A principles-based approach to cyber capacity-building (CCB)

Understanding and operationalizing the OEWG CCB principles

Research paper

Published 25 June 2024

Updated 26 June 2024

ISBN: 978 1 78413 613 0

Joyce Hakmeh

Associate Fellow, International Security Programme

Amrit Swali

Former Research Associate, International Security Programme

In 2021, members of the UN Open-ended Working Group (OEWG) agreed 10 principles for cyber capacity-building (CCB). However, to date, the principles have not had the impact that was expected or hoped for. Part of the issue has been a lack of understanding of how best to utilize the principles and how to apply them in different situations. This paper aims to provide more specific detail to improve general comprehension of the principles, as well as guidance on real-world implementation.

A principles-based approach is an effective way of standardizing, guiding and informing CCB activities. The OEWG principles provide an opportunity to streamline CCB efforts and establish a common understanding of global best practice. The paper illustrates how a principles-based approach may inform the design, implementation and evaluation of a cyber capacity-building project.

DOI: 10.55317/9781784136130

Resource	What it can assist with
Results focused
Operational Guidance: The EU’s International Cooperation on Cyber Capacity Building20 Operational Guidance for the EU’s International Cooperation on Cyber Capacity Building21	The EU’s operational guidance describes a process and contains recommendations for managing results-focused CCB. The first edition also includes example indicators and metrics for results frameworks related to different cyber capacities. The guidance is written for an EU audience, but most of the content is universally applicable.
Guide for Criminal Justice Statistics on Cybercrime and Electronic Evidence22	This guide provides advice for using and integrating statistics within the day-to-day operations of the criminal justice authorities, but it is also useful for cyber capacity-builders wanting to find and use evidence related to cybercrime.
Results and Indicators for Development: Cybersecurity23	This European Commission guidance note contains clear and measurable results statements that are in line with the UN SDGs, along with a range of indicators to monitor progress.
Global Overview of Existing National Cyber Capacity Assessment Tools 24	Several assessment tools have been developed to (self) assess a country’s cyber capacity. This global overview of assessment tools (GOAT) guide helps countries and capacity-builders to see which tools exist, compare their features and access them.
The Art of Knowledge Exchange: A Results-Focused Planning Guide for Development Practitioners25	Much of CCB involves exchanging knowledge between officials and experts in different countries. This World Bank guide provides results-focused advice for designing and managing such activities.
Handbook on Planning, Monitoring and Evaluating for Development Results26	Although framed around international development and over a decade old, this UNDP handbook contains a lot of practical advice on planning for results-focused capacity-building that can be applied in CCB.
Evidence-based
Applying Evaluation Criteria Thoughtfully27	This is an OECD guide to applying six criteria for good evaluations – relevance, coherence, effectiveness, efficiency, impact and sustainability – that are applicable to CCB.
Development Research in Practice: The DIME Analytics Data Handbook28	Written by the Development Impact Evaluation (DIME) team at the World Bank, this guide to using data for research and evaluation in development has methods that can be applied in CCB.
Assessing the Strength of Evidence29	This guide provides a method that helps assess the strength of evidence in individual reports or papers as well as make a judgment on the overall strength of evidence in the area of CCB being researched.
How to Do a Rigorous, Evidence-focused Literature Review in International Development: A Guidance Note30	Before starting a large programme or intervention, states may wish to review the relevant literature to see what evidence there is, what different types of intervention work and learn lessons from what has been tried before. This guide contains advice that can assist in that process.
Sustainable
Guide for Developing Sustainability and Transition Plans – V2.031	This guide for USAID is framed around international development healthcare programmes but has best practice advice that is directly applicable to CCB.
Demand-driven and locally owned
A Demand-Driven Approach to Development: A CSIS Primer32	A primer explaining what a demand-driven approach means, why it matters and how it might be implemented.
Accountability
Frameworks for Mutual Accountability and Enhanced Policy Dialogue 33	This K4D report, commissioned by the UK’s former Department for International Development, provides advice on what mutual accountability frameworks are and good practices for establishing them.
Mutual Accountability: A Guidance Note for National Policy-makers and Practitioners34	This guidance note commissioned by the UN Economic and Social Council provides advice on applying mutual accountability that has useful lessons for CCB.
Transparency
Open Data, Transparency and Accountability: Topic Guide35	This DFID-commissioned guide provides general advice on open data, transparency and accountability that is applicable in the CCB context.
Sharing What Matters: Foundation Transparency36	This Centre for Effective Philanthropy guide has advice for foundations but will also be of interest to recipients of philanthropic grants and has some lessons for donors.
International Open Data Charter37	Open-data good practices help organizations to apply transparency and accountability as well as contributing to better collaboration, research and the development of new CCB tools. The Open Data Charter contains six principles for open data that aim to guide governments in collecting, sharing and using well-governed data in order to respond effectively and accountably to global challenges. Further information and advice are available at https://opendatacharter.net.
When Does Transparency Improve Institutional Performance?38	This study examined 20,000 projects in 83 countries to learn when transparency improves institutional performance. It identifies that having and following access to information policies is key.
Human rights-based approach
Operational Human Rights Guidance for EU External Cooperation Actions Addressing Terrorism, Organised Crime and Cybersecurity39	The EU’s human rights guidance for its international CCB can provide ideas on how to assess and mitigate human rights risks.
UNDP Digital Standards – Do No Harm40	The ‘do no harm’ digital standard contains useful practices for all capacity-building that is developing or contributing to digital products and services.
The Human Rights Based Approach to Development Cooperation Towards a Common Understanding Among UN Agencies41	This short guidance note for UN agencies is useful for organizations working through how to create a framework for applying a human-rights based approach in their own work. The human rights field has progressed in the two decades since it was written, but it may be useful for understanding how the UN originally worked through the same issues.
Gender and inclusion
A Framework for Developing Gender-Responsive Cybersecurity Policy: Assessment Tool42	This assessment tool seeks to provide step-by-step advice and concrete recommendations for those wishing to develop a gender approach to cybersecurity policy.
Manual on Online Gender Violence and its Impact on the Lives of Women and Girls43	Information, tools and strategies for countering online gender-based violence. The manual can be used by capacity-builders to better understand the phenomenon of online gender violence, how it manifests and what some response strategies are.
Integrating Gender in Cybercrime Capacity-building Toolkit44	This toolkit has been designed for practitioners working to integrate gender considerations in anti-cybercrime capacity-building activities but has insights that are applicable to all CCB. Using a set of example projects, it offers clear steps to promote the gender-sensitive design and implementation of a wide range of capacity-building activities.
Confidentiality of sensitive information
Handbook on Data Protection in Humanitarian Action45	This International Committee of the Red Cross (ICRC) handbook was written for humanitarian organizations but has advice that is applicable in CCB programmes including: basic principles of data protection; legal bases for personal data processing; international data-sharing; data protection impact assessments; and relevant scenario-specific advice such as cloud services and digital ID.
(Multi-stakeholder) partnerships
The SDG Partnership Guidebook: A Practical Guide to Building High Impact Multi-stakeholder Partnerships for the Sustainable Development Goals46	This guide by The Partnering Initiative and United Nations Department of Economic and Social Affairs is framed around building country-level partnerships to achieve the SDGs. It is accompanied by a Fit For Partnering framework and assessment process to help organizations prepare for and improve their partnerships.47
Framework for Multistakeholder Cyber Policy Development48	This guide by Global Partners Digital provides advice for creating and evaluating multi-stakeholder processes for national cyber policy development that can also be applied to taking a multi-stakeholder approach to capacity-building.

Resource

What it can assist with

Results focused

Operational Guidance: The EU’s International Cooperation on Cyber Capacity Building20

Operational Guidance for the EU’s International Cooperation on Cyber Capacity Building21

The EU’s operational guidance describes a process and contains recommendations for managing results-focused CCB. The first edition also includes example indicators and metrics for results frameworks related to different cyber capacities. The guidance is written for an EU audience, but most of the content is universally applicable.

Guide for Criminal Justice Statistics on Cybercrime and Electronic Evidence22

This guide provides advice for using and integrating statistics within the day-to-day operations of the criminal justice authorities, but it is also useful for cyber capacity-builders wanting to find and use evidence related to cybercrime.

Results and Indicators for Development: Cybersecurity23

This European Commission guidance note contains clear and measurable results statements that are in line with the UN SDGs, along with a range of indicators to monitor progress.

Global Overview of Existing National Cyber Capacity Assessment Tools 24

Several assessment tools have been developed to (self) assess a country’s cyber capacity. This global overview of assessment tools (GOAT) guide helps countries and capacity-builders to see which tools exist, compare their features and access them.

The Art of Knowledge Exchange: A Results-Focused Planning Guide for Development Practitioners25

Much of CCB involves exchanging knowledge between officials and experts in different countries. This World Bank guide provides results-focused advice for designing and managing such activities.

Handbook on Planning, Monitoring and Evaluating for Development Results26

Although framed around international development and over a decade old, this UNDP handbook contains a lot of practical advice on planning for results-focused capacity-building that can be applied in CCB.

Evidence-based

Applying Evaluation Criteria Thoughtfully27

This is an OECD guide to applying six criteria for good evaluations – relevance, coherence, effectiveness, efficiency, impact and sustainability – that are applicable to CCB.

Development Research in Practice: The DIME Analytics Data Handbook28

Written by the Development Impact Evaluation (DIME) team at the World Bank, this guide to using data for research and evaluation in development has methods that can be applied in CCB.

Assessing the Strength of Evidence29

This guide provides a method that helps assess the strength of evidence in individual reports or papers as well as make a judgment on the overall strength of evidence in the area of CCB being researched.

How to Do a Rigorous, Evidence-focused Literature Review in International Development: A Guidance Note30

Before starting a large programme or intervention, states may wish to review the relevant literature to see what evidence there is, what different types of intervention work and learn lessons from what has been tried before. This guide contains advice that can assist in that process.

Sustainable

Guide for Developing Sustainability and Transition Plans – V2.031

This guide for USAID is framed around international development healthcare programmes but has best practice advice that is directly applicable to CCB.

Demand-driven and locally owned

A Demand-Driven Approach to Development: A CSIS Primer32

A primer explaining what a demand-driven approach means, why it matters and how it might be implemented.

Accountability

Frameworks for Mutual Accountability and Enhanced Policy Dialogue 33

This K4D report, commissioned by the UK’s former Department for International Development, provides advice on what mutual accountability frameworks are and good practices for establishing them.

Mutual Accountability: A Guidance Note for National Policy-makers and Practitioners34

This guidance note commissioned by the UN Economic and Social Council provides advice on applying mutual accountability that has useful lessons for CCB.

Transparency

Open Data, Transparency and Accountability: Topic Guide35

This DFID-commissioned guide provides general advice on open data, transparency and accountability that is applicable in the CCB context.

Sharing What Matters: Foundation Transparency36

This Centre for Effective Philanthropy guide has advice for foundations but will also be of interest to recipients of philanthropic grants and has some lessons for donors.

International Open Data Charter37

Open-data good practices help organizations to apply transparency and accountability as well as contributing to better collaboration, research and the development of new CCB tools. The Open Data Charter contains six principles for open data that aim to guide governments in collecting, sharing and using well-governed data in order to respond effectively and accountably to global challenges. Further information and advice are available at https://opendatacharter.net.

When Does Transparency Improve Institutional Performance?38

This study examined 20,000 projects in 83 countries to learn when transparency improves institutional performance. It identifies that having and following access to information policies is key.

Human rights-based approach

Operational Human Rights Guidance for EU External Cooperation Actions Addressing Terrorism, Organised Crime and Cybersecurity39

The EU’s human rights guidance for its international CCB can provide ideas on how to assess and mitigate human rights risks.

UNDP Digital Standards – Do No Harm40

The ‘do no harm’ digital standard contains useful practices for all capacity-building that is developing or contributing to digital products and services.

The Human Rights Based Approach to Development Cooperation Towards a Common Understanding Among UN Agencies41

This short guidance note for UN agencies is useful for organizations working through how to create a framework for applying a human-rights based approach in their own work. The human rights field has progressed in the two decades since it was written, but it may be useful for understanding how the UN originally worked through the same issues.

Gender and inclusion

A Framework for Developing Gender-Responsive Cybersecurity Policy: Assessment Tool42

This assessment tool seeks to provide step-by-step advice and concrete recommendations for those wishing to develop a gender approach to cybersecurity policy.

Manual on Online Gender Violence and its Impact on the Lives of Women and Girls43

Information, tools and strategies for countering online gender-based violence. The manual can be used by capacity-builders to better understand the phenomenon of online gender violence, how it manifests and what some response strategies are.

Integrating Gender in Cybercrime Capacity-building Toolkit44

This toolkit has been designed for practitioners working to integrate gender considerations in anti-cybercrime capacity-building activities but has insights that are applicable to all CCB. Using a set of example projects, it offers clear steps to promote the gender-sensitive design and implementation of a wide range of capacity-building activities.

Confidentiality of sensitive information

Handbook on Data Protection in Humanitarian Action45

This International Committee of the Red Cross (ICRC) handbook was written for humanitarian organizations but has advice that is applicable in CCB programmes including: basic principles of data protection; legal bases for personal data processing; international data-sharing; data protection impact assessments; and relevant scenario-specific advice such as cloud services and digital ID.

(Multi-stakeholder) partnerships

The SDG Partnership Guidebook: A Practical Guide to Building High Impact Multi-stakeholder Partnerships for the Sustainable Development Goals46

This guide by The Partnering Initiative and United Nations Department of Economic and Social Affairs is framed around building country-level partnerships to achieve the SDGs. It is accompanied by a Fit For Partnering framework and assessment process to help organizations prepare for and improve their partnerships.47

Framework for Multistakeholder Cyber Policy Development48

This guide by Global Partners Digital provides advice for creating and evaluating multi-stakeholder processes for national cyber policy development that can also be applied to taking a multi-stakeholder approach to capacity-building.

Topic themes

Defence and security

Economics and trade

Environment

Health

Institutions

Major powers

Politics and law

Society

Technology

Regions

Africa

Americas

Asia-Pacific

Europe

Middle East and North Africa

Russia and Eurasia

Foreign policy and international affairs events

Publications

Become a member

The Queen Elizabeth II Academy for Leadership and the Next Generation

About us

A principles-based approach to cyber capacity-building (CCB)

Joyce Hakmeh

Amrit Swali

Robert Collett

Annex B. Resources for applying CCB principles