Cybersecurity

Companies continue to invest heavily in protecting their systems, yet to manage the scale and sophistication of today’s threats requires governments to play a critical role. They can deter malicious activity, ensure laws are consistently enforced and can work hand-in-hand with the private sector to anticipate threats and coordinate responses. Bringing the respective expertise of government and the private-sector together creates the conditions for developing shared expectations and more compatible security requirements – which in turn reduces the risk of regulatory fragmentation, strengthens resilience across critical sectors and builds trust in digital ecosystems.

Critical infrastructures – from power grids and water systems to finance, health and supply chains – are increasingly targeted by sophisticated cyber threats. Protecting them not only demands robust government action, but also close cooperation with operators who manage these systems every day. Governments should adopt risk-based cybersecurity standards aligned with global best practices – avoiding overly rigid compliance models that may discourage transparency or innovation. Prescriptive requirements that fail to reflect evolving threats or operational realities can discourage businesses from voluntarily sharing information about incidents or vulnerabilities and limit their ability to innovate in deploying more effective security solutions.

Alongside regulation, governments and operators must actively support each other through intelligence sharing, incident response coordination and red-team exercises that simulate real-world attacks. Cybersecurity for critical infrastructure cannot be achieved by regulation alone. It must be maintained through continuous partnership, joint preparedness and shared accountability.

Cyber threats know no borders. Effective responses require governments to deepen international cooperation and implement agreed norms of responsible state behaviour. Existing international norms – including those developed by the United Nations – provide a solid foundation. However, these commitments only improve security when they are put into practice. Governments must work together to share timely information, coordinate responses to major incidents and improved legal assistance that respects rights and fosters trust.

At the same time, international collaboration against cybercrime should focus on practical operational measures – including timely and safeguarded information sharing between competent authorities, streamlined cross-border cooperation mechanisms for investigations, and capacity-building initiatives that strengthen technical and institutional capabilities across jurisdictions – as opposed to overly broad or poorly defined treaties that could undermine human rights or disrupt business activity.

Bringing governments, business, civil society and technical experts together is essential for making cybersecurity policy both credible and workable. Inclusive engagement ensures policies are grounded in technical reality, sensitive to societal needs and responsive to economic imperatives.

Governments should move beyond one-off consultations and embed non-state stakeholders throughout the entire policymaking cycle – from design to implementation and review. At the international level, multistakeholder processes also strengthen legitimacy and secure wider buy-in, vital for addressing borderless challenges like cybercrime. By contrast, purely intergovernmental processes risk producing rigid, impractical outcomes that fail to meet the needs of the digital ecosystem.