OSCE

As cybersecurity became an increasingly important issue for international peace and security, the OSCE established an Informal Working Group (IWG) in 2012 to develop confidence-building measures aimed at reducing the risks of conflict stemming from the use of information and communication technologies (ICTs).

Participating States subsequently adopted a total of 16 cyber CBMs: eleven in 2013 and five additional measures in 2016. In 2017, participating States agreed to prioritise implementation rather than negotiate additional measures.

The OSCE cyber CBMs cover a broad range of objectives and can be grouped into three functional categories:

1. Posturing Measures To make state behaviour in cyberspace more transparent and predictable, allowing states to read each other's postures.

2. Communication Measures To promote timely dialogue and cooperation to prevent misunderstandings and defuse tensions

3. Preparedness Measures support national readiness and due diligence to address cyber threats, by further developing national capacities

Together, these measures create a comprehensive framework designed to enhance transparency, facilitate cooperation, reduce misunderstandings, and build confidence among participating States.

Since 2017, the OSCE has placed a strong emphasis on implementation. Over the past decade, participating States and the OSCE Secretariat have supported implementation through workshops, tabletop exercises, e-learning programmes, expert meetings, communication mechanisms, and information-sharing initiatives.

Implementation is closely linked to capacity-building. Given the varying levels of cyber maturity across the OSCE region, many implementation activities simultaneously help participating States strengthen national capacities while advancing specific cyber CBMs.

A distinctive feature of the OSCE approach is the Adopt-a-CBM Initiative, introduced in 2018. Under this framework, participating States assume responsibility for supporting the implementation of individual cyber CBMs by developing discussion papers, conducting surveys, sharing national experiences, and organising related activities. To this date, 26 OSCE participating states have adopted 9 CBMs. The initiative has strengthened ownership and helped maintain momentum across the implementation process.

The OSCE Secretariat, particularly through its Transnational Threats Department (TNTD), also plays a central role. The Secretariat supports implementation activities, facilitates information exchange among participating States, manages the cyber Points of Contact (PoC) Network, and organises regular meetings and communication exercises.

Several cyber CBMs have generated clearly identifiable outputs, including the designation of national cyber Points of Contact, the exchange of national cybersecurity strategies, a website of definitions of important terms, and regular participation in OSCE Working Group meetings. Other measures are implemented more indirectly through cooperation, dialogue, information-sharing, and the exchange of experiences and good practices. Together, these activities contribute to the broader objective of building trust and confidence among participating States.

Implementation of OSCE cyber CBMs is among the most advanced of any multilateral cyber CBM framework. Nearly all participating States have implemented at least one cyber CBM and regularly engage in related activities. At the same time, implementation levels vary across measures and state, reflecting differences in national priorities, resources, institutional arrangements, and cyber capacities.

The OSCE experience also highlights an important finding of this directory: implementation is not a one-time event but an ongoing process. While some measures have clearly defined deliverables, others rely on sustained engagement, communication, and cooperation over time.

• The OSCE hosts the most mature and comprehensive regional cyber CBM framework currently in operation.

• Implementation is supported by a wide range of practical activities, many of which combine confidence-building with capacity-building.

• The Adopt-a-CBM Initiative has become an important mechanism for strengthening state ownership and advancing implementation.

• The OSCE Secretariat plays a central coordinating role through its support for dialogue, information-sharing, and Points of Contact networks.

• Despite heightened geopolitical tensions in the OSCE region, cyber CBM implementation and cooperation activities have largely continued, demonstrating the enduring value of confidence-building mechanisms even during periods of crisis.