CBM 1: Point of Contacts

Background: This CBM invites the member states to nominate technical, and diplomatic PoCs, taking on different roles - also taken into account and to be complemented by the work CERTs / CSIRTs. The Directory is designed as “voluntary, practical and neutral in nature, developed and implemented in accordance with the principles of sovereignty, sovereign equality, the settlement of disputes by peaceful means and non-intervention in the internal affairs of other States.”320 Its core purpose is to strengthen communication and cooperation among states, thereby enhancing transparency, predictability, and international peace and security. The Directory also aims to support timely coordination during significant ICT incidents, reduce the risk of misunderstandings, and facilitate information-sharing and capacity-building to improve prevention, response, and recovery efforts.321 This CBM is considered fundamental for the implementation of further measures, but also an enabler of effective cooperation in the capacity-building domain, particularly for information exchange.

Practice: The establishment of the Global PoC Directory was the result of a lengthy and complex process. The idea had been introduced in the 2013 and 2015 GGE reports, which recommended that states nominate national PoCs. Over the years, through dedicated exchanges on how such a network could be organized, the proposal became more precise until, in the 2022 APR, states reached consensus to establish a global PoC Directory. This decision built on existing regional initiatives, recognizing that not all states were part of regional PoC networks.322 In 2022, states agreed to prioritize its development. The fourth and fifth substantive OEWG sessions focused on next steps and operational design, complemented by an intersessional meeting in December 2022 dedicated exclusively to the Directory. In this context, capacity-building needs were discussed, alongside a background paper prepared by the UN Secretariat compiling states’ views. To further inform implementation, UNIDIR conducted a study, published in 2023 on behalf of the OEWG, analyzing existing PoC networks and collecting state inputs.

Member states agreed that the United Nations Office for Disarmament Affairs (UNODA) would maintain the Directory. A secure, password-protected web platform was created for member states.323 Importantly, the Directory itself does not store sensitive communications; instead, states engage through mutually agreed, potentially secure, bilateral channels. Agreed principles specify that information exchanged should remain confidential, may only be shared with third parties with mutual consent, and should, where possible, be documented by PoCs. Clear operational procedures for initiating and responding to requests via the Directory were also defined.324

Some states have suggested developing standardized templates to improve clarity and timeliness of communications. While initial proposals have already been put forward325, it remains under discussion within the framework of the new global mechanism.

Since its launch in May 2024, participation has steadily expanded. UNODA has supported states through practical resources such as the guide “POC101: How to Access and Participate in the PoC Directory”, tailored e-learning courses, and awareness-raising activities. By May 2024, 92 states had nominated PoCs;326 by mid-2026, this number had risen to about 125 states,327 with more than 300 PoCs registered overall. Most states nominated both technical and diplomatic contacts, though some submitted only one category, and others nominated several. To avoid duplication, many states opted to nominate the same PoCs used in regional networks. Discussions continue on how best to leverage these regional–global synergies. Thus, the CBM is widely implemented and currently among all UN-agreed cyber CBMs the only one explicitly implemented.

To ensure functionality, biannual “ping tests” are conducted: UNODA sends a message to all registered PoCs, who must confirm receipt within 48 hours.328 In 2024, tests were held in June and December, yielding a 60–70% response rate.329 States also receive an annual reminder to update PoC details, with updates accepted on a rolling basis.330 Practical exercises further strengthen the Directory’s use. In March 2025, the first virtual tabletop exercise was organized by the OEWG II’s Chair, supported by UNODA, UNIDIR, and the ITU.331 It simulated Directory use under different time-zone scenarios. In addition, voluntary PoC meetings have been initiated, including a hybrid meeting in May 2024, to share experiences and lessons learned.332

The CBM is also linked to other CBMs, particularly CBM 5 and CBM 6, as states noted that “networks and directories could serve as platforms for capacity-building and knowledge-sharing. Capacity-building activities such as training sessions, seminars and other initiatives were noted as useful for strengthening expertise, knowledge and cooperation, which would in turn allow for more effective engagement in the directory.”333 However, this also suggests that it is not yet entirely defined what the directory will be used for. At the same time, ongoing misuse of the directory has been discussed at UN meetings.334

• Since its launch in 2024, most UN member states have nominated diplomatic and technical PoCs to the Global PoC Directory.

• Implementation is supported by a secure UNODA-managed web platform, biannual ping tests, tabletop exercises, PoC meetings, practical guidance materials, and dedicated e-learning courses.

• However, ongoing misuse is regularly criticized in UN meetings.