and Inclusion Survey (‘Survey’). Whilst the completion of this Survey is mandatory, please note that your responses to this Survey will be kept separately from your application and will have no effect whatsoever on your application to the Programme.

Digital Catapult (as the Data Controller) will collect and process your personal data, including the following special category data to help Digital Catapult improve its services in respect of equality, diversity and inclusion:

• Racial and/or ethnic origin
• Sexual orientation
• Health (including disability)
• Religious and/or philosophical beliefs

The data collected and processed may be shared with relevant third parties and/or published but only in an aggregated form, which means you will not be personally identifiable.

Your personal data will be kept for 15 months from the time you respond to the Survey. Should you apply to another of Digital Catapult’s opportunities within the 15 month period, we will provide you with the option to allow us to re-use the data we already hold, to resubmit the Survey or to delete your Survey data. If you choose to complete the Survey again, we will keep your updated data for 15 months from the time you resubmit the Survey.

Please note you are responsible for the accuracy of the data you share with Digital Catapult and you agree to inform us if your data needs to be updated.

For more information on Digital Catapult’s collection, use and protection of your personal data and your rights in regards to your personal data, please see Digital Catapult’s privacy policy (https://www.digicatapult.org.uk/legal/privacy-policy/) or contact us at privacy@digicatapult.org.uk. If you have specific queries on our use of your Survey data (including a request to delete your Survey data), please contact us at edisurvey@digicatapult.org.uk.

8. SELECTION

8.1 Qualification

The Catapult will undertake an initial assessment of the Applicants against the Programme Requirements.

8.2 Selection process

All information and documents requested must be submitted. Failure to submit all requested information and documents may result in the application being rejected. Digital Catapult will not use outside information in respect of your application unless otherwise indicated, other than to undertake due diligence. Digital Catapult reserves the right to not work with people or any organisation which could impact its reputation.

All qualifying applications will be reviewed. The Digital Catapult will undertake an initial assessment of the Applicants against the Programme Requirements.

All qualifying applications in each Tier will be reviewed and scored by the Judges.

8.3 Application Scoring criteria and weighting

The scoring criteria will be assessed by the Judges based on statements in the areas below. Each criterion will be scored on a range from 0 to 5. 0 being an “Unacceptable or No submission” score for each criterion and 5 being an “Excellent” score for each criterion. This scoring will be applied to all applications and will be equally weighted. A zero score will automatically result in a failed Application.

There are 5 criteria upon which all applicants will be assessed:

1. Relevance – The proposed use case or experimentation is relevant to DSbD technologies, CHERI, and the capabilities of the Sonata Board.
2. Innovation – The proposed use case is novel and will provide valuable insights for the DSbD programme.
3. Impact and scalability – The proposed use case or experimentation has the potential to scale and create impact beyond the immediate demonstrator.
4. Expertise and commitment of team – The applicant has the relevant expertise to undertake the proposed work and adequate resources committed to the programme.
5. Technical feasibility – The experimentation and project plan presented is technically feasible within the timeframe, budget, and resource available.

Furthermore, in each case, Digital Catapult will be selecting participants on a portfolio basis to ensure the Programme is able to deliver consistent support and activities that provide value to all Participants.

8.4 Due diligence

We will carry out due diligence on applicants prior to the point of selection onto the Programme. Applicants must be willing to submit further information or documentation upon request to qualify as ‘successful’.

8.5 Successful applicants

Successful applicants will be notified and provided with a standard agreement for review and execution (“Programme Agreement”).

The Programme Agreement is a standard agreement and not negotiable.  We do try and ensure these contracts are fair and reasonable.

In order to be accepted onto the Programme, successful applicants must sign the Programme Agreement.

9 COMPETITION TERMS – SPECIFIC

9.1 Benefits

All the benefits provided under the Programme by third-party organisations (“Suppliers”) are subject to the Supplier’s terms and conditions stated in the Programme T&Cs.

Any optional benefits provided by third party organisations whose terms and conditions are not contained in the Programme T&Cs will be agreed between the Participant and the Supplier directly.

Digital Catapult reserves the right to amend the list of benefits at its sole discretion.

9.2 State Assistance

Participants shall receive the grant as Minimal Financial Assistance (“MFA”), or to the extent applicable under the Northern Ireland Protocol, the de minimis aid regulations (COMMISSION REGULATION (EU) No 1407/2013), collectively referred to herein as “State Assistance.

The total State Assistance received or due to be received by an individual Participant (including any associated companies e.g. subsidiaries), originating from a United Kingdom source, must not exceed £315,000, or €200,000 (approximately £165,000) for Northern Ireland Companies (or any other company subject to the Northern Ireland Protocol), each in aggregate across the Participant’s current fiscal year (as at the Agreement Date) and the previous two fiscal years.

This Programme has been assessed as providing £16,690 for Tier 1 Participants.

This Programme has been assessed as providing £1,690 for Tier 2 Participants.

Before signing the Programme Agreement, Applicants will therefore be asked to sign a declaration confirming that you are eligible to receive the State Assistance.

9.3 Accessibility

We aim to make all of our programmes accessible. We welcome feedback as to how we may be able to improve the accessibility of our programmes in the future. If you have any feedback with regards to accessibility, please send your feedback by email to: edisurvey@digicatapult.org.uk. Your feedback may be used by us in our programmes and activities.

9.4 Applicants

Digital Catapult reserves the right to accept any application which does not fulfil the minimum requirements.

9.5 Key Dates

Digital Catapult reserves the right to change the Key Dates at its sole discretion. No extension to deadlines will usually be granted, with very limited exceptions where the Applicant requests an extension due to reasonable extenuating circumstances, beyond the Applicant’s control and unforeseen to them, subject to the Applicant providing evidence that proves the extenuating circumstance; and the Applicant informing Digital Catapult as soon as reasonably practicable following the extenuating circumstance becoming apparent. Digital Catapult reserves the right to consider the factors and decide whether such circumstances are extenuating and whether granting an extension is fair to other applicants. No extension granted will usually be for greater than two working days.

9.6 Applications

All information and documents requested must be submitted. Failure to submit all requested information and documents may result in the application being rejected.  Catapult will not use outside information in respect of your application unless otherwise indicated, other than to undertake due diligence.  Digital Catapult reserves the right to not work with people or an organisation which it believes could impact its reputation.

9.7  Previous Applications

Catapult reserves the right to either (i) reassess an application from a previous competition (together with information gained from an update meeting), or (ii) accept as a successful applicant an organisation that was previously successful in a previous competition, but whose participation was deferred to a later Programme.

9.8  Personal Data

Digital Catapult is the Controller for the personal information submitted in the Application for the purposes of the Data Protection Act 2018 and the UK GDPR.

Digital Catapult and IUK (each, a party) are partnering on this programme, and each is individually (not jointly) a Controller for the purposes of the Data Protection Act 2018 and the UK GDPR.  Each party is individually responsible to you for how that party respectively stores, uses and processes your personal data in accordance with that its own privacy policy. Each party is not responsible to you for the other party’s storage, use or processing of your data.  Actions taken by one party (e.g. deleting personal data) will be independent of the other party. If you need to make a data request, please make such request directly to the relevant party.

In submitting the Application, the Applicant confirms that it has made the Key Contact and any other person whose personal data has been submitted, aware of, and has the lawful grounds to enable each Controller (including its processors) to, process the personal information of the Key Contact (and any other person named in the Application and open call process) as set out in these Competition Terms and in accordance with the respective privacy policies: Digital Catapult (https://www.digicatapult.org.uk/legal/privacy-policy/)andFunder (https://www.gov.uk/government/publications/privacy-notice-and-information-management-policy-innovate-uk/privacy-notice-and-information-management-policy).

9.9 Programme Agreement

Digital Catapult reserves the right to make amendments to the Programme Agreement it issues up until the point of execution by both parties.

9.10 Participant Programmes

Digital Catapult reserves the right to offer Participants access to its Participant Programmes, such as its Platinum Awards.

10. COMPETITION TERMS – GENERAL

10.1 Data Retention

Digital Catapult will store your application and the scoring it has received for the entire duration of the Programme, or up to two (2) years, whichever the greater.  If you are a successful Applicant, we shall also store your Application for a period of up to seven (7) years following the end of the Programme.  For administration purposes, contracts may be stored for up to seven (7) years, contracts providing State Assistance for up to eleven (11) years, and deeds for up to thirteen (13) years from the end of the Programme.

10.2 Confidentiality

The information provided in your Application will be kept confidential and only used and disclosed as reasonably necessary for the purpose of assessing Applications, and, if admitted onto the Programme, for working with you in the Programme.  This may include with our Programme Partners as indicated above.

For practical reasons, NDAs will not be signed by Digital Catapult or the Programme Partners as part of this Programme Competition. The activities we provide can only be achieved through trust of the tech community. It is therefore not in our interest to release your sensitive information. Confidentiality provisions are included in the Programme Agreement.

The scoring of your Application will be treated as sensitive information.

As your Application will be transmitted over the Internet, ultimately Digital Catapult cannot guarantee its security.

10.3 Intellectual Property

We respect the intellectual property of others and we ask our Applicants to do the same.

In submitting the Application, you promise that you have and continue to have all necessary rights, licenses, permissions and consent to provide the content in your application to us, and for Catapult to use the Application as we have set out.

We will not remove from Applications any proprietary labels or copyright assertions.

10.4 Disclaimers, Exclusions & Limitations

We accept no liability for any consequences, whether direct or indirect, that may arise from your participation in the Programme Competition, your reliance on any statements we may have made about your application, the Programme, or its suspension or withdrawal.

In any case, to the extent permitted under law, Digital Catapult’s liability shall be limited to one thousand (£1,000) pounds.

10.5 Entire Agreement

These Competition Terms constitute the entire agreement between Digital Catapult and the Applicant and extinguish all previous and contemporaneous agreements, promises, assurances, and understandings between them, whether written or oral, relating to the subject matter of these Competition Terms

10.6 Jurisdiction

The Programme Competition is governed by English law and the Applicant agrees that any dispute shall be exclusively resolved in the English courts.