UN

The development of cyber CBMs at the UN has been gradual. Early discussions took place within the UN Groups of Governmental Experts (GGEs), which played an important role in introducing confidence-building measures as a tool for reducing cyber risks and preventing misunderstandings between states.

Building on this work, two Open-ended Working Groups (OEWG), the first established in 2019 and the second convening for the first time in 2021, became the principal forum for negotiations on international cybersecurity. In contrast to the GGEs, both were open to all UN Member States. Between 2022 and 2024, UN Member states agreed on a set of eight voluntary cyber CBMs that now form part of the UN framework for responsible state behaviour in cyberspace.

These measures aim to strengthen communication, transparency, cooperation, and information-sharing among states while reducing the risk of misunderstanding, escalation, and conflict in the cyber domain.

Importantly, the UN framework provides the only globally agreed set of cyber CBMs, making it a cornerstone of international efforts to promote cyber stability.

Implementation of the UN cyber CBMs is still at an early stage. One of the most significant achievements to date has been the establishment of the UN Global Points of Contact (PoC) Directory (CBM 1), which enables states to communicate rapidly and directly during cyber incidents and has become the most explicit example of cyber CBM implementation at the global level.

Beyond specific measures, the UN process itself serves as an important confidence-building mechanism. Through regular meetings, information-sharing, and dialogue among all member states within the OEWG.

Many implementation activities therefore occur implicitly through participation in discussions, exchanges of national experiences, capacity-building initiatives, and cooperation with regional organisations.

The universal nature of the UN is both a strength and a challenge. Bringing together states with different political systems, cybersecurity capacities, priorities, and levels of experience with cyber diplomacy makes consensus difficult. At the same time, it ensures that all states have an opportunity to contribute to the development and implementation of cyber CBMs.

Because implementation capacities vary considerably, regional organisations play an important role in translating global commitments into practical activities. The UN has therefore increasingly emphasised cooperation with regional organisations and encouraged mutual learning across regions.

While implementation remains uneven, the adoption of the eight cyber CBMs is widely regarded as one of the most concrete achievements of recent UN cybersecurity negotiations. Most states agree that the current focus should not be on developing new measures, but rather on supporting the implementation of those already agreed.

• The UN provides the only globally agreed framework for cyber confidence-building measures.

• Cyber CBMs emerged from a long-term process spanning the GGEs and OEWGs, with discussions continuing in the UN’s new global mechanism on ICT security.

• The UN Global Points of Contact Directory represents the most explicit example of implementation to date – other CBMs have seen implementation efforts, however, mostly implicit.

• The OEWG process itself functioned as a confidence-building mechanism by fostering dialogue, transparency, and trust among states – this is likely to continue throughout the new permanent mechanism.

• Implementation is driven forward through cooperation between global and regional initiatives.