Making Cyber CBMs Work

Executive summary

Cyber confidence-building measures (CBMs) are mutually agreed-upon sets of actions between states that, while not obligatory nor legally binding, carry political weight. They aim to strengthen trust, increase transparency and predictability, maintain communication between states and reduce the risk of misunderstandings and unintended escalation – which becomes especially crucial when there are growing geopolitical tensions and rapid technological progress.

Over the past decade, cyber CBMs have become an established element of international cyber diplomacy, with such measures having been adopted within several regional organisations, including the Organization for Security and Co-operation in Europe (OSCE), the Organization of American States (OAS), the Association of Southeast Asian Nations Regional Forum (ARF), the Conference on Interaction and Confidence-Building Measures in Asia (CICA) and the Economic Community of West African States (ECOWAS), as well as at the global level through the United Nations (UN). The African Union (AU) is also considering developing cyber CBMs, which further underscores the continued relevance of these measures. Examples of such multilateral cyber CBMs include establishing directories of national Points of Contact (PoCs), sharing cybersecurity strategies, exchanging national views on threats or on the application of international law in cyberspace, conducting joint workshops, building national capacities or setting up crisis communication mechanisms.

However, achieving consensus regarding cyber CBMs is only the first step. Their contribution to international peace and security ultimately depends on whether they are implemented and used in practice. While a considerable portion of the research has been devoted to negotiating and formulating cyber CBMs, their implementation has received far less attention. Thus, building on previous interface research that mapped implementation across organisations, this study examines the aspects that influence multilateral cyber CBM processes based on 15 factors (an overview of these factors is presented in the figure below) and translates these findings into practical recommendations.

Assessing implementation success requires a broad perspective. Since cyber CBMs are a preventive instrument, their principal objective – the avoidance of conflict and unintended escalation – cannot be directly evaluated. Instead, the effectiveness of such practices needs to be assessed through a combination of indicators, including adoption and participation, institutionalisation, implementation activities, practical use and operationalisation, good faith and non-abuse as well as the overall security environment. Success may also be reflected by more sweeping developments, such as strengthened cyber capacity, closer regional cooperation, increased policy coordination, the diffusion of norms and increased integration of cybersecurity into foreign and security policies.

As the success of such a process primarily depends on sustained political commitment, political will emerges as the most relevant factor. However, political will is not sufficient on its own. Effective implementation is also enabled by dedicated secretariats, clear ownership, a shared understanding of the CBMs and, most importantly, adequate financial and human resources. Conversely, implementation is often constrained by limited cyber capacity, competing political priorities and lack of trust among parties, insufficient awareness, high staff turnover, differing interpretations of broadly formulated CBMs and the voluntary nature of the measures themselves.

The identified factors should not be considered in isolation, as they are highly interconnected and often reinforce one another. It is apparent that some factors are more relevant during the run-up of such a process, such as the geopolitical environment or timing, or the formulation phase, such as participation or consensus building, whilst others – including ownership, dedicated secretariats or the understanding of each CBM – are particularly relevant in relation to ongoing CBM implementation. In contrast, political will and resources are crucial at almost every stage of the process.

Factors influencing Cyber CBM Processes

Overall, this analysis identifies more factors that can hinder implementation than those that actively facilitate it. Moreover, enabling and challenging factors are often two sides of the same coin: reducing challenges such as insufficient political will or limited resources may be more important in many cases than introducing or leveraging entirely new enabling measures. Certain driving factors can be actively created and strengthened, including institutional design choices, the strategic use of political windows of opportunity and the promotion of ownership of measures and their implementation.

This study also underlines that there is no universal model when it comes to regional cyber CBMs. The importance attributed to individual factors hindering or enabling a process, the nature of the factor itself or the starting point or way to proceed differ across organisations depending on political dynamics, institutional design, prior CBM experience, cyber maturity and available resources. Nevertheless, common patterns emerge across all processes, allowing the lessons learnt to be transferred while respecting regional specificities.

Based on these findings, the study identifies six priorities for future efforts:

• Develop a shared understanding of implementation and success among relevant actors, including clear expectations regarding what the successful implementation of individual CBMs and possible steps to achieve that should look like in practice while taking into account differing regional contexts and perspectives.

• Strengthen transparency and implementation reviews through voluntary reporting, implementation mapping and regular exchanges of information about good practices and implementation challenges by drawing on standardised processes and existing resources.

• Promote ownership and institutional responsibility by encouraging states to actively champion individual CBMs and sustain implementation over time instead of relying on individual persons or states to drive the process forward.

• Invest in sustainable capacity-building and resources, ensuring that implementation support is closely linked to practical CBM requirements to be thoughtful of limited resources.

• Maintain political momentum for implementation by keeping cyber CBMs on the agenda of relevant international and regional fora beyond the negotiation and adoption phases and using windows of political opportunity to frame discussions around concrete implementation steps, share experiences and sustain follow-up in relevant negotiation and implementation processes.

• Expand cross-regional learning, enabling global and regional organisations that have cyber CBM processes in place, or are considering putting them in place, to exchange implementation experiences, identify opportunities for interoperability and mutual reinforcement and build on existing efforts where appropriate while accounting for differing regional contexts.

As the framework for responsible state behaviour in cyberspace continues to mature, this study argues that the contribution of cyber CBMs to international peace and security will depend less on negotiating additional commitments and more on ensuring that existing measures are effectively translated into practice – at least within the multilateral organisations that already have cyber CBMs in place.

---

Introduction: cyber stability in an era of decreasing trust

Rapid advances in digital technologies are reshaping the cyber threat landscape. The growing development and diffusion of artificial intelligence (AI), including its potential to automate various aspects of cyber operations, may increase the speed, scale and accessibility of malicious activities. ¹ Simultaneously, cybercrime and state-linked cyber operations continue to pose challenges to international security. ² These technological developments are unfolding against a backdrop of intensifying strategic competition, ³ ongoing armed conflicts ⁴ and growing strain in relations between states and within security partnerships. ⁵ As political relations become increasingly adversarial and consensus becomes harder to achieve in multilateral diplomacy, practical mechanisms that preserve dialogue and reduce uncertainty become increasingly valuable.

Decreasing trust between states is also a challenge in the cyber domain, where limited transparency and difficulty attributing malicious activities ⁶ create persistent risks of misunderstanding. For example, a representative from South Korea highlighted this assessment at the United Nations (UN), saying that “the borderless, anonymous nature of the cyberspace and the speed at which malicious actors conduct illegal destabilising cyber activities, means that confidence among states, or lack thereof, is becoming an ever more important factor of international security”. ⁷

Based on almost two decades of work, ⁸ cyber confidence-building measures (CBMs) have emerged as a key instrument of international cyber diplomacy. They are part of a broader framework for responsible state behaviour in cyberspace, alongside discussions of threats, voluntary norms of responsible state behaviour, the application of international law and capacity-building. This is reflected in the UN’s newly established, permanent Global Mechanism on Information and Communication Technologies (ICTs) in the Context of International Security, created following 25 years of temporary discussions. These complementary areas address different dimensions of international cyber stability – from understanding threats and clarifying expectations of state conduct to strengthening national capabilities and fostering trust and cooperation.

The main objective behind engaging in cyber CBM processes is related to international peace and security: reducing risks, increasing predictability and preventing unintended escalation in the cyber domain. For example, numerous statements by states within the UN processes emphasise these goals.

Participation in cyber CBMs may also be motivated by strategic, reputational, capacity-building or domestic considerations. Engagement can provide access to expertise, strengthen partnerships, demonstrate commitment to responsible behaviour and enable states to shape emerging norms and governance processes. In addition to these substantive motivations, the design of CBMs makes participation more accessible than other policy processes. As CBMs are voluntary and non-binding, they are relatively inexpensive to adopt and serve as instruments for international cooperation that allow states to build mutual trust without legal pressure. ²⁰

While cyber CBMs have become an established element of the international cyber diplomacy framework, the associated scholarly and policy discussions have primarily focused on developing, negotiating and adopting these measures. Relatively little attention has been given to what happens once consensus has been reached and how the effectiveness of the measures is assessed. However, the implementation is ultimately what determines whether cyber CBMs contribute to the realisation of their objectives. Therefore, as the international framework for responsible state behaviour in cyberspace continues to mature, the central challenge is increasingly shifting from agreeing on cyber CBMs to making them work in practice. ²¹

Previous interface research mapped the implementation status of cyber CBMs across different multilateral organisations by tracing observable implementation activities and state practice and found significant variation in this regard across organisations, participating states and individual measures. While some cyber CBMs have been actively implemented and institutionalised, others have seen limited practical uptake. These findings suggest that the successful implementation of cyber CBMs depends on a range of enabling and hindering factors that remain insufficiently understood.

Examining these factors can help clarify the conditions under which CBM implementation is more likely to succeed while demonstrating that their relevance may vary across political and regional contexts and that putting them into practice ultimately depends on states’ willingness and capacity to act. Such insights can provide a useful foundation for strengthening existing implementation efforts and serve as a resource for regions considering developing their own cyber CBM processes.

---

Defining success: what makes a process effective

Unlike reactive instruments, such as sanctions – which seek to levy costs in response to undesirable state behaviour – and legally binding arms control agreements – which impose formal constraints on state conduct – existing multilateral cyber CBMs are primarily preventive and voluntary in nature. Their greatest benefit may manifest as events that never occur: crises that get defused instead of intensifying, misunderstandings that get clarified before they can develop into political disputes or cyber incidents that do not trigger wider or cross-domain escalation.

As a result, assessing the contribution of cyber CBMs to their ultimate objectives is challenging. It is difficult to observe prevented crises and instances of de-escalation and attribute these to specific measures, and evidence of how cyber CBMs function in actual crisis situations remains limited. Nevertheless, the difficulty of measuring their ultimate impact does not preclude a more practical assessment of their implementation and potential effectiveness. By examining observable indicators of state practice and implementation activities, it is possible to identify patterns that may suggest whether and how cyber CBMs contribute to their intended objectives even if their direct impact on crisis prevention cannot be conclusively established.

Accordingly, the successful implementation of cyber CBMs should be understood as a multilayered concept. Rather than seeking to measure every dimension of effectiveness or establish a direct causal link between individual measures and international stability, this approach identifies a range of indicators that provide insights into the different aspects of implementation, namely participation, institutionalisation, implementation activities, practical use, responsible conduct and the broader security landscape, which are distinct but interrelated dimensions.

1. Adoption and Participation: Have CBMs been adopted? How many CBMs have been formally adopted, and how many states are involved in the process?

   The formulation of CBMs and their adoption constitute the basis of subsequent implementation. While their very existence is often considered an initial indicator of success, it represents a necessary starting point instead: without agreed-upon measures, there can be no implementation of those commitments. The extent of state participation provides the first indication of the political support for a CBM process. Broad participation may signal a shared interest in the process and its objectives, but it may not necessarily translate into effective implementation.

2. Institutionalisation: Have structures and processes been established to support implementation?

   Institutionalisation is related to the extent to which cyber CBMs as well as the steps contributing to their implementation and overall objectives are embedded in the structures, responsibilities and processes of the associated multilateral organisation and the participating states. Institutionalisation helps ensure that implementation does not depend solely on individual officials or temporary political momentum and can be sustained over time.

   Cyber CBMs are instruments of state-to-state diplomacy, and their formulation and adoption are primarily driven by diplomatic processes. However, implementation often depends on national authorities beyond foreign ministries, including cybersecurity agencies, other relevant governmental bodies and – depending on the measure – non-governmental actors that may also contribute to implementation. Therefore, institutionalisation also requires appropriate responsibility assignment and coordination efforts across the actors involved.

3. Implementation Activities: Are states taking steps to put CBMs into practice?

   Implementation activities provide an indication of whether states are acting on their commitments, and these can often be observed via publicly accessible information and documented state practices.

   In some cases, implementation can be measured relatively clearly. For example, implementation can be assessed by examining whether the meetings that a particular cyber CBM calls for have taken place, which states have nominated PoCs under relevant regional and UN frameworks, which states have established a national cyber incident severity schema as, for instance, recommended in OAS CBM 11 or whether relevant trainings or tabletop exercises have been carried out and which states took part in the same.

   In other cases, implementation is less explicit, as some CBMs express broader commitments that may be advanced through national policy processes or activities not explicitly undertaken to fulfil a particular measure. For instance, developing a national cybersecurity strategy may contribute to the objectives of a CBM even if it was executed because of a wider policy process, i.e. CBM implementation was not its motivation or framing.

4. Practical Use and Operationalisation: Are CBMs used to manage incidents, misunderstandings or tensions in practice?

   The implementation of a CBM does not necessarily imply that it is used in practice. Hence, a distinction must be made between what has been described above with regard to establishing a mechanism or carrying out activities to support it and relying on it when a relevant situation arises. For example, a PoC directory may be established and communication channels tested through regular communication checks. These activities indicate implementation, but they do not establish whether states rely on the directory and its associated channels during actual cyber incidents, misunderstandings or periods of heightened tension. States may opt for alternative communication channels instead. Thus, assessing the practical use of CBMs requires examining – where evidence is available – whether states use them when relevant and whether they are considered suitable for the purpose. ²²

5. Good Faith and Non-Abuse: Are the CBMs being used in good faith and not being abused?

   The effectiveness of CBMs depends on them being used in good faith. ²³ The potential misuse of CBM mechanisms poses a significant risk to trust and undermines the overall process. ²⁴ Such risks can be assessed, to a limited extent, through documented concerns, statements by participating states and reported instances of alleged misuse. For example, in the case of the UN PoC Directory, states have expressed concerns that repeated or unfounded requests could be used to overwhelm national cybersecurity agencies, thereby reducing the mechanism’s effectiveness and eroding confidence in both the tool itself and the broader diplomatic process. ²⁵

6. Broader Security Environment: Have cyber conflicts in the region led to escalation?

   Finally, the broader security environment should also be considered when assessing CBM success. Cyber CBMs are ultimately designed to reduce risks and prevent escalation. Therefore, the absence of significant cyber-related escalation within a region may serve as a potential indicator that the broader framework of trust, cooperation and communication that cyber CBM processes are building contributes positively to regional stability. However, such conclusions must be drawn with great caution, as many factors influence interstate relations, and it is rarely possible to establish a direct causal link between the broader framework that CBM processes have contributed to building in a given region and the absence of conflict.

The extent to which each of these dimensions can be assessed varies: some – such as implementation activities – produce identifiable outputs that can be tracked through press statements, social media posts, reports or documented state practice. Others – particularly practical use and its relation with the broader security environment – are more difficult to observe and attribute because information about the use of diplomatic communication channels during sensitive incidents may not be publicly available. Accordingly, the absence of documented use should not be interpreted as evidence that a CBM has not been used.

Based on this understanding, the next question that arises is about how such outcomes can be achieved. The following section examines the factors that enable or impede the effectiveness of multilateral cyber CBMs processes across different organisational contexts.

---

From commitment to practice: enablers and challenges

Based on the indicators described above, this study identifies 15 factors that influence the effectiveness of cyber CBM processes. These factors are discussed in the following sections and have been organised in a loose chronological order. While some factors span several stages or influence the process throughout its development, others are particularly relevant only at a certain stage of the process (see figure below).

Factors influencing Cyber CBM Processes

Factor 1: Geopolitical Environment

Cyber CBM processes are shaped by the geopolitical environment in which states negotiate, adopt and implement them. Geopolitical tensions can either constrain or incentivise confidence-building. When strategic competition intensifies and states increasingly question each other’s intentions, trust in shared commitments may erode. Governments may become less willing to exchange sensitive information, rely on communication channels with geopolitical rivals or invest political capital in multilateral cooperation. This could limit the objective of the mutually agreed-upon CBMs and complicate their implementation.

At the same time, deteriorating international relations can increase the need for mechanisms that help states manage tensions and reduce the risk of misinterpretations. Maintaining communication channels, clarifying intentions and establishing procedures for handling incidents may become more important precisely when trust is limited. Geopolitical competition can, therefore, provide an impetus for developing or strengthening CBMs even if broader political disagreements remain unresolved.

These dynamics are also shaped by broader technological developments. For example, advances in AI may accelerate vulnerability discovery and cyber operations, potentially shortening response times and complicating assessments of intent and state responsibility. Such developments may require existing mechanisms to be reviewed.

Factor 2: Political Will

A crucial cross-cutting factor throughout all stages of a CBM process – from initiation and adoption to long-term implementation – is political will. It influences whether states engage in CBM processes, the commitments they are willing to make and their continued support for implementation – even during periods of heightened geopolitical competition and when multilateral cooperation is under greater strain than normal. This requires continuous political prioritisation at the relevant levels of government, confidence in the value of the process and a willingness to cooperate with other participants. ²⁶

When it comes to the cyber domain, generating such buy-in at the national level can be challenging, where responsibilities are often distributed across multiple actors who may not be accustomed to international cooperation. ²⁷ Moreover, cybersecurity is not always a political priority, with the attention given to it often increasing only in response to major cyber incidents – i.e. when new awareness of the risks of cyber insecurity has been forced upon governmental decision-makers. ²⁸ Globally, incidents such as Stuxnet (2010), ²⁹ WannaCry (2017) ³⁰ and NotPetya (2017) ³¹ fundamentally shaped political perceptions of cyber threats and the need for enhanced cybersecurity governance. Similarly, country-specific incidents, including Russia’s cyber campaign against Estonia in 2007, ³² the destructive cyber operation targeting Costa Rica in 2022 ³³ and Iran’s cyber operation against Albania in 2022, ³⁴ triggered significant national and international policy responses. Such incidents have also been featured in states’ statements and policy discussions to underline the importance of international cooperation and confidence-building in cyberspace. ³⁵

Factor 3: Timing

Another factor is political momentum and the availability of windows of opportunity. Like other policy processes, cyber CBM initiatives also partly depend on when political attention, shared interests and willingness to cooperate converge. Such windows may emerge from international negotiations, shifts in political priorities or heightened attention to cybersecurity. Recognising and using these opportunities can help initiate new processes, secure consensus regarding measures or advance implementation.

Periods of heightened tension can also create incentives for confidence-building. CBMs are particularly relevant when relations between states are strained, as they provide practical tools for managing risks and preventing unintended escalation. The Cold War origins of confidence-building illustrate this dynamic: despite profound political and military rivalry, states recognised the value of transparency and communication with regard to reducing uncertainty. ³⁶

However, the geopolitical environment was less strained when it came to the adoption of the OSCE cyber CBMs than it is today. The adoption then was facilitated by the recent development of recommendations in the 2013 UN GGE report, ³⁷ which encouraged their initial implementation through regional organisations. In addition, cybersecurity was increasingly perceived as a topic of security policy. ³⁸ This created political momentum and an opportunity to translate emerging global agreement into regional practice. The OSCE used this momentum as well as the organisation’s long-standing role in reducing tensions through dialogue and confidence-building, rooted in the Helsinki Final Act, to adopt the first OSCE cyber CBMs in 2013.

More recent developments demonstrate that heightened tensions can reinforce the value of these existing CBMs. Despite the severe deterioration in international relations following Russia’s full-scale invasion of Ukraine, some cyber CBM activities within the OSCE continued, ³⁹ while some states intensified their engagement with the same. Germany, for instance, reported increasing its use of the OSCE PoC network and sharing information about major cyber incidents more actively in response to heightened tensions. ⁴⁰

At the global level, states have also continued to negotiate and agree on cyber-related outcomes through periods of geopolitical tension, including within UN processes. These developments suggest that geopolitical crises do not invariably prevent diplomatic agreement or cooperation. However, such a crisis may complicate consensus-building, and reaching consensus during such times does not necessarily translate into meaningful implementation.

This has also been highlighted by OAS CBM 7, which addresses gender equality in cybersecurity: ⁴¹ its process illustrates how a particular political moment can create an opportunity to achieve consensus regarding an issue that may have been more contested under different political circumstances. However, consensus alone does not guarantee sustained implementation. Shifts in political priorities in the US and several Latin American states may affect the continued support for gender-related initiatives and the willingness to act on agreed-upon commitments. ⁴²

Factor 4: Prior CBM Experience

Political will can be strengthened through a range of reinforcing factors, one of which is prior experience with CBMs. Positive experiences with CBMs – either in the cyber domain or in other areas – can significantly facilitate engagement and lower barriers to participation. ⁴³

This is particularly evident in the OSCE region: since the end of the Cold War, the organisation and its predecessor have developed and implemented a wide range of CBMs across different domains, including cyberspace. ⁴⁴ As a result, the OSCE is often described as a pioneer in the development and practical application of CBMs, with such mechanisms effectively being “in its DNA”. ⁴⁵ Furthermore, the OAS could draw on past experiences with such processes within its region, starting with traditional CBMs and subsequently expanding to include non-traditional CBMs. ⁴⁶

By contrast, other multilateral settings have less institutional experience with CBMs or focus more on other policy areas or instruments. In forums such as the ARF or the UN, cyber CBMs represent – to a greater extent than in other multilateral organisations – only one element within a broader agenda, suggesting that the focus lies elsewhere. This becomes evident when we look at the UN process, where CBMs are one item on the agenda for discussion, but there is no working group dedicated solely to discussing cyber CBMs, as there is within the OSCE and OAS.

This can affect both the prioritisation of CBMs and the level of familiarity with them among participating states. Institutional legacy provides crucial advantages that can enable CBM adoption and drive successful implementation: states can draw on established practices, shared understandings and existing structures, such as secretariats, communication channels and implementation mechanisms. ⁴⁷ Such legacy also facilitates the transfer of CBM concepts into the cyber domain, as actors are already familiar with the underlying logic and objectives of CBMs. Whereas, in other cases, states need to first develop a basic understanding of the instrument itself before meaningful engagement is possible.

This was particularly evident in the UN context, where efforts to establish global cyber CBMs brought together states with extremely different levels of prior exposure to such a tool. When it comes to states without prior CBM experience, additional advocacy and capacity-building efforts are required to build the associated understanding and support. In such contexts, political will is often actively cultivated through dialogue and engagement; sustained advocacy and international dialogue have proven to be key drivers of successful cyber CBM development and implementation. ⁴⁸ It has certainly helped in this regard that an increasing number of regional organisations already had such processes in place once it became a topic of discussion within the UN.

Another aspect to consider in the global setting is that states may hold fundamentally different views on the purpose and value of CBMs. While many see transparency and information sharing as key tools for building trust and reducing the risk of misperceptions, others view such measures more critically. In the context of cyber CBMs, transparency can involve sharing national cybersecurity strategies or information on cyber incidents, but states may be reluctant to disclose certain information. From the Chinese government’s perspective, greater transparency can carry strategic risks: Beijing views itself as being at a disadvantage relative to the US and considers secrecy and ambiguity vital for maintaining a tactical advantage. Therefore, transparency may be perceived as enabling stronger states to exert pressure on weaker ones rather than building trust. ⁴⁹ This view does not necessarily apply to cyber CBM processes, but it reveals a certain way of thinking about a crucial factor in the context of cyber CBMs.

Meanwhile, the establishment of global cyber CBMs within the UN framework – with the first global cyber CBM having been adopted in 2022 – has obviously broadened states’ exposure to the concept, including those with limited prior experience with the same. However, familiarity with agreed-upon commitments does not necessarily translate into the practical experience of implementing them. Explicit implementation of the UN cyber CBMs remains at an early stage, and many of the measures and approaches draw on lessons learnt from earlier regional processes. Hence, prior experience continues to matter: established regional processes can offer practical insights into operationalising commitments, sustaining implementation and addressing implementation challenges – also drawing from prior CBM experiences from other domains – that newer processes may not have encountered yet.

It is also vital to note that institutional unfamiliarity with CBMs does not necessarily imply resistance. The cyber CBMs implemented by ECOWAS represent the first ever CBMs of the region.

Finally, the growing number of multilateral cyber CBM initiatives may lead to a diffusion effect. As more states observe the perceived benefits of such measures, they may become more inclined to engage in similar processes themselves. This dynamic can gradually strengthen political will across regions and contribute to enabling additional multilateral cyber CBM processes. For instance, the African Union (AU) is currently considering starting a cyber CBM process. ⁵⁰

Factor 5: Participation

The success of cyber CBM processes depends on not only how many states participate but also which states are involved. While broad participation may lend legitimacy to a given process, its practical relevance will depend on the involvement of states that are central to addressing the risks or tensions in question. ⁵¹ The absence of key actors, such as states that have strong cyber capabilities, ⁵² can limit the effectiveness of a CBM process even if a large number of states have reached consensus regarding the measures. Thus, participation should be assessed not only in quantitative terms but also in terms of the relevance of the states involved.

Some of the multilateral organisations that have cyber CBMs in place can draw on long-standing traditions of cooperation among their member states, which fosters a baseline level of trust and facilitates engagement: the OAS, for example, is often perceived as an organisation with a relatively more homogeneous membership and a history of sustained cooperation. ⁵³ The OSCE also has a long-standing tradition of confidence-building and institutional experience in this region. However, Russia’s full-scale invasion of Ukraine has placed severe strain on cooperation across the organisation, making consensus and broader political engagement increasingly difficult. ⁵⁴ Nevertheless, this has not brought cyber CBM activities to a complete halt: some activities have continued, and certain participating states have maintained or intensified their engagement.

Other forums, such as the ARF, bring together a highly diverse set of actors, including major powers with competing strategic interests, such as the US, EU, China and Russia. In such contexts, deep-seated geopolitical tensions and fundamentally different visions for the cyber domain complicate cooperation and can limit both the intention and the practical implementation of cyber CBMs. ⁵⁵ While the ARF provides a platform for regional dialogue on cyber issues, participating states may prioritise other bilateral, regional or multilateral channels for practical cooperation. ⁵⁶

Thus, participation is one of the factors that influences what kind of cyber CBMs get adopted as well as the ability and political will to provide resources to participate in the process or drive it forward.

When it comes to participation, cyber CBM processes face another structural limitation: cybersecurity governance requires a multistakeholder approach, as the vast majority of digital infrastructure is privately owned and operated. This implies that private companies often control the networks, platforms and technical expertise that are crucial during cyber incidents. ⁵⁷ Recognising this, organisations such as the OAS, OSCE and UN have adopted CBMs that explicitly encourage cooperation with non-state stakeholders (OAS CBM 10, OSCE CBM 12 and 14 and UN CBM 8). However, CBMs remain fundamentally state-centric diplomatic instruments, ⁵⁸ as these non-governmental actors are not present when the CBMs are negotiated. ⁵⁹

A similar disconnect exists in the case of military and intelligence actors. Cyber operations are increasingly being used for military, law enforcement and intelligence purposes, and many of the most sophisticated capabilities are located within defence institutions or intelligence agencies. ⁶⁰ Yet, cyber CBM processes are primarily diplomatic in nature and tend to involve ministries of foreign affairs as well as national technical agencies. This means that the actors who may ultimately shape cyber escalation dynamics are often absent from confidence-building discussions, which can limit the practical reach of these mechanisms. ^{61 62}

These challenges are further compounded by the fact that not all regions are embedded in regional organisational frameworks and not all states within a region are necessarily a part of its regional structures, such as the example of Kosovo and Israel. In this context, the UN serves the crucial function of a “safety net” by providing an inclusive platform for all states to engage in cyber CBM processes, such as through the global PoC directory. ⁶³

Factor 6: Institutional Design

The aforementioned challenges that stem from the composition of participating states can be reinforced by structural constraints: the ARF processes, for instance, are typically slow and consensus-driven, involve multiple layers of approval and lack a dedicated secretariat to actively support and sustain implementation efforts. As a result, only a very limited number of activities are adopted each year, and progress can be easily stalled. ⁶⁴ This suggests that challenges to effective adaptation and implementation do not stem solely from state behaviour and are rooted in institutional design as well.

This illustrates how the institutional setup of cyber CBM processes can differ across multilateral frameworks. The same applies to the design and formal status of the CBMs themselves. For instance, ECOWAS uniquely adopted its cyber CBMs through a directive, giving the measures a legally defined basis rather than making participation purely voluntary. However, member states retain discretion regarding how the agreed-upon objectives are achieved, as the details of implementation are not specified. It remains to be seen how this situation will develop and whether there will be any differences in the long-term implementation of the measures compared to purely voluntary ones.

A common feature across the OSCE, ARF, OAS and ECOWAS is the existence of dedicated working group meetings focused specifically on cyber CBM implementation. These meetings serve as a driver of implementation by creating continuity, fostering a degree of institutionalisation and providing regular opportunities for participating states to exchange updates on progress, discuss implementation challenges and, perhaps most importantly, create informal spaces where personal relationships and trust can gradually develop. That said, the frequency of these meetings vary considerably across organisations. Within the OSCE, for example, CBM 11 formally calls for three such meetings to be held per year; however, in practice, as many as four meetings are often held, with broad participation by the states involved. In contrast, the OAS and ARF generally have only one dedicated meeting annually, while the ECOWAS currently also aims to have one meeting per year. In the ARF, many of these meetings have continued to be held in hybrid formats since the COVID-19 pandemic and due to travel restrictions to Russia since the beginning of the war, which was the host country for this meeting in 2024. Such hybrid meetings have increased accessibility in some cases and ensured continuity while simultaneously reducing opportunities for informal interaction.

The COVID-19 pandemic further illustrated how implementation models matter. While all organisations were affected by restrictions on in-person engagement, the ARF was particularly vulnerable because its implementation model heavily relied on workshops. Other organisations demonstrated greater adaptability: the OAS expanded online learning initiatives, while the OSCE continued to extend their alternative implementation formats, including manuals and e-learning courses. In general, having a variety of different implementation activities can help ensure successful implementation, as not every format is equally suitable for every cyber CBM or for all states. Resources such as manuals or e-learning courses can contribute to continuity by providing knowledge over the long term, as opposed to a one-time workshop.

Factor 7: Consensus Building

A key challenge at the formulation stage, which also has direct implications for implementation, is consensus building. Multilateral cyber CBMs are typically adopted through consensus, which requires all participating states to agree on their wording. Some CBMs – particularly those that are less politically sensitive or build on existing practices, experiences, resources or initiatives – are easier to agree upon, whereas others address more contentious issues and, therefore, face greater resistance.

For example, there was broad support for UN CBM 1 to establish a global PoC directory as well as for ECOWAS CBM 2 to establish a regional PoC directory, partly because many states were already familiar with them and their benefits through their participation in regional cyber CBM processes that already had such PoC directories in place. Such measures, which are easier to agree on, are vital for getting the process off the ground, so that all involved states can gain joint initial experience and achieve early successes with the process. Furthermore, this may help secure long-term, incremental support for more sensitive or more intrusive measures. ⁶⁵

Other CBMs address more contentious areas, such as OSCE CBM 9, which involves sharing and subsequently agreeing on common definitions of key cybersecurity terms. ⁶⁶ This has always been a polarising, contentious issue – a fact that is clearly reflected in the compromise regarding the name of the OSCE cyber CBMs: cyber/ICT security CBMs. ⁶⁷

Existing political tensions can further complicate the process of achieving consensus, as states may oppose proposals based on broader geopolitical rivalries – i.e. not based on what the proposal is but, rather, on who is in favour of it or suggesting it. ⁶⁸

The formulation phase (sometimes) prioritises finding some kind of compromise to achieve consensus over ensuring clarity or feasibility. This can result in broadly formulated measures without detailed guidance or clearly formulated steps, which can lead to significant challenges during implementation.

The inclusive nature of consensus-based processes also has positive effects with respect to successful implementation, as broad participation fosters a sense of ownership among states. Ultimately, all organisations share the common feature of multiple proposals being made before being discussed, and fine-tuned and, finally, getting narrowed down to those which were possible for all states to adopt through consensus. This enhances the legitimacy of CBMs and increases the likelihood that the states will remain engaged in the implementation phase. ⁶⁹ One example illustrating this is the extensive, inclusive negotiating process employed for the UN CBMs within several Open-Ended Working Group (OEWG) sessions. Another example of this is the development of the most recent ECOWAS cyber CBMs, which were jointly developed by representatives of all member states during workshops.

Factor 8: Dedicated Secretariat

A key driver of effective implementation – and, importantly, of raising awareness and institutionalisation as well as observable implementation activities and, thus, continuity – is the presence of a (neutral) dedicated secretariat within a multilateral organisation. This is, of course, connected to the factor of institutional design discussed earlier. However, an analysis of existing cyber CBM frameworks shows that secretariats are often the primary catalysts of implementation. It is for this reason that this has been considered within this analysis as an independent factor that becomes especially relevant at the implementation stage.

Analysing different multilateral cyber CBMs processes reveals that secretariats initiate and support activities, raise awareness, track progress, organise meetings and help sustain momentum over time. ⁷⁰ In doing so, they provide a degree of institutional continuity that is otherwise difficult to achieve in intergovernmental processes.

Within organisations such as the OSCE (OSCE Secretariat’s Transnational Threats Department [TNTD]) and the OAS (Inter-American Committee Against Terrorism [CICTE]), secretariats regularly organise workshops, trainings and capacity-building activities – often in cooperation with individual states. ⁷¹ They also contribute to the development of practical resources, such as handbooks or e-learning tools ⁷² and support regular working-level exchanges, including intersessional meetings that allow states to share updates and discuss implementation progress.

Secretariats also play a crucial operational role in maintaining key cyber CBM mechanisms. For example, within the UN, ⁷³ ECOWAS, ⁷⁴ OSCE ⁷⁵ and OAS, ⁷⁶ the dedicated secretariats are responsible for managing the PoC directories by keeping the associated information up to date, conducting communication tests and providing feedback to all involved states regarding response rates or effectiveness. Beyond these technical functions, they also facilitate cross-regional dialogue by preserving institutional knowledge and disseminating best practices. This is particularly visible in UN processes, where representatives from organisations such as the OSCE and OAS have shared their experiences.

Conversely, where such institutional support is absent, implementation generally tends to be more limited. The ARF, for instance, lacks a dedicated secretariat with an implementation mandate in this regard, and responsibility for advancing cyber CBMs rests largely with individual states, which hinders implementation, as it can lead to fewer and less sustained activities.

At the same time, the role of secretariats has clear limits. While they can facilitate processes, provide expertise and implement activities, the success of the CBMs ultimately depends on the states participating in the process. Trust, in particular, cannot be generated by institutions alone. Moreover, secretariats can only act within the mandates, resources and level of confidence granted to them by states. As has been aptly noted in the OSCE context, multilateral institutions “cannot make states pick up the phone”. ⁷⁷

Factor 9: Financial and Human Resources

Considering the long-term nature, multilateral CBMs require sustained engagement, regular activities and continuous maintenance – all of which require financial and human resources. Thus, resources are a cross-cutting factor with implications for both the formulation and the implementation of cyber CBMs. ⁷⁸ Their availability is among the most fundamental determinants of whether political commitments can be initiated in the first place and then translated into sustained practical implementation, which makes this one of the most important factors that can either drive or hinder the effectiveness of such processes.

Many states – particularly smaller ones or those with limited resources – have only a small number of personnel dedicated to cybersecurity, sometimes with the same experts being responsible for a wide range of issues. ⁷⁹ As a result, participation in multiple international processes can strain existing capacities and force prioritisation, potentially affecting the implementation of cyber CBMs across all stages of their lifecycle. ⁸⁰ During negotiations, states may also be reluctant to commit to measures or processes that they lack the resources to implement. A possibility enabling such a process is therefore to adopt only a small number of CBMs as a first step, which was done within the ECOWAS.

The rotation of diplomatic staff presents an additional challenge with regard to continuity. When responsibility for cyber CBMs moves between officials, maintaining institutional knowledge requires deliberate investment in handover processes and the involvement of multiple relevant actors. Some states have sought to address this challenge by involving both diplomatic and technical experts in cyber CBM processes. For example, the Czech National Cyber and Information Security Agency (NUKIB) also engages in OSCE CBM processes. ⁸¹ However, maintaining such broad participation itself requires additional human resources.

During implementation, having different levels of resources can lead to uneven participation and limit the effectiveness of certain measures. The resource requirement of individual cyber CBMs varies considerably. Measures such as OSCE CBM 4, which focuses on capacity-building activities, require sustained institutional engagement and coordination. Other measures may seem relatively inexpensive at first glance but require ongoing investment over time at the national level as well as within the organisation. PoC directories, for example (UN CBM 1, OSCE CBM 8, OAS CBM 2 and 3, ECOWAS CBM 2 and ARF CBM1), represent a core element across multilateral cyber CBM frameworks and initially seem straightforward to implement, as they primarily involve the designation of national contact points. However, maintaining such mechanisms – ensuring that the information remains up to date, conducting and participating in regular tests and promoting the use of the directory – requires sustained human effort and institutional attention.

The resources available to multilateral organisations are often dependent on contributions from its member or participating states or voluntary funding for specific activities. ⁸² This can make CBM implementation vulnerable to shifts in political priorities and broader geopolitical developments. One consequence of the current crisis in the international order, for example, is that some states, including the US, have reduced their engagement with international organisations, including financial contributions, adding to the liquidity challenges faced by the UN. ⁸³ The OAS has historically relied heavily on US funding for cybersecurity-related initiatives, which means that changes in US policy under the Trump administration have affected the scope and continuity of some activities. ⁸⁴

When it comes to effective implementation, the ability to make efficient use of available resources is a crucial enabler. Activities that advance multiple CBMs simultaneously can help reduce the financial and human resources required for implementation. Within the OSCE, for instance, CBMs 2, 4 and 6 all focus on strengthening cyber resilience, preparedness and risk reduction and are thus often advanced through joint workshops and training activities. ⁸⁵ Similarly, CBMs 3, 8, 10 and 13 all aim to facilitate communication and crisis management between participating states. ⁸⁶ Rather than addressing these measures separately, the OSCE regularly conducts cyber exercises that operationalise several of them simultaneously by testing these mechanisms.

A similar dynamic can be observed in the OAS. Its e-learning course supports the implementation of several cyber CBMs – specifically CBMs 4, 5, 7, 8 and 9 – by building knowledge and awareness among member states while enabling available resources to support several measures simultaneously. Likewise, the OAS cyber portal serves as a shared resource that directly supports the implementation of CBMs 1, 2 and 3. ⁸⁷

Building on existing initiatives can similarly reduce resource requirements. For example, the UNIDIR Cyber Policy Portal was utilised as a part of UN CBM 3, the OSCE was able to build on an existing communications network for CBM 10, and the OAS was built on existing capacity-building initiatives.

The development of cyber CBMs in the ECOWAS region provides another example of how external resources can support implementation. The process as a whole has been supported by Germany as an external donor, which was a crucial enabling factor. ⁸⁸ However, such external support can also create structural dependencies and raise questions about the long-term sustainability of CBM processes if funding declines or donor priorities shift. ⁸⁹

Factor 10: Capacity, Knowledge and Cyber Maturity

Financial and human resources alone do not determine whether states are able to implement cyber CBMs. States also differ significantly in their institutional, technical and knowledge capacities. ⁹⁰ These differences dictate their ability to meaningfully participate in CBM processes and can affect the extent to which individual measures can be implemented in practice. ⁹¹

While implementation challenges related to capacity exist in all regions, they are particularly prominent in highly diverse settings. Such differences can create different starting points for implementation within the same regional process. ⁹² This is, for instance, relevant for cyber CBMs that rely on information sharing, such as the exchange of national strategies and legal frameworks (e.g. OSCE CBM 7, ARF CBM 2, ECOWAS CBM 1 and OAS CBM 1) or incident response practices (e.g. OSCE CBM 15 and OAS CBM 11). For states with well-developed cybersecurity ecosystems, such information may already be readily available and can be shared with relative ease, but other states may still be at an earlier stage of developing basic concepts, policies, institutional structures or technical capabilities. ⁹³ For example, while some states, such as the US and France, may already have established systems for classifying cyber incidents and can engage relatively easily in detailed exchanges as envisaged under OSCE CBM 15 ⁹⁴ or OAS CBM 11, ⁹⁵ others may first need to develop the domestic structures required to properly generate and organise such information. ⁹⁶

Consequently, a lack of information sharing does not necessarily indicate a lack of willingness to implement a CBM and may instead reflect structural limitations in a state’s ability to generate, process or share the relevant information. This distinction is important when assessing implementation: differences in observable implementation may partly reflect differences in capacity rather than those in political commitment.

These capacity differences create a structural challenge for multilateral CBMs, which ultimately rely on a certain degree of reciprocity. ⁹⁷ If states have extremely different capacities to implement a measure, implementation may become uneven, rendering some states unable to engage on equal terms.

To address resource gaps, several multilateral organisations, such as the OSCE and OAS, have integrated targeted cyber capacity-building efforts into their CBM processes. In the OSCE, for instance, many such activities are carried out under the “Activities and Customized Support for the Implementation of OSCE Cyber/ICT Security Confidence-Building Measures” project, which is funded by voluntary financial contributions from participating states.

Factor 11: Ownership

Implementation processes are often driven by individuals: highly motivated and well-connected actors, such as diplomats, chairs of working groups ⁹⁸ or the staff of international organisations. Such individuals can play a key role in advancing processes. ⁹⁹ However, this also creates vulnerabilities: if progress depends too heavily on specific actors, continuity may be at risk if they leave. Therefore, the establishment of mechanisms to create ownership is essential to ensure the sustainability of CBM implementation.

Additionally, across different multilateral settings, smaller groups of states have often played a key role in driving cyber CBM processes forward. Within the UN framework, cross-regional groups of states, such as the Confidence Builders, ¹⁰⁰ have played a vital role in maintaining momentum, breaching divide, proposing concrete ideas and engaging with states that had reservations or questions. ¹⁰¹ Through their engagement with the topic – which could have potentially been inspired by its alignment with their political priorities – they took over responsibility and, consequently, sought ownership.

A particularly effective feature of such groups has been their diversity: coalitions composed of states from different regions or political alignments are often better positioned to build bridges, foster dialogue and advocate for CBMs among a wider set of participants. This enhances such groups’ legitimacy, increasing the likelihood that their proposals will be taken seriously by other states as well as by the OEWG’s chair. The Confidence Builders group includes states from different political camps that are continuously shaping the discussions surrounding cyber issues. Support from leadership figures, such as the Chair of the OEWG, has further contributed to keeping CBMs on the agenda and advancing the process.

One example of a successful approach to institutionalising implementation is the OSCE’s “adopt a CBM” initiative, which was launched in 2018. Under this framework, participating states assume responsibility of specific CBMs by developing discussion papers outlining implementation pathways, conducting questionnaires to map national approaches and organising supporting activities. ¹⁰² This not only distributes the burden of implementation but also strengthens ownership and helps ensure continuity over time. Hence, it contributes to awareness and institutionalisation as well as to observable implementation activities.

Factor 12: Operationalisation

There are several reasons for the gap between CBMs being in place and their practical use. For example, states with strong bilateral relations often rely on established, more direct communication channels, which may be faster, less formal, better known and more trusted than cyber CBM-specific mechanisms within a multilateral organisation. Conversely, in politically strained relationships, requests made through cyber CBM channels may be ignored or met with reluctance. In other cases, states may simply lack the technical or institutional capacity to respond (which draws attention back to the previously described challenge related to different levels of resources and cyber maturity). As a result, the practical uptake of such cyber CBMs can remain limited.

The implementation of OSCE CBM 10 ¹⁰³ illustrates the broader challenge involved with moving from formal implementation to actual operational use. Significant progress has been made in this regard: a shared understanding of the measure exists, and an increasing number of participating states have connected to the OSCE Communications Network. However, the mechanism has seen limited practical use. One reason for this is that the platform can be cumbersome to use in time-sensitive situations.

In practice, national Computer Emergency Response Team (CERTs) and technical authorities often rely on faster, more informal communication channels that they already trust and use regularly. Consequently, the added value of formal diplomatic mechanisms was not always immediately evident to technical actors, challenging the implementation of CBMs aiming to establish communication channels. This is related to the recurring challenge that technical and diplomatic communities often operate very differently. Successfully implementing cyber CBMs frequently requires bridging the gaps between these communities – a task that can be difficult in practice.

Cyber incidents such as the operation targeting Ukraine’s power grid in 2015 could, in principle, have been addressed through the existing cyber CBM crisis management mechanisms (OSCE CBMs 3, 8, 13 and 16), but, according to publicly available information, this did not happen in this case. ¹⁰⁴

Nevertheless, Nauru, for instance, stated the following: “It is precisely because we are small that CBMs matter so much to Nauru. In a serious ICT incident, a small state’s response begins with a question: who do we call?” ¹⁰⁵ Tonga argues, “Small states do not maintain wide networks of diplomats tasked with cyber-related cooperation. When an incident strikes, trusted, predictable lines of communications between states are needed. Tonga, therefore, strongly supports the Global Points of Contact Directory (...).” ¹⁰⁶

The broader challenge and its importance is highlighted by the OSCE stating that “CBMs are designed with practical application in mind and are only considered ‘implemented’ by an OSCE participating State if actively used”. ¹⁰⁷ A statement was made by the representative of Vanuatu at the 2026 meeting of the Global Mechanism as follows: “Confidence is not built by the number of channels that exist or the volume of requests within them, but by the certainty of what happens when one is used.” ¹⁰⁸

Factor 13: Understanding of Each CBM

A factor that affects practical CBM use is the varying degree of concretisation across different cyber CBMs. ¹⁰⁹ Some measures are relatively concrete and describe specific working steps, such as OSCE CBM 11 stating that there should be three intersessional Working Group Meetings a year. Further, CBMs concerning the PoC directory clearly describe necessary working steps to implement the CBM. Others, however, are formulated with a higher level of abstraction, functioning more as general commitments or political signals than as operational measures.

In some cases, this can be explained by consensus building during the formulation stage. However, vague language may lead to divergent interpretations, uneven implementation or situations in which almost any activity can be framed as implementation – potentially diluting the effectiveness of the measure. It can be observed that cyber CBMs that include a concrete shared vision are generally at a more advanced stage of implementation or have greater levels of implementation activity than other ones that are less clearly defined.

Initial ambiguity does not necessarily preclude success. If sufficient political will exists, broadly formulated CBMs can serve as a starting point for iterative development, enabling states to gradually specify and operationalise measures over time. Initiatives such as the Confidence Builder group in the UN context have demonstrated that sustained dialogue and cooperation can help translate general commitments into more concrete practices.

A promising trend has also emerged in recent OEWG sessions: more states now highlight their national cyber CBM activities and explicitly link them to specific UN cyber CBMs. ¹¹⁰ Such efforts help clarify the purpose of each measure, manifest them in the real world and provide models that others can follow. At the same time, these examples – which include highlighting conferences and novel laws, joint research projects or capacity-building efforts – also illustrate how broad the idea of implementing these cyber CBMs is, as they are formulated in a very broad manner.

Factor 14: Measurability

Such varying degrees of concretisation lead to varying degrees of measurability across different cyber CBMs, which also affects their practical use. ¹¹¹ Some of the adopted multilateral cyber CBMs allow for relatively straightforward tracking of their implementation through clearly identifiable outputs, including the following:

• Meetings held; for example, OSCE CBM 11 can be assessed by examining whether meetings have taken place, how frequently they have been held and which states have participated.

• Points of contact (PoCs) nominated; for example, under OSCE CBM 8, UN CBM 1, ECOWAS CBM 2 and OAS CBMs 2 and 3, implementation can be assessed by identifying how many and which states have nominated PoCs.

• Mechanisms established; for instance, OAS CBM 11 can be assessed by examining how many and which states have established a national cyber incident severity schema.

With less concrete cyber CBMs that describe general commitments or political signals instead, implementation is largely implicit. However, there is a possibility that clear measurable indicators can enable implementation by enhancing accountability. ¹¹²

Verification is not the goal of CBMs. ¹¹³ A certain degree of flexibility is inherent to CBMs and can be beneficial, allowing states to adapt implementation to their specific contexts. The key challenge, therefore, lies in striking a balance between flexibility and clarity. Without a shared understanding and measurability, such as in the form of regular reviews of objectives and expected outcomes, implementation risks becoming fragmented and inconsistent across states.

Factor 15: Non-Abuse

Finally, the effectiveness of CBMs ultimately depends on their use in good faith. ¹¹⁴ Hence, the potential misuse of CBM mechanisms constitutes a significant challenge to individual CBMs as well as the process as a whole. If such instruments are exploited in a way that undermines their purpose, this can erode trust, reduce their practical utility and ultimately weaken the overall process.

Concerns regarding such risks have already been raised in international discussions, particularly in the context of the UN. For example, during recent sessions at the UN level, states expressed apprehension regarding the possible misuse of the global PoC directory. France, for example, urged other states to “not exploit this tool, to not overuse the tool, at the risk of making it inoperable”. ¹¹⁵ These concerns were later echoed and further specified in a joint statement made by Germany and France, which highlighted the risk that repeated or unfounded requests – despite the availability of established channels – could place undue strain on national cybersecurity agencies. It was argued that such practices risk undermining both the credibility of the mechanism itself and the broader diplomatic efforts underpinning it, particularly by weakening trust between technical and diplomatic communities. The concerns were supported by additional states in 2026, including Tonga and South Korea. ¹¹⁶

As mentioned earlier, institutional design can also be exploited for abusive purposes: for instance, during the implementation of cyber CBMs within the ARF, the requirement for consensus-based decision-making was frequently used to stall implementation activities. The reasons for undertaking such actions are presumably not related to the specific activity itself and believed to stem from politicisation or tensions among the participants.

Furthermore, the “one bad apple” scenario can lead to challenges in this context. For example, if there is a state participates with whom information cannot be shared under any circumstances, it could result in no information may be shared at all with any of the other participating states.

---

Key findings: patterns across enablers and challenges

CBMs can serve as an important starting point for diplomatic engagement, particularly when deeper forms of cooperation remain out of reach. However, building and sustaining confidence in cyberspace is far from straightforward: trust is difficult to establish, easily undermined and requires continuous effort to maintain. Translating political commitments into sustained practice requires more than just the adoption of the agreed-upon measures. This study identifies several factors that dictate whether cyber CBMs are properly implemented, highlighting not only the obstacles that hinder progress but also the conditions under which implementation can be strengthened.

One of the key findings is that the factors that impede implementation outnumber those that actively facilitate it. However, these categories are not clear-cut: most factors can either enable or constrain implementation depending on the context. Political will, for instance, can sustain engagement, while its absence can stall an otherwise well-designed process. Institutional arrangements can provide continuity and support, but their effectiveness depends on the resources available to maintain them. Therefore, implementation depends not only on creating favourable conditions but also on managing the constraints that can undermine progress. Nevertheless, some conditions can be actively fostered, particularly through institutional design, the strategic use of political windows of opportunity and the creation of ownership by individual states or groups of states.

A further finding of this analysis is that these factors are interconnected rather than independent. Political will can facilitate resource allocation, which strengthens implementation capacity; implementation activities can, in turn, help build trust and reinforce political support. The reverse is also possible: weak implementation can undermine confidence in the process, further reducing political commitment and resources.

The relevance of individual factors also varies across the stages of a CBM process and between regional contexts. Some factors are particularly crucial during formulation, while others become more relevant during implementation (see Figure 1). Established processes may benefit from institutional experience and support structures, whereas newer initiatives may face greater challenges in terms of securing ownership and continuity. Differences in states’ resources and cyber maturity, along with regional security dynamics, further shape what CBMs can realistically achieve. Thus, there is no “one size fits all” model for successful implementation when it comes to regional processes; efforts to strengthen CBMs need to account for the specific conditions and needs of each process.

Taken together, the findings of this analysis highlight the central role of political will and sustained political engagement. Although cyber CBMs address technical issues and may depend on technical expertise, their implementation ultimately relies on political decisions regarding priorities, resources, cooperation and continued participation. While a state’s technical capacity matters, it cannot compensate for a lack of political commitment. Conversely, political support alone may be insufficient if the state lacks the capacity to act. Hence, successful implementation requires political willingness as well as the practical means to translate commitments into action.

Cyber CBMs: unique or just another multilateral policy process?

Many of the factors identified in this study are not unique to cyber CBMs, or even to CBMs more broadly. Political will, institutional design, resources, continuity and clarity of objectives have been found to be recurring determinants of implementation across multilateral policy processes, particularly those based on voluntary and non-binding commitments. ¹¹⁷ The findings may, therefore, also inform efforts to understand implementation in other policy domains.

What distinguishes cyber CBMs is the context in which these familiar challenges arise. Persistent uncertainty regarding cyber threats and state behaviour, significant differences in terms of cyber maturity and competition for political attention and resources can complicate implementation. Furthermore, relevant expertise and responsibilities are often distributed across various national authorities, while non-governmental actors may also play a role in the cyber domain without being systematically included in CBM processes. These characteristics amplify well-known implementation challenges.

Another important distinction is related to the security environment in which cyber CBMs operate. Multilateral cyber CBMs are primarily designed as preventive instruments intended to reduce risks before crises emerge; however, in general, CBMs have often also been used in post-conflict settings, situations of prolonged tension or even during ongoing armed conflicts. In such contexts, implementation comes with additional challenges other than the ones discussed within this paper: Actors may have limited interest in reducing tensions, deep historical grievances may continue to shape perceptions and broader questions of reconciliation can affect the willingness to implement the CBMs. Experiences from regions such as the Western Balkans demonstrate that confidence-building is often embedded within the wider political and societal processes of rebuilding trust. ¹¹⁸ While CBMs can help maintain communication channels and reduce risks, in such settings, there is also the risk that successful CBM cooperation can create an illusion of progress while more fundamental political disputes remain unresolved. ¹¹⁹ Consequently, the objectives and expectations surrounding CBMs will likely differ depending on the settings in which they operate.

Implementation as a continuous process

Cyber CBM implementation is best understood as a continuous and iterative process rather than a linear sequence that has a defined endpoint. Progress varies across measures and regions: some CBMs remain at an early stage, while others become established practices. Even well-established measures, however, may have scope for further operationalisation, more consistent use or more ambitious implementation.

Progress may also become visible through incremental developments that extend beyond the immediate outputs of individual measures. These include improvements in cyber capacity and resilience or the strengthening of bilateral and multilateral partnerships and may manifest through increased dialogue on the topic, coordinated positions in international negotiations, implementation of joint projects, diffusion of norms and language across related international forums ¹²⁰ or gradual institutionalisation of cyber issues within foreign policy agendas. In some regions, such as the OAS, it is highly likely that the cyber CBM process has contributed to such shifts. Broader trends may also serve as indicators of success, such as a growing number of states participating in cyber CBM implementation activities or the emergence of new regional cyber CBM processes. These developments suggest that states perceive value in such initiatives and expect tangible benefits from engagement.

Finally, the process itself often matters as much – if not even more – as the individual outputs it generates. Particularly during periods of geopolitical tension, the continued willingness of states to engage with each other, exchange views, participate in joint activities and maintain communication mechanisms may constitute a significant success in its own right.

---

Making cyber CBMs work: bridging the implementation gap

The preceding analysis identified factors that influence the success of multilateral cyber CBM processes. Building on these findings, this chapter outlines a set of practical recommendations aimed at strengthening multilateral cyber CBM processes.

Strengthen a shared vision

Cyber CBMs are often interpreted differently by different states. Therefore, developing a common understanding of the objectives and expected outcomes of cyber CBMs via structured exchanges should be consider a priority. ¹²¹

A vital element of such exchanges should be a stronger focus on the practical benefits of cyber CBMs. States should be encouraged to share success stories and concrete implementation experiences. Existing examples – such as the operational use of PoC directories ¹²² – can help demonstrate that cyber CBMs are not merely political declarations and can generate practical value. Making these experiences more visible could provide inspiration for other states and strengthen confidence in the process.

Additionally, states should exchange experiences related to implementation challenges, unsuccessful approaches and “potential pitfalls”. ¹²³ Understanding why certain measures proved difficult to operationalise – or why specific approaches failed – can be just as valuable as highlighting good practices. Such discussions require a certain degree of trust, and they help normalise implementation challenges and enable states to learn from one another instead of repeatedly facing similar obstacles in isolation.

For instance, prior to Working Group meetings, the OAS CICTE Secretariat sends out a standardised questionnaire asking about challenges or considerations relating to implementation; the secretariat then shares the results of this questionnaire, in anonymised form, with all member states. ¹²⁴ Such a practice can serve as a valuable experience to learn from. Recent discussions within the UN OEWG have also demonstrated an encouraging trend, with an increasing number of states linking national activities to specific cyber CBMs (e.g. Germany and the UK), ¹²⁵ effectively contributing to a more concrete vision of the cyber CBM by mapping their implementation efforts.

Similarly, states participating in cyber CBM processes should periodically reflect on whether existing cyber CBMs remain fit for purpose or whether their interpretation needs to evolve in accordance with technological developments and the changing cyber threat landscape. Alternatively, states should adopt a very critical view regarding whether, in light of the experiences gained or changed circumstances, it might not be worth devoting further efforts to a specific CBM and whether to focus their efforts on the implementation of others instead. ¹²⁶

Secretariats could play a critical role in this regard by creating the space for such exchange to occur and by facilitating discussions on common challenges, for instance, via standardised questionnaires. Nevertheless, individual states, groups of states (such as the Confidence Builder group) or the chair of a working group (such as the case with the “adopt a CBM” initiative within the OSCE) could also take the initiative to start such efforts or at least to put it on the agenda. At the UN level – where, compared to the OAS and OSCE, such an agenda item has not yet been institutionalised – the Dedicated Thematic Groups (DTGs) ¹²⁷ (DTG 1 most probably fits best) should be used for such exchanges. ¹²⁸

Strengthen implementation mapping efforts

The development of a shared understanding of implementation should be complemented by mechanisms that make implementation more transparent and easier to assess. While cyber CBMs are deliberately made voluntary and should not be verified in the same manner as, for instance, legally binding arms control agreements, this does not preclude regular reporting or implementation reviews through the use of standardised questionnaires or similar instruments to enable comparison and anchor the exchange of information. ¹²⁹

Therefore, states participating in the process should establish more structured mechanisms to document implementation activities, exchange implementation progress and identify any remaining gaps. ¹³⁰ This is easier to do with certain cyber CBMs (especially those that describe explicit implementation tasks or deliverables) than with others. Hence, it is particularly important in these cases to be able to refer to a shared vision. Examples of this exist, highlighting that such approaches are feasible:

• The minutes of OAS Working Group meetings show that some states are linking their activities to CBMs in a very structured manner (e.g. Trinidad and Tobago ¹³¹ ). Similarly, during OSCE Working Group Meetings, co-adopters give an update on the current CBM implementation status or upcoming implementation activities.

• The OAS has established regular public institutional reporting, which aims to achieve greater visibility of implementation activities and, thereby, increase transparency, this does not only focus on cyber CBMs but also includes all the CBMs within the organisations. The process of sharing information has been made as straightforward as possible for states; following the update to the website for the cyber PoCs, states can now submit information via a form on the website.

• Another existing resource aiming to map implementation efforts is the National Survey of Implementation of United Nations Recommendations on the Responsible Use of ICTs by States in the Context of International Security, which includes a section on cyber CBM implementation and could serve as a useful starting point for more structured and transparent reporting.

Unfortunately, so far, such resources have not seen a lot of uptake. The UN implementation survey, for instance, has only been filled in and published by two states (Czech Republic and Canada) since its release in 2022. These experiences could be built upon further without duplicating efforts. However, an updated version would be needed. For example, the current UN implementation survey currently includes a section on cyber CBM implementation, but lacks explicit questions about the UN cyber CBMs or specific regional efforts. This would address suggestions, for instance, by Costa Rica as well as Singapore, who advocated for a “repository for states to submit CBMs” or a “directory for what exists regionally”. ¹³²

Such initiatives should not aim to simply mark CBMs as completed and, instead, should strive to map out the existing implementation efforts and maintain a clear record of developments. Such regular implementation reviews, voluntary reporting templates or dedicated review conferences could help monitor progress over time and identify cyber CBM efforts more explicitly while preserving the voluntary character of CBMs. Such review mechanisms could also be incorporated into CBMs or the CBM processes and be established more firmly both at a later stage in the implementation phase and (ideally) from the outset of a new process.

These measures could contribute to creating awareness or initiating exchanges across different levels and actors, as cyber CBMs are predominantly perceived as a diplomatic tool. However, depending on the specific CBM, it largely depends on implementation on the national level, where technical experts, ministries or police are needed for successful implementation.

Again, secretariats have a particularly crucial role to play in this regard. By collecting implementation data, tracing developments and coordinating reporting processes, they can strengthen institutional memory and ensure that the mapping of CBM implementation remains a persistent agenda item rather than an ad hoc discussion. Nevertheless, individual states (such as the Czech Republic and Canada did to a certain degree), groups of states or the chair of a working group could also take up the initiative to start such efforts or to at least put it on the agenda.

Strengthen ownership

Ownership is a strong driver of successful implementation. Unlike most other enabling factors, ownership can be actively fostered.

Existing initiatives provide valuable inspiration in this respect. The OSCE’s “Adopt a CBM” initiative and the ARF’s sponsoring-state approach assign responsibility for individual cyber CBMs and encourage states to voluntarily take a role in promoting implementation. Similar models could be adopted in other multilateral cyber CBM processes. ¹³³

States that assume responsibility for particular cyber CBMs can prepare implementation guidance, facilitate dialogue, mobilise financial resources, coordinate activities and promote awareness among states. Making such responsibilities more transparent could further strengthen accountability and visibility, such as by publicly communicating which state adopted which cyber CBM within the OSCE in the way that the ARF publishes which state is a sponsoring state for specific measures.

Strengthen and leverage capacities in a sustainable manner

Resource constraints remain one of the most persistent challenges to implementation across all multilateral cyber CBM processes. Hence, long-term implementation requires sustained investment.

Such capacity-building efforts should be driven by clearly defined implementation needs rather than generic cybersecurity assistance. Identifying which capacities are required for specific cyber CBMs and which existing initiatives already address these needs could help avoid duplication and ensure that the limited resources are used efficiently; such efforts already exist with regard to the implementation of cyber norms. ¹³⁴ Particularly within the UN framework, many CBMs are already being implemented implicitly through the use of existing resources, such as the Cyber Policy Portal. It has also become easier to achieve consensus on cyber CBMs, where these can build on existing initiatives.

Mapping how individual cyber CBMs contribute to the implementation of the voluntary, non-binding norms for responsible state behaviour or the application of international law within the cyber domain could further strengthen the strategic rationale for investing in cyber CBM implementation. The ASEAN Norms Checklist, an initiative designed to drive the implementation of the norms forward, for instance, emphasises the relevance of PoC directories specifically with regard to Norm A. Moreover, the crucial role of regional dialogue in the implementation of all the norms is emphasised on a regular basis. ¹³⁵

Academia, think tanks and implementing organisations can, if requested by the states, provide valuable support by conducting implementation mapping, identifying capacity gaps and evaluating the contribution of cyber CBMs to the broader cyber stability framework as well as to the implementation of such capacity activities. Finally, in this case as well, the DTGs (DTG 2 would probably be the best fit here) could be leveraged as a space to identify the capacities needed accordingly. ¹³⁶

Strengthen cross-regional learning

Regional cyber CBM processes have generated valuable experiences over the past decade. ¹³⁷ Greater efforts should be made to exchange experiences across regions and systematically learn from existing practices. ¹³⁸

Encouragingly, this has already been done and has become more common in recent years through exchanges between organisations such as the OSCE, OAS, ECOWAS, ASEAN, AU and UN. ¹³⁹ These efforts should be expanded to avoid dependence on individuals. ¹⁴⁰ In the future, regular meetings could take place on the heels of the plenary meetings of the Global Mechanism – as suggested by representatives of the regional organisations themselves. ¹⁴¹ Discussions should also extend to regional organisations that have not yet developed cyber CBMs, thus enabling them to benefit from existing experiences and adapt successful approaches to their own regional contexts.

Some states are members of multiple regional organisations and, consequently, are able to make comparisons regarding cyber CBM processes, which should be leveraged. Canada and the US, for instance, are both members of the OSCE, OAS, ARF and UN, while all European states are members of the OSCE and UN and are represented by the European External Action Service (EEAS) within the ARF. Finally, all ECOWAS member states are also members of the UN and AU.

As suggested by multiple states, ¹⁴² the DTGs within the UN Global Mechanism could provide a platform for such cross-regional exchange between states – including states that are members of regional organisations that, so far, have not established cyber CBMs or those that are not members of any other regional organisation – as it should not be only the secretariats that exchange information. Nevertheless, the inclusion of the secretariats of regional organisations within those DTG discussions is crucial to allow them to share their experiences ¹⁴³ (here both DTGs would be suitable). ¹⁴⁴

Instead of seeking harmonisation, cross-regional cooperation should aim to promote interoperability where appropriate, facilitate mutual learning and strengthen the overall ecosystem of cyber CBMs. For instance, certain cyber CBMs exist in every region, such as the exchange of strategies and similar documents as well as PoC directories. Such CBMs also exist at the UN level, with all states participating in the process. Discussions should, therefore, take place on how these existing efforts in these regions can be utilised to strengthen overall cyber CBM implementation while being mindful of the use of (human) resources. ¹⁴⁵

With regard to the global PoC directory, for instance, the OAS has committed to cooperating with the UN and striving for harmonisation of the directory entries, whereas the ECOWAS has included in the text of their CBM 2 regarding a regional PoC directory that preference should be given to nominating PoCs that are listed in both the ECOWAS and the UN PoC directories. This could possibly reduce the required resources for keeping it updated (e.g. via comms checks), as duplications or parallel running mechanisms can be avoided – thus enabling the fulfilment of requests by smaller or less-well-resourced states that only have limited personnel capacity. ¹⁴⁶

While these recommendations address different dimensions of implementation, they should not be understood as separate or independent measures. Effective CBM implementation requires a broad and mutually reinforcing strategy with regard to both the practical capacities and the political conditions that enable sustained engagement.

---

Acknowledgement

This analysis has been supported by the cyber diplomacy working group “Multilateral Cyber Confidence-Building Measures” and through additional interviews with (cyber) diplomats, researchers and practitioners, including with representatives from member states from the analyzed organizations, industry, military, academia, and civil society.

The views and opinions expressed in this paper are those of the authors and do not reflect the official policy or position of the experts or that of their respective employer/s.

In alphabetical order, acknowledging essential contributions of the members of the working group:

1. Anastasiya Kazakova, DiploFoundation

2. Catalina Vera Toro, Permanent Mission of Chile to the OAS

3. Eugene Tan, S. Rajaratnam School of International Studies (RSIS)

4. Fabian Hetz, Deutsche Gesellschaft für Internationale Zusammenarbeit GmbH (GiZ)

5. Folake Olagunju, Economic Community of West African States (ECOWAS)

6. Heli Tiirmaa-Klaar, IT Coalition

7. John Schabedoth, German Federal Foreign Office

8. Jörn-Arne Niemann, Permanent Mission of the Federal Republic of Germany to the OSCE

9. Jürgen Altmann, Technische Universität Dortmund 

10. Karsten Geier, German Embassy in Luxembourg / Centre for humanitarian Dialogue

11. Mariana Jaramillo, Organization of American States (OAS)

12. Neno Malisevic, Microsoft

13. Pavlina Pavlova, Critical Cyber

14. Serge Droz, Swiss Federal Department of Foreign Affairs

15. Thomas Reinhold, Peace Research Institute Frankfurt (PRIF)

The author would like to thank the involved subject matter experts for their insights and for sharing their experience.

This project was funded by the German Foundation for Peace Research (DSF).