Cyber capacity building ideas for the UN Global Mechanism

How should the Global Mechanism support and use capacity building?

The baton of cybersecurity negotiations at the United Nations has just been passed to a new Global Mechanism, but the question of what precisely it should do with respect to international cyber capacity building (CCB) is still to be decided. This article presents twelve options under a four-theme framing:

  • More investment
  • Better projects
  • Coordinated activity
  • CCB for the UN Framework

For two decades UN members and their experts have negotiated to develop and advance a framework of responsible state behaviour in cyberspace. This spring sees the latest evolution in that process, as the former temporary working group hands over to a new permanent Global Mechanism chaired by El Salvador’s Ambassador Egriselda López.

The Global Mechanism is mandated by the UN to support cyber capacity building through a Dedicated Thematic Group and a regular Global Roundtable, which will bring together high-level government representatives, stakeholders and experts on CCB.

So we know that capacity building will be an important agenda item for the Global Mechanism, but what has not yet been agreed are the issues, goals and activities that will be taken up under it.

Fortunately for the Global Mechanism, while the UN was hosting negotiations on a framework for responsible state behaviour, the capacity building community was also at work, accumulating two decades of experience, lessons and ideas for future improvements. Many of these have already crossed over and informed OEWG outputs such as their principles for cyber capacity building and the Points of Contact directory. However now that the Global Mechanism has a Dedicated Thematic Group for capacity building it could and should benefit much more from this groundwork.

In addition to experience and ideas, there already exists a rich landscape of existing platforms and structures for advancing and coordinating cyber capacity building. Switzerland was one of several member states who urged the Global Mechanism to take account of this and not duplicate activity or reinvent the wheel. Some of the structures are already within the UN family of agencies and some are outside it. Some are within technical domains (e.g. incident response, policing, critical infrastructure etc.) and some are cross-cutting, like the Global Forum on Cyber Expertise (GFCE) Community or Korea’s Cybersecurity Alliance for Mutual Progress (CAMP). All of them could be valuable partners to the Global Mechanism.

There has also been substantial research into both good CCB practices and how to address the strategic challenges and opportunities the field faces. At the end of this article I’ve linked to five examples of the intellectual groundwork that has been laid, but there is much more that I could have included.

Finally it is worth considering the scale of the need for cyber capacity building. The amount of support that UN member states need to sustainably reach a baseline level of cybersecurity far exceeds the CCB resources that donors in the Global Mechanism would realistically be able to commit. The cumulative spend of international cyber capacity building projects directly funded by donor governments is measured in the tens of millions of dollars. I would estimate the true global need for CCB support in just a single year would exceed this. This is the large unmet demand and funding gap that so many member states pointed to in their OEWG interventions.

What does this mean for the Global Mechanism? The conclusion I draw from this is that the Global Mechanism should look for systemic solutions. These may include enabling countries to invest effectively in their own cybersecurity and working with other platforms and funders (e.g. international finance institutions) to expand and improve CCB as a whole. There may be a role for the Global Mechanism to be more hands-on and operational, as several states requested. However the Global Mechanism’s core mandate, the size of its secretariat and the likely sums it could raise itself all suggest that any work creating and overseeing new programmes or funds would be most effectively focused on the issues closest to home: CCB to support engagement in the Global Mechanism itself; and CCB that directly improves understanding and implementation of the UN framework.

To flesh out that high-level view I have set out twelve practical ideas the Global Mechanism might consider, grouped in four themes. I have derived these from the interventions of member states at the OEWG, the OEWG’s final report and the research literature.

I do not suggest doing all twelve things at once. The Global Mechanism is intended to be permanent so it can afford to take the long view. And in the early years it would be better to do a few things well than a lot of things poorly.

Twelve Recommendations

Theme: More Investment

1. Promote the Field

The greatest challenge facing CCB, and therefore the greatest opportunity to address, is that the overall amount of CCB support available globally falls far short of what is needed and being asked for. This is part of a larger short-fall, and decline, in funding for international cooperation activities. As a starting point to addressing this the Global Mechanism can play a vital role promoting CCB and encouraging investment in it. It has direct channels to all member states to collect and share the success stories of capacity building and the evidence for why CCB is needed and effective. It also has the power to coordinate with other CCB structures outside the UN to amplify this effort.

What member states said

“States continued to highlight that the High-level Global Roundtable on ICT security capacity building in the context of international security, first convened on 10 May 2024 in New York, added value to the OEWG discussions by raising the level of awareness of the urgency of ICT capacity-building among high-level government officials.”
— OEWG Final Report, para 53(i)

“States in a position to do so are encouraged to continue to support capacity-building programmes, including in collaboration, where appropriate, with regional and sub-regional organizations and other interested parties and stakeholders, including businesses, non-governmental organizations and academia.”
— OEWG Final Report, para 59

“To achieve consistent results, we should promote cyber capacity building through a comprehensive approach.”
— Latvia (OEWG2-s09-m08)

“Furthermore, international and regional financial institutions should be encouraged to dedicate more resources for financing cyber projects and the development of secure ICT infrastructure.”
— Croatia (OEWG2-s06-m08)

2. Support Mainstreaming CCB into Development

The Accra Call (linked at the end of this article) made the case for integrating cyber resilience into development programming. Global Mechanism representatives do not need to formally join the call to agree that this policy goal would improve both CCB and development. There are many practical actions set out in the Accra Call that could be considered, adopted or adapted by the Global Mechanism.

What member states said

“States further emphasized that capacity-building is foundational to developing the resources, skills, policies and institutions necessary to increase the resilience and ICT security of States and to accelerate the digital transformation of States and the implementation of the 2030 Agenda for Sustainable Development.”
— OEWG Final Report, para 9

“We would like to stress the importance of embodying and connecting cybersecurity with development assistance, which was also highlighted at the Global Conference on Capacity Building in Accra last year.”
— Croatia (OEWG2-s07-m09)

“The OEWG should consider how cybersecurity considerations and good practices can be integrated into future digital development projects while recognizing the unique needs, circumstances, and state of cybersecurity developments, both in low and high-income countries.”
— India (OEWG2-s07-m08)

3. Catalyse New Partnerships

The Global Mechanism can encourage, support and coordinate with South-South, triangular, regional and sub-regional cooperation. As a starting point it might hold a Dedicated Thematic Group meeting or a portion of the Global Roundtable with the organisations currently facilitating that cooperation, such as regional economic communities, to discuss what a strategic global approach to expanding and improving CCB might look like.

What member states said

“States continued to underscore the value of South-South, triangular and sub-regional and regional cooperation, which does not replace but complements North-South cooperation. States reiterated the valuable contributions of South-South and triangular cooperation in ICT security capacity-building and encouraged the expansion of such mechanisms.”
— OEWG Final Report, para 53(c)

“Kenya also proposes developing exchange programs, including through South to South and Triangular cooperation, where states can learn from each other… The regional arrangements demonstrate a shared understanding of the ubiquitous nature of ICT and the need for cross-border and regional arrangements to safeguard the cyberspace.”
— Kenya (OEWG2-s02-m08)

“Our countries wish to emphasize how important regional bodies, as well as sub regional bodies and initiatives are to provide coordination and cooperation opportunities among states.”
— Argentina, on behalf of a group of Latin American states (OEWG2-s06-m07)

Theme: Better Projects

4. Champion Principles-based CCB

The GM should promote and support a principles-based approach to CCB. The Chair of the OEWG called for action-orientated suggestions as to how this might be done. Several states gave actionable suggestions and one stakeholder responded with a guide to implementing the principles. The Global Mechanism inherits these suggestions and could now refine and implement them. There is also a need to raise awareness of the principles inside the teams funding, designing, implementing and benefiting from CCB activities.

What member states said

“States, recalling and reaffirming the ICT security capacity-building principles as adopted in the 2021 OEWG report and contained in the second APR, continued to highlight the need for further efforts to mainstream these principles into relevant capacity-building programming.”
— OEWG Final Report, para 53(a)

“States continued to encourage efforts to promote gender-responsive capacity-building efforts.”
— OEWG Final Report, para 53(a)

“Indonesia emphasizes the importance of raising awareness among Member States and stakeholders about the principles of ICT security capacity building. Establishing a monitoring and evaluation system would ensure efforts are effective in strengthening ICT capabilities of states.”
— Indonesia (OEWG2-s09-m09)

“We have worked within our Pacific family to establish mechanisms and principles within our own region that implement our UN OEWG cyber capacity building principles. We believe that these efforts can serve as a model to others.”
— Tonga (OEWG2-s09-m08)

5. Foster Inclusivity

The GM should actively support CCB initiatives that enable greater participation from G77 countries in international CCB debates. I suggest considering how both DTG meetings and the Global Roundtable events could be designed in an inclusive way.

What member states said

“States in a position to do so are encouraged to provide support to representatives and experts from developing countries to attend the [Global] Roundtables [on cyber capacity building].”
— OEWG Final Report, para 55

“Because the United States believes that these discussions should be as inclusive as possible, we funded travel and participation of a dozen participants from G77 countries.”
— United States (OEWG2-s06-m08)

“It is a priority for CARICOM that we ensure the equal and active participation by developing countries, particularly LDCs, LLDCs and SIDS in the work of this OEWG. We also encourage broad participation by stakeholders from developing countries, as they offer a unique perspective of the challenges faced by all countries in relation to cyber security.”
— Trinidad and Tobago, on behalf of CARICOM (OEWG2-s01-m02)

6. Improve the Use of Evidence and Data

CCB has much anecdotal evidence of its benefits, but this has not been validated, published and collated in the ways needed to influence those who might fund CCB. The field needs: an improvement in evidence-based programming; a modest investment in peer-reviewed studies of the evidence; a place to collectively gather and share evidence; and a communication effort to inform potential funders that this evidence exists and what it shows. This critical piece of the CCB puzzle is being worked on by a handful of researchers and funders, but it hasn’t received the attention or investment it warrants given that unlocking more funding depends upon an evidence-backed case.

What member states said

“States proposed that efforts to tailor capacity-building to a recipient State’s needs could be enhanced by a State’s evaluation of its own current status of ICT security at the national level.”
— OEWG Final Report, para 53(b)

“[We emphasise] the importance of an evidence-based approach. This can be effected through use of the Survey of National Implementation.”
— Australia (OEWG2-s01-m09)

“Frameworks such as the Cybersecurity Capacity Maturity Model for Nations, developed by the Global Cybersecurity Capacity Centre, can be invaluable for identifying capacity-building priorities.”
— Ghana (OEWG2-s07-m09)

Theme: Coordinated Activity

7. Encourage Knowledge Sharing

The GM should offer to facilitate better information exchange on CCB within the UN system and between the UN and its external partners. Following its own principles this should be demand-driven: it should be an offer to UN agencies rather than an instruction. However as a new part of the UN CCB architecture there is a window of opportunity for the GM to play a role in improving knowledge sharing and coordination across the UN and with its key external partners.

What member states said

“States recalled the simulation exercise organized from 10 to 11 and 17 to 18 March 2025 by the OEWG Chair, in partnership with interested States and with the support of the UN Office for Disarmament Affairs (UNODA), the UN Institute for Disarmament Research (UNIDIR) and the International Telecommunications Union (ITU).”
— OEWG Final Report, para 47(f)

“The Open-Ended Working Group could recommend mainstreaming of the cybersecurity into the UN Digital Development Agenda across the UN system.”
— Czech Republic (OEWG2-s01-m09)

“We propose that the OEWG use the potentials of the International Telecommunication Union (ITU), which is the United Nations Specialized Agency for Information and Communication Technologies, to further capacity-building coordination.”
— Iran (OEWG2-s03-m04)

8. Bridge Government Silos

Within governments, CCB sits across multiple communities including diplomacy, development, defence, home security, intelligence and justice. The literature warns of scenarios in which the CCB activities of these branches of government become increasingly siloed and subject to different, sometimes conflicting, sets of principles and goals. This is not a problem that the Global Mechanism can solve, but it can help mitigate it by consciously encouraging representatives from different arms of government to attend meetings tailored to their particular concerns and to mix at events like the Global Roundtable. I anticipate from Switzerland’s interventions that it might caution against duplicating the work of the Global Forum on Cyber Expertise.

My view is that the GFCE has done an admirable job of putting diplomats, police, incident responders and development bank staff in the same room to discuss CCB, but the field still needs to build bridges to development and defence officials and stakeholders— something the Global Mechanism could add value on.

What member states said

“States proposed that similar [Global Roundtables] on ICT security capacity-building in the context of international security with representation of high-level government officials or relevant governmental and non-governmental experts could continue to be convened on a regular basis under the auspices of the future permanent mechanism.”
— OEWG Final Report, para 53(i)

“Focus should lay on strengthening the efforts of the existing initiatives and support the coordination and collaboration by inclusive and cross-cutting efforts.”
— Switzerland (OEWG2-s10-m07)

“We should be improving the way stakeholders work together to deliver results by dismantling silos, developing original frameworks, adopting a holistic approach, enhancing trust, and promoting knowledge sharing across all levels.”
— Tonga (OEWG2-s09-m08)

9. Consultation

The GM should consult with the wider CCB community to gather information, avoid duplication, coordinate and increase its influence upon what actually happens in future CCB programmes. This means engaging not just UN agencies but forums like the GFCE and CAMP, development banks, regional bodies, implementers, stakeholders and experts.

What member states said

“Global Roundtables could include technical-level discussions between capacity building practitioners, representatives of interested States, and other interested parties and stakeholders, including businesses, non-governmental organizations and academia, with due consideration given to equitable geographical representation.”
— OEWG Final Report, para 55

“The future mechanism should take into account, promote, and support the work of other existing fora engaged in cybersecurity capacity building, inside and outside of the EU, including the World Bank Digital Trust Fund, the ITU programs, and regional organizations’ activities.”
— European Union (OEWG2-s09-m08)

“It is important to involve other interested parties in capacity-building efforts, in particular businesses, academia, and non-governmental organizations.”
— Russia (OEWG2-s06-m08)

Theme: CCB for the UN Framework

10. Focus Operational Work on the Mandate

If the GM takes a more hands-on role in CCB delivery, it should focus this activity on the areas closest to its core mandate. One benefit of starting here is that it would mean taking programme or trust fund decisions on the areas where GM representatives (often diplomats) will have domain expertise and be well qualified to assess the relevant needs, opportunities, risks and constraints. Several member states reminded the OEWG that there are existing trust funds and global initatives for wider cyber capacity building.

What member states said

“The OEWG recalled its mandate contained in General Assembly resolution 75/240 as follows: ‘Acting on a consensus basis, to continue, as a priority, to further develop the rules, norms and principles of responsible behaviour of States and the ways for their implementation.’”
— OEWG Final Report, para 6

“The OEWG’s scope is to consider the issue of ICT security in the context of international security. It is not a forum to address all cybersecurity issues, nor is it an operational entity. In the area of capacity building, the OEWG should focus on articulating how capacity building can enable more states to implement and adhere to their commitments to the framework of responsible state behavior.”
— United States (OEWG2-s03-m04)

“We reaffirm our support for the establishment of a United Nations Voluntary Fund dedicated to ICT security capacity building… Such a fund will help ensure that all states, in particular developing countries, possess the necessary capacity to participate fully and meaningfully in the work of the Global Mechanism and to effectively implement the framework for responsible state behavior.”
— Nigeria (GMICTS-s00-m01)

11. Compile and Share Tools for the Framework

The GM could identify and compile effective policy tools and mechanisms that help governments adopt and implement measures that strengthen or implement the UN Framework for Responsible State Behaviour. This is a knowledge function: gathering what exists across the practitioner community, curating it against the framework, and making it accessible to states that want to implement commitments but do not know where to start. Adjacent ideas to this already exist but I believe their repositories are focused either on general cybersecurity tools (e.g. free, open source software for incident response teams) or they contain resources for designing and implementing CCB programmes.

What member states said

“States made further proposals for initiatives to support capacity-building, including a Digital Tool to support States’ national implementation of the voluntary, non-binding norms of responsible State behaviour, including the implementation of the norms checklist, and could also be integrated into the GSCCP if agreed by States.”
— OEWG Final Report, para 53(g)

“States to establish a dedicated Global ICT Security Cooperation and Capacity Building Portal (GSCCP) via a step-by-step modular approach. In this regard, the Portal should first be developed to function as an online platform to support the future permanent mechanism.”
— OEWG Final Report, para 56

“Such operations also require assessment and review and the development of checklists and tools which would be instrumental for responding to the specific needs of states.”
— Thailand (OEWG2-s07-m08)

“We now need to move forward on concrete action focused on implementing the agreed framework, which will require first of all, supporting states capacities in an inclusive, coordinated, efficient and tailor-made way.”
— Colombia (OEWG2-s02-m10)

12. Framework-related Matchmaking

The GM’s CCB track should focus specifically on helping member states understand what capacity building support exists for implementing the UN framework — norms, CBMs, international law — and give them a structured venue to articulate what they need. This is a narrower mandate than general CCB matchmaking, but it is one the GM can do better than any other body precisely because it sits at the intersection of the norms framework and state implementation. The OEWG’s Final Report contained several actionable ideas at para 43 for activities supporting implementation of the UN framework and engagement with the Global Mechanism.

What member states said

“States are encouraged to continue supporting programs to facilitate the participation of delegates in the work of the future permanent mechanism, including the existing delegates sponsorship program, and the Women in International Security and Cyberspace Fellowship.”
— OEWG Final Report, para 57

“States to continue discussions at the future permanent mechanism on the initial report prepared by the UN Secretariat outlining a proposal for the development and operationalization of a UN voluntary fund to support the capacity-building of States on security of and in the use of ICTs.”
— OEWG Final Report, para 58

“Acknowledging existing capacity-building initiatives on international law, States continued to underscore the urgent need to continue such capacity-building efforts including with the aim of ensuring that all States are able to participate on an equal footing on the development of common understandings on how international law applies in the use of ICTs.”
— OEWG Final Report, para 43(d)

“My delegation would like for [the Women in International Security and Cyberspace Fellowship] to be expanded to allow female diplomats from other regions to benefit from it.”
— Democratic Republic of Congo (OEWG2-s10-m08)

“[the UN Singapore Fellowship Programme] stands as an exemplary model for creating a dedicated fellowship program under the United Nations, specifically designed to enhance ICT-related training and education.”
— Iran (OEWG2-s10-m07)

Further Reading

While the twelve ideas above have been grouped and framed as I see them, they all originate in the OEWG discussions or prior research by academics and think tanks. If you like an idea then all credit goes to the original proposer or author and if you don’t like it then assume it is my fault for not explaining it well!

There is a lot of good background reading I’ve not mentioned here, but I suggest starting with these five documents if you would like to learn more.

Leave a Reply

Your email address will not be published. Required fields are marked *