Ninth Meeting of the First Substantive Plenary Session: Developing and Implementing Capacity Building

#

Opening and Procedural Matters

Chair Egriselda López opened the ninth and final meeting of the first substantive plenary session of the 2026 Global Mechanism on Progress in the Area of ICTs and International Security, calling the session to order and directing delegates to the last agenda item: developing and implementing capacity building . Noting that the day marked the conclusion of the programme of work, she reminded delegations that whilst no preset time limit applied to interventions, she encouraged abridged statements to allow all speakers to be heard, with full versions to be submitted to the Secretariat . Thirteen requests for the floor had been received, and the Chair announced the first five speakers as Thailand, Saudi Arabia, the Philippines, Zimbabwe, and the Kingdom of the Netherlands .

—

#

Capacity Building as a Foundational and Cross-Cutting Pillar

A defining theme of the session was the near-universal agreement that capacity building is not merely one pillar among equals within the UN framework for responsible state behaviour in ICTs, but rather the foundational enabler underpinning all other pillars [S52][S69]. Thailand opened by affirming that “capacity building is indispensable in mitigating malicious cyber activities and strengthening cyber resilience” and should “remain a central pillar of our collective efforts, enabling all states, particularly developing countries, to address the challenges and opportunities presented by emerging technologies” . The Philippines articulated this most precisely, stating that capacity building “is not a stand-alone pillar, but an enabler of all five pillars, strengthening the ability of states to implement international law, operationalise the voluntary norms, develop confidence-building measures, and participate effectively in regular institutional dialogue” . Indonesia reinforced this framing, asserting that “without adequate capacity, implementations of all pillars of the global mechanisms would be difficult to achieve” . The Dominican Republic went further, describing capacity building as “the cross-cutting and enabling factor without which the other norms and commitments under the framework for responsible state behaviour will just remain words on a page” . The Kenya ICT Action Network, speaking on behalf of civil society and technical stakeholders, similarly described it as “a fundamental bridge that converts abstract norms on paper into operational resilience on the ground” . The Chair’s concluding remarks confirmed this consensus, noting that “the vast majority of member states see capacity building as a fundamental pillar for exercising the other pillars” [S52][S79].

—

#

Core Principles Governing Effective Capacity Building

Alongside this conceptual consensus, delegations converged strongly on the principles that should govern how capacity building is designed and delivered [S88]. There was broad agreement that programmes must be demand-driven, nationally owned, needs-based, sustainable, and free from political conditionalities. The Philippines called for capacity building that is “demand-driven, nationally owned, sustainable, and responsive to nationally identified priorities,” emphasising that it should “empower states to develop enduring institutional, legal, technical, operational, and policy capabilities rather than provide one-time assistance” . Thailand similarly stressed that “such efforts must be need-based, tailored to national priorities and responsive to national capacities” . Zimbabwe, aligning itself with the ICC statement before making its national remarks, articulated the most comprehensive formulation, stating that capacity building “should be nationally owned, demand-driven, needs-based, sustainable, transparent, and free from conditionalities” and must “empower states to build lasting resilience rather than create technological dependence” . Indonesia explicitly added that it must be “free from political conditionalities to bridge digital divides” , a formulation echoed by Tuvalu, which called for “country-owned and needs-driven” approaches supported by “state-led assessments” to ensure support is “tailored and practical” . FIRST, the global forum of incident response and security teams, reinforced this from a practitioner perspective, noting that capacity building “must be locally driven, responsive to national priorities and sustained over a longer period of time” rather than delivered through “short-term interventions” . Interpol similarly confirmed that “sustainable operational capabilities” result when capacity building is “nationally owned, driven by identified needs, and crucially tailored to the distinct responsibility of relevant national actors” . The Chair’s closing summary reflected this consensus, noting that capacity building “must be sustained, coordinated, and contextualised in the needs and realities of states without applying a one-size-fits-all approach” [S122][S123].

—

#

National and Regional Capacity Building Initiatives

A substantial portion of the session was devoted to delegations describing concrete capacity building initiatives already underway at national, bilateral, and regional levels, demonstrating that practical cooperation is delivering results even as the global mechanism is being established [S129].

Saudi Arabia outlined an extensive portfolio of international initiatives, framing them as stemming from “its belief in the importance of dialogue, the exchange of expertise, and capacity building at the global level” . These included the Global Cybersecurity Forum (GCF), established as “a global platform bringing together stakeholders from various sectors, including the private sector, academia, and the technical community” ; the Global Initiative for Child Protection in Cyberspace and the Global Initiative for Women’s Empowerment in Cybersecurity, launched by Crown Prince Mohammed bin Salman ; the Global Initiative for International Capacity Building in Cyberspace in partnership with the United Nations ; and, in partnership with UNITAR, a dedicated cybersecurity office headquartered in Riyadh to launch capacity building initiatives and joint research programmes . Saudi Arabia also reported that its specialised programme to train women in cybersecurity for leadership positions had seen “representatives from more than 67 countries” graduate , and that it had partnered with the World Economic Forum to establish the Centre for Cybersecurity Economics in Riyadh . Notably, Saudi Arabia, in partnership with UNODA, launched during this session a capacity-building programme specifically for representatives participating in the global mechanism, aimed at supporting the effective participation of states in the mechanism’s work .

Thailand highlighted the ASEAN-Japan Cybersecurity Capacity Building Centre as “a key platform for strengthening regional cyber capacity,” noting its collaboration with partners including the United States, the United Kingdom, Canada, Switzerland, and the Netherlands, as well as civil society organisations . Thailand also described working with UNIDIR, Canada, the European Union, and the ICT for Peace Foundation to improve capacity building at national and regional levels . Thailand proposed that DTG-2 on capacity building prioritise discussions on advanced cyber threats including “AI and security, quantum readiness, post-quantum cryptography, and operational technology security,” as well as assistance with national legal and policy frameworks, though Thailand’s statement was cut off before this second point could be fully articulated .

The Philippines described its ongoing efforts to strengthen its cybersecurity ecosystem through “investments in institutional development, workforce capacity, the protection of critical information infrastructure, and international cooperation,” recognising in particular the contributions of UNIDIR, whose “workshops and technical engagements have strengthened national expertise” . The Philippines also highlighted the ITU Academy’s HERS CyberTrack programme, through which three Filipino women cybersecurity policy professionals were participating in the cyber policy and diplomacy track .

The Dominican Republic, as host of the Cyber Capacity Centre for Latin America and the Caribbean (LAC4) in Santo Domingo, described providing “technical diplomatic assistance directly to states without the intermediary of additional global bodies” . It reported training “more than 900 police officers, judges and prosecutors” through EU programmes – referred to in the transcript as GLACY-e and GLACY+ – with some graduates becoming instructors themselves . The Dominican Republic also described embedding cyber diplomacy in permanent specialist master’s training programmes so that “all diplomats will have the basic tools that will allow them to become significantly involved into these increasingly cross-cutting disseminations” . Paraguay similarly highlighted its new National Security Strategy developed in collaboration with the OAS and the C-CERT Americas network for cyber incident response and prevention . Paraguay also specifically acknowledged the Women in Cyber Programme (supported by Canada, the OAS, and the Global Forum on Cyber Expertise), the UNIDIR training course on international law and cyberspace, the United Nations Singapore Fellowship Programme, and the ODA Programme as valuable contributions to its capacity building efforts.

Indonesia pointed to ASEAN’s Cybersecurity Cooperation Strategy for 2026-2030 as demonstrating “how tailored long-term programs can strengthen national and regional resilience” . Indonesia also emphasised that capacity building “should include training for policymakers and technical experts, academia, legal experts, and other relevant stakeholders to ensure a holistic and comprehensive approach,” and proposed that DTG-2 focus on “critical information infrastructure protections, cyber crisis management, and strengthening the capacity of CERT and C-CERT” . The Netherlands, aligning itself with the EU statement before making its national remarks, described its long-standing commitment to cyber capacity building worldwide, including supporting “development and implementation of national cybersecurity strategies, incident response capabilities and policies for vulnerability disclosure” and strengthening CERTs and national agencies globally .

Zimbabwe welcomed the establishment of DTG-2 pursuant to General Assembly Resolution 79-237, noting that “its creation reflects the shared recognition that capacity building is essential to narrowing the digital divide, strengthening national resilience, and ensuring that all states, regardless of their size or technical capacity, can implement the agreed framework effectively” . Zimbabwe also welcomed the voluntary fund and fellowship programmes established under Resolution 79-237, noting that “these initiatives will help broaden participation and make expertise more accessible.” It further referenced the Malabo Convention and the Common African Position on the Application of International Law in Cyberspace as important regional frameworks underpinning Africa’s approach to cyber capacity building, and called for “greater coordination among existing capacity-building initiatives to maximize their impact, avoid duplication, and better respond to national needs” , highlighting the Global Points of Contact Directory as “one of the most practical achievements of the open-ended working group” .

—

#

Challenges Facing Developing and Geographically Disadvantaged States

Several delegations drew attention to the structural barriers that make capacity building particularly challenging for developing countries, small island developing states, landlocked nations, and post-conflict countries [S79].

Suriname, speaking for the first time and aligning itself with the CARICOM statement delivered by the Bahamas, described capacity building as “an investment in national resilience, institutional development, economic stability, and public trust” rather than “simply a technical exercise” . It noted that “limited financial and human resources often require difficult choices, yet the cost of insufficient investment is far greater, exposing countries to disruption of essential services, economic losses, and weakened public confidence” . Suriname also highlighted the growing importance of cybersecurity as its emergent offshore oil and gas sector creates new opportunities for economic growth while simultaneously expanding the need to protect critical infrastructure .

Tuvalu, aligning with the Pacific Island Forum, emphasised that capacity building “is the fundamental foundation for small island developing states such as my own country, Tuvalu, to effectively implement cyber norms, strengthen our national preparedness, and engage meaningfully in UN cyber processes” . It highlighted “significant constraints including limited resources, geographic isolation, and high connectivity costs” and called for international support that is “predictable, sustainable, and delivered through diverse channels, including remote and hybrid training, the use of micro-modules, and sustained mentorship programs” .

Paraguay introduced a structural dimension often absent from such discussions, noting that “asymmetries generate insecurity” and that “sustainable growth in cybersecurity will not be possible without the sustainable growth of a digital economy,” particularly for landlocked countries without direct access to the maritime backbones of the internet, through which 95% of web information still passes .

Yemen, speaking for the first time, described the situation of post-conflict and least developed countries most starkly, stating that “a weakness in one link means the entire chain falls apart” and calling for “practical support” to “bolster their infrastructure of control and surveillance” and establish national cybersecurity centres . Yemen noted that it has enacted a law against cybercrime and on the protection of data, and has established a national cybersecurity centre. It also described 12-month long-term training programmes designed to build the capacity of staff in cybersecurity and legal evidence, strengthening national capacity to counter transnational cybercrime. Yemen called for “swift action in terms of the two DTGs in December 2026” .

FIRST added a systemic critique, noting that “funding is often limited to short-term project cycles, while reporting requirements are increasingly complex and fragmented across donors,” and that “these constraints undermine the long-term investments that meaningfully advance capacity-building requirements” .

—

#

Gender Inclusion and Women’s Participation

Gender-responsive capacity building and women’s participation in cybersecurity emerged as a particularly strong area of consensus, with multiple delegations and the Chair celebrating concrete progress [S81][S85][S90].

Thailand recognised the importance of gender-responsive programmes, highlighting the Women in International Security and Cyberspace Fellowship and the Women Thailand Cyber Top Talent Competition, which aims to “enhance women’s practical cybersecurity skills, reach the gender gap, and cultivate a new generation of highly skilled cybersecurity professionals” . The Netherlands expressed “special appreciation of the Women in Cyber Fellowship, coordinated by UNIDIR, to which the Kingdom of the Netherlands is a proud donor,” noting that it “has strengthened the participation of women in UN cyber processes” and “provided training to excellent results” . The Netherlands encouraged all delegations “in a position to do so to contribute to the work of the Fellowship and broader to ensure that we bridge the gender divide” . Tuvalu acknowledged the fellowship as “invaluable” in enhancing its participation in UN cyber discussions . The African Union Commission emphasised that capacity building must promote “gender equality and while giving young Africans the knowledge and skills that they need to become innovative actors and to work in cybersecurity” .

Australia, together with Canada, Germany, New Zealand, the Netherlands, and the United Kingdom, reaffirmed its support for the Women in Cyber Fellowship and noted a historic milestone: “women delivered just over 50% of the statements during this plenary session,” continuing “the trend of gender parity” seen in the final sessions of the OEWG . The Chair confirmed this figure in her closing remarks, noting that “of the 324 statements made this week, 162 were delivered by women, and that is indeed 50%” , describing this as a defining feature of the mechanism’s first session and affirming that “their leadership and experience constitutes a reminder that building a safer, more secure digital environment requires all of the talent and participation of women” .

Australia’s statement on gender inclusion was delivered under agenda item 8 (other matters), emphasising that “achieving meaningful gender inclusion is also essential to building a more effective, representative and resilient international cyber environment” . It noted that through the Women in Cyber Fellowship, Australia and partner countries are “helping expand opportunities for women from underrepresented and developing states to participate in UN cybersecurity processes, strengthen professional networks and contribute their expertise to national and international policymaking” . Australia encouraged all delegations to “continue efforts to promote the full equal and meaningful participation and leadership of women across all aspects of the global mechanisms” .

—

#

The Role of International Organisations and Non-State Actors

International organisations and accredited non-state entities made substantive contributions that enriched the discussion with operational experience and practical tools [S80][S92].

Interpol described its approach of embedding capacity building throughout the operational cycle, using the football team metaphor to illustrate that “different types of players, goalkeepers, defenders, or strikers, may need different specialized forms of training” . It provided a concrete example in which 13 countries from the Middle East and North Africa received specialised training and participated in tabletop exercises, before Interpol coordinated a joint operation against phishing and malware that resulted in the arrest of “over 200 suspects, who had been linked to 3,867 identified victims” . Interpol also highlighted the growing industrialisation of cybercrime and its work developing practical guidance for the responsible use of AI in law enforcement, including a toolkit and e-learning course . It measured the success of capacity building by what member countries are equipped to do: “conduct more effective investigations, identify and arrest offenders, dismantle malicious infrastructure and criminal networks, trace and recover illicit processes, and support victims” .

The OSCE described nearly a decade of capacity building activities linked to its confidence-building measures, including workshops on critical information infrastructure protection, cross-sector cooperation, and threat information sharing . It highlighted its annual training on international cyber diplomacy, which in November of the previous year gathered 18 participants from Eastern and Southeastern Europe, Central Asia, South Caucasus, and Mongolia . The OSCE also described a regional workshop that brought together 14 policymakers to strengthen national capacities on the applicability of international law to state use of ICTs .

Chris Sampson of Future Earth Systems, speaking from the perspective of the technical community, proposed that enterprise architecture tools such as capability maps and capability maturity models could assist member states in “prioritisation and planning for capacity building in each of your jurisdictions,” identifying which capabilities are needed across government and the broader economy . FIRST called for “stronger partnerships among states, private sectors, civil society, and the technical community with donors and implementers working together effectively in public-private partnerships” , and specifically noted that regions such as the Western Balkans and Africa demonstrate that “greatest impact is achieved when international organizations work closely with local stakeholders.” The Kenya ICT Action Network argued that capacity building “must not be a top-down, copy-paste exercise” and that programmes “will need to be co-designed, co-created with local institutions to address specific regional threat landscapes, local language realities, and human rights impacts” – including protecting civil society and vulnerable populations from technology-facilitated abuse . It called for the global mechanism to “systematically integrate non-state actors as co-designers, co-creators, trainers, and evaluators of capacity-building programs to ensure accountability and measurable impact” .

The African Union Commission welcomed the establishment of DTG-2 and described capacity building as “a strategic investment in digital development” and “an essential lever for consolidating international peace and security in cyberspace” . It committed to supporting member states in implementing the Common African Position on the Application of International Law in Cyberspace and the UN Framework on Responsible Behaviour of States , framing these efforts within the aspirations of Agenda 2063 as the continental development framework guiding Africa’s digital transformation.

—

#

The Global ICT Security Portal and Kuwait’s Proposal

The establishment and operationalisation of the Global ICT Security Cooperation and Capacity Building Portal attracted significant attention as a concrete deliverable from the OEWG final report [S131][S132].

Kuwait delivered one of the most detailed and operationally specific contributions of the session, grounding its proposals in specific provisions of the OEWG final report – including paragraphs 8, 9, 39, 43D2, 53, 53G, and 56 – demonstrating a detailed engagement with the agreed text. Kuwait explicitly welcomed India’s important commitment to supporting the establishment and operationalisation of the global portal as a confidence-building gesture, and expressed readiness to work with India to explore how its previously developed digital tool on voluntary non-binding norms could be “technically aligned with the portal architecture” . Kuwait proposed developing “a voluntary scenario-based capacity building module on international law and the use of ICT within the global portal” . Kuwait envisioned the portal as a “modular one-stop-shop approach,” with one component supporting practical implementation of voluntary non-binding norms and another facilitating capacity building and “deeper common understanding concerning the application of international law” . The proposed scenario bank would contain “neutral and hypothetical scenarios relating to the use of ICTs in the context of international security,” submitted voluntarily by member states, experts, and relevant UN entities . Member states could voluntarily provide their views on applicable rules and principles of international law, with the tool explicitly designed not to “determine whether interpretation is correct, rank national positions, or replace intergovernmental negotiations” . Kuwait argued this approach would “maximize existing resources, avoid unnecessary duplication, and help transform the global portal into an interactive capacity-building environment supporting continuous learning and more focused intergovernmental discussion” .

The Secretariat provided a brief update confirming that India had pledged financial support for the technical establishment and maintenance of the portal, enabling its development “in the current budgetary and liquidity constraints of the United Nations Secretariat” . The Secretariat noted that an initial proposal document was available as A-AC.292-2025-1 and committed to providing a more substantive update at future sessions . The Dominican Republic complemented this discussion by recommending that the portal serve primarily to “map activities to avoid fragmentation of international efforts” and function as a coordination tool rather than a new implementing body, and that any voluntary fund include “metrics so that we can measure results” [S133][S134].

—

#

The Role of DTG-2 and the Dedicated Thematic Groups

Multiple delegations addressed the role of the Dedicated Thematic Group on Capacity Building (DTG-2) as a pivotal mechanism for translating the session’s normative consensus into concrete, action-oriented outcomes [S63].

The Netherlands argued that the global mechanism “should not be a one- or two-way street, but rather should act as a place where ideas, needs, experiences, innovations and resources all come together,” and that “the role of DTG2 in this sense will be pivotal for the global mechanism’s success” . It called for DTG-2 to “function as a space for genuine collaboration to ensure that capacity building is implemented in an effective, pragmatic and responsive manner” . Indonesia envisioned the global mechanism, including through the DTGs, as “a hub for coordinating capacity-building efforts, matching needs with resources, and ensuring that assistance is accessible to all member states” . Zimbabwe welcomed the establishment of DTG-2 pursuant to General Assembly Resolution 79-237, noting that “its creation reflects the shared recognition that capacity building is essential to narrowing the digital divide, strengthening national resilience, and ensuring that all states, regardless of their size or technical capacity, can implement the agreed framework effectively” . Yemen called for “swift action in terms of the two DTGs in December 2026” .

—

#

Rights of Reply: Russia and Ukraine

Near the close of the session, the Russian Federation exercised its right of reply to condemn what it described as “outrageous anti-Russian attacks” from the Italian delegation the previous day, alleging that Ukraine’s attacks on Russian civilian infrastructure had not been mentioned and that “some delegations have appeared here not to engage in professional dialogue, but to settle political scores and to reproduce propaganda clichés” . Russia argued that “such an approach undermines the work of the global mechanism” . Ukraine responded by reaffirming that it “remains under Russia’s aggression and is conducting the defense under the Article 51 of the UN Charter,” and that “public attribution and restrictive measures are applied for a reason,” namely “to manifest a joint protest against malicious behavior that undermines security in the use of the ICTs and on the global scale” . This brief but sharp exchange introduced a moment of geopolitical tension into an otherwise cooperative session, underscoring the broader political context in which the mechanism operates.

—

#

Chair’s Concluding Remarks and Next Steps

Chair Egriselda López delivered extensive concluding remarks that synthesised the week’s deliberations and set out a clear plan for the intersessional period. She began by thanking all delegations for their substantive statements and participation, recognising the effort of those who had travelled from far to attend and the support of states that had enabled the participation of delegations from developing countries . She noted that the session had produced “broad, diverse and representative participation,” strengthening “the truly global character of this mechanism” . The Chair also expressed deep gratitude to the co-facilitators of both DTGs, noting that they “have already begun their work and have shown from the outset a firm commitment to the success of this mechanism,” recognising their willingness, hard work, and leadership.

The Chair reflected on the quality and precision of the statements made during the week, noting that delegations had come with “national statements, regional statements, statements on behalf of groups of countries and also working documents and concrete proposals that will be immensely useful in the next phase of our work” . She celebrated the 50% gender parity in statements as a defining feature of the session, describing it as a milestone that “proudly bears the hallmark of these women” . The Chair also specifically thanked Julie and Ligia from her team, as well as the young intern whose “great enthusiasm and a readiness to learn” had contributed to the work of the Chair during this historic first session.

On the substance of the capacity building discussion, the Chair confirmed the broad convergence on capacity building as “a shared and universal need” , noting that delegations had described a wide range of capacity building activities including “tabletop exercises, workshops, specialised trainings, exchanges of good practices in the area of information security, and also assistance in developing policies and regulatory frameworks” . She welcomed bilateral, regional, and sub-regional activities, including the Women in Cyber programme and the UNODA-Saudi Arabia programme to support developing country participation .

Turning to next steps, the Chair outlined her intention to make “the most effective possible use of the intersessional period, which runs from today until the start of the DTGs scheduled from 7 to 11 December this year” . She committed to working closely with the co-facilitators to structure the DTGs “in an integrated and cross-cutting way with the aim of offering more specialised action-oriented spaces fully aligned with the framework’s five pillars” , building on her non-paper of 29 June as the basis for the DTG organisation proposal. She indicated that a preliminary proposal for the organisation of the DTGs, including an agenda and topics for consideration, would be circulated “toward the end of August” . The Secretariat would also facilitate the creation of a roster of experts foreseen in Resolution A/80/257 to support DTG deliberations , and the Chair would convey guiding questions ahead of each DTG meeting with sufficient advance notice .

The Chair made an explicit and candid appeal for flexibility from all delegations, acknowledging that “the DTGs have no prior template to build on” and that “there is no ready-made formula we can simply copy” . She asked delegations to receive the August proposal “as a serious, balanced, good faith basis on which to begin building without delay,” noting that “consensus cannot in practice become an endless negotiation over every word of an initial proposal” . She also confirmed that El Salvador would present to the First Committee the resolution endorsing the plenary session and DTG deliberations, with the expectation that it would be adopted without a vote .

The Chair concluded by affirming that “together we are writing the first page in the history of the global mechanism” and that “even in an extremely complex international environment, dialogue, cooperation and the quest for consensus are all still possible” . She expressed confidence that, with the same determination and flexibility she had called for, the mechanism could “produce concrete results” commensurate with what member states expect of it .

The first substantive plenary session of the 2026 Global Mechanism on Advancements in the Area of ICTs in the Context of International Security was formally closed .

Expanded Summary: Eighth Meeting of the 2026 Substantive Plenary Session – Developing and Implementing Capacity Building Measures

#

Opening and Procedural Context

Chair Egriselda López opened the eighth meeting of the 2026 substantive plenary session of the Global Mechanism on Developments in the Field of ICTs in the Context of International Security by calling the session to order and directing delegates to the final agenda item: developing and implementing capacity building measures . Noting that 49 delegations had requested the floor – a figure she described as reflecting the importance and relevance of the topic – the Chair urged speakers to consider delivering shorter oral statements and submitting full versions as e-statements to the Secretariat . A clock was displayed on screen to assist with time management . The volume of requests for the floor was itself a signal of the centrality of capacity building to the membership’s concerns, a theme that would be reinforced throughout the session [S194].

—

#

Capacity Building as the Foundational Pillar of the Framework

A near-universal consensus emerged across all regional groupings that capacity building is not a secondary or optional element of the framework for responsible state behaviour in cyberspace but its essential prerequisite. Cote d’Ivoire, aligning with the African Group, stated that for many states capacity building remains “the essential precondition for implementing the framework for the responsible behavior of states in the use of ICTs,” noting that digital transformation simultaneously opens immense prospects for development and increases exposure to cyber attacks, disruptions of essential services, and digital fraud . Critically, Cote d’Ivoire argued that “security collective cannot rest on national capacities, which are deeply unequal,” and that the digital environment requires resilience even from states with limited resources .

South Africa reinforced this framing, maintaining that capacity building is “a cross-cutting issue on the pillars of the global mechanism” and that member states remain at varying levels of implementation due to differing contexts and capabilities . Malawi elevated the argument further, stating that “if the cumulative and evolving framework represents our shared vision for responsible state behavior in cyberspace, then capacity building is what makes that vision achievable,” and insisting that it should be understood not as assistance from some states to others but as “a shared investment in international peace and security” . Rwanda similarly concluded that without the necessary institutions, legal frameworks, technical expertise, and skilled professionals, “commitments cannot be implemented, norms cannot be operationalised and resilience cannot be strengthened” .

Australia drew on the accumulated experience of the OEWG and GGEs to make the same point with particular clarity: “Norms, law and confidence building measures don’t implement themselves. People implement them. Institutions implement them. Capability implements them” . Cameroon stated that “a framework without capacity remains an aspiration. Norms without the ability to implement them remain commitments. And cooperation without shared capabilities cannot deliver lasting results” . Cameroon also grounded this argument in a long-standing African understanding “that the strength of a community is measured by its ability to uplift and empower all its members.” This framing – that capacity building is the operational bridge between political commitment and practical implementation – was echoed by virtually every delegation that took the floor [S196][S197].

—

#

Core Principles: Demand-Driven, Nationally Owned, Sustainable, and Inclusive

Alongside the foundational argument, an equally strong consensus emerged on the principles that should govern effective capacity building. Delegations consistently called for approaches that are demand-driven, nationally owned, tailored to the specific circumstances of recipient states, and sustainable over time, explicitly rejecting one-size-fits-all models [S198][S199].

Cote d’Ivoire stated that capacity building “must be voluntary, inclusive, sustainable, transparent, and based on the needs expressed by the beneficiary states themselves” and “must take into account local realities and produce measurable results” . South Africa called for efforts guided by the capacity building principles encapsulated in paragraph 56 of the 2021 OEWG final report . Malawi argued that capacity building “must therefore remain demand-driven, tailored to national priorities, and responsive to the different levels of development and capacities of member states,” and should “promote self-sufficiency by enabling states to develop enduring institutions, skilled professionals, and resilient national partners rather than creating long-term dependency” .

Cambodia articulated a comprehensive set of principles, stating that capacity building must be “demand-driven, tailored to national circumstances, and grounded in national ownership,” as well as “sustainable and results-focused,” “evidence-based, politically neutral, transparent and accountable, and provided without conditions” . Korea stated that capacity building “should not be driven solely by the priorities of providers or follow a one-size-fits-all approach” but should be “demand-driven and tailored to the specific needs and priorities of recipient states,” and emphasised that unnecessary duplication of existing capacity building efforts should be avoided in favour of enhanced coordination, complementarity, and efficient use of available resources . Germany argued that capacity building initiatives are “most successful when implemented through a co-creation approach, whereby donor and recipient states collaborate closely to jointly design, develop, and implement programs based on the UN principles for cybercapacity building” .

The principle of sustainability received particular emphasis. Kiribati stated plainly that “a single training builds a memory. It does not build an institution” . Tonga provided a concrete national illustration, noting that the response to a cyber attack on its health system succeeded “because the relationships and capabilities behind it had been invested in over years and not weeks” . Nauru warned that “support delivered in fragments leaves fragments behind” and called for capacity building that is “cumulative, each engagement building on the last, developing our own people rather than substituting for them, and lasting beyond any single project cycle” .

—

#

The Digital Divide and the Particular Challenges of Developing and Small Island States

Many delegations highlighted the structural inequality between developed and developing states in cyber capabilities as a systemic vulnerability for the entire digital ecosystem [S163]. Malawi stated that “for developing countries, however, the challenge is often not lack of commitment, but a lack of resources, expertise, and opportunities to translate political commitments into operational capabilities” . Rwanda echoed this, noting that “in many developing countries the challenge is no longer or not a lack of commitment. It is a lack of resources, technical expertise and opportunities to build national capacities” .

Brazil framed the digital divide as rendering international cooperation “an urgent imperative in order to expand the capacity of states to force their resilience, mitigate risks, and respond to ICT incidents” , and argued that “no country can tackle threats in the digital domain in isolation, and vulnerability left unaddressed in one state is a vulnerability available to be exploited against all” . Cuba described “the vast, gaping digital divide and the enormous economic difficulties faced by developing countries” as placing them in a position of asymmetry in preventing, detecting, and tackling ICT threats .

Pacific Island states offered some of the most vivid and analytically precise accounts of what resource constraints mean in practice [S204][S205][S207]. Nauru, with a population of 12,000, stated that “political will is not a scarce resource. Capacity is. A committed small state can draft the laws, set the strategies, and design the institution. What it cannot do alone is staff them, sustain them, and grow the expertise they require” . Kiribati described how each of its national cybersecurity achievements – its strategy, its maturity assessment, its digital government project – “was years of work for a very small number of people” . The Marshall Islands, making its first-ever intervention in this process – having not previously spoken at the OEWG – described how digital connectivity is “the difference between a family divided by the ocean and one able to speak across it,” but that “the very connection that can lift a remote nation can also expose it,” and that “the smallest and most distant among us have the least to fall back on when it does” . The Marshall Islands delegate closed with the Marshallese word “Komoltada” – thank you – a detail that humanised the intervention.

Vanuatu offered a counterpoint that was equally powerful: testifying that “two decades of sustained national investment supported by genuine partnerships have given Vanuatu the strongest cyber security standing in our region by international assessment,” it argued that “the return on well-designed capacity building is measurable, and sceptics of this pillar should study the Pacific before doubting it” . This evidence-based framing reinforced the broader argument that sustained, country-owned investment produces results [S200].

—

#

Gender Inclusion and the Women in International Security and Cyberspace Fellowship

Gender inclusion emerged as one of the most consistently endorsed themes of the session, with delegations across all regions affirming that it is a substantive component of effective capacity building rather than an afterthought. Malawi stated that “inclusive cybersecurity is stronger cybersecurity” and that “when women participate fully as policymakers, technical experts, incident responders, diplomats, and leaders our institutions become more resilient and our responses more effective” . Brazil argued that ensuring women and persons from marginalised populations are included in the ICT security workforce “should be treated by the DTG2 as a substantive component of capacity building rather than an afterthought” . Botswana reinforced that “all capacity-building efforts must systematically adopt a gender-sensitive perspective, and that true cyber resilience cannot be achieved while a gender-digital divide persists” .

The Women in International Security and Cyberspace (WIC) Fellowship received particularly strong and personal endorsement from delegations across different regions and development levels. Malawi commended UNIDIR and sponsoring states for the fellowship and welcomed the launch of UNIDIR’s Compendium of Good Practices on Gender Mainstreaming in Cybersecurity . Canada stated that it proudly contributes to the WIC Fellowship and supported the Compendium of Good Practices on Gender Equality and Cybersecurity, noting that “gender responsive approaches can strengthen cyber resilience, improve governance, and contribute to more sustainable capacity building outcomes” . Switzerland observed that the fellowship demonstrates “this added value concretely, supporting diplomats in bringing their expertise and perspectives directly into this room” .

Several delegates offered personal testimony about the fellowship’s transformative impact. Kiribati stated that two of its three-person delegation were present through the WIC Fellowship and one through the UN Sponsorship Programme, and that “not one of us will be in this room without those programs,” drawing a sharp distinction: “The training is not incidental to the travel. It is what turns attendance into participation” . Tonga expressed gratitude to UNIDIR and donor partners for allowing its small nation to participate in the fellowship, which “greatly assisted us and has also allowed our small delegation to participate in this substantive plenary session” . Albania acknowledged participating in the session as part of the WIC Fellowship, made possible through the support of the Netherlands, describing it as “a strong community of women whose expertise and engagement contributes meaningfully to the United Nations discussions on cybersecurity” . Bosnia-Herzegovina’s delegate noted that her presence at the session “reflects our strong commitment to women’s leadership and equal representation in cyber diplomacy.” Ghana’s delegate noted that she is herself a WIC fellow , and the Bahamas shared that participation in the WIC programme over the previous two weeks demonstrated that “sustained investment in people creates lasting national and international impact” . Ghana also highlighted the “HESCYBER Tract” as an initiative that has expanded opportunities for women from developing countries.

—

#

National Experiences and Concrete Capacity Building Efforts

A significant portion of the session was devoted to delegations sharing national experiences, which collectively illustrated both the diversity of approaches and the common challenges faced across different contexts.

Cote d’Ivoire described strengthening its institutional architecture through the National Agency for Information Systems Security and working to develop sectoral incident response mechanisms and train staff . Malawi outlined a comprehensive national programme including child online protection training for teachers across all education divisions, university cyber drills, women in cyber initiatives, and specialised technical training through the national CERT . Albania reported delivering over 50 activities targeting professionals, the public and private sector, and vulnerable groups including persons with disabilities, the Roma community, visually impaired individuals, and elderly people, with over 7,700 participants in the previous year alone .

India highlighted its bilateral practice through the Indian Technical and Economic Cooperation Programme, through which “in the last five years alone, we have offered close to 50,000 fully funded training opportunities to professionals from Global South countries, spanning nearly 400 courses at over 100 premier Indian institutions, with a substantial and growing share dedicated specifically to ICT, cybersecurity, e-commerce and the development of new technologies” . Mauritius noted that it hosts one of the ITU Global Academy Training Centres, where dedicated training programmes on cybersecurity norms and CBMs have been conducted annually since 2021, attended by over 20 countries, and extended an open invitation for member states to register on the ITU Academy portal for future trainings .

Nauru described advancing “our most ambitious cyber and digital reform program in our national history,” with a cybersecurity bill in the final stages of government consideration, alongside a digital transformation bill and data protection bill, and national cybersecurity and child online protection strategies being developed in parallel with ITU assistance . Ecuador described developing a national cybersecurity policy for 2026-2029 with seven pillars, one of which is linked to international cooperation and cyber diplomacy, incorporating emerging technologies such as AI, quantum computing, and the Internet of Things . The Bahamas described the formal launch of CertBS, its National Computer Incident Response Team, in December 2023, and reinforced the lesson that “capacity building is more effective when it’s tailored to the reality of the recipient” . The Bahamas also highlighted specific national programmes including its annual cybersecurity conference, the CyberShark Capture the Flag competition (referred to in the transcript as “Capture the Fly”), a national cyber hygiene school roadshow, and targeted training for policymakers, women, and youth.

Guyana supported both the UN Voluntary Fund and the capacity building portal, and noted that it had recently joined the Latin American Caribbean Cyber Competency Centre (LAC4) . The Democratic Republic of the Congo described its national digital plan comprising 69 priority projects across four pillars including infrastructure and governance, which led to the establishment of an agency for digital technologies, the ratification of a digital code, and the development of a national cybersecurity strategy. Serbia highlighted its distinctive dual role as both a beneficiary of international cooperation and capacity building programmes and an contributor to regional cooperation in South-East Europe, including through the exchange of expertise, joint exercises, and cooperation between national CERTs.

Ireland expressed support for the further development of a digital tool for state implementation of the UN framework, building on the voluntary norms implementation checklist – a concrete proposal for the DTG2 agenda. Singapore announced that it would run the seventh iteration of the United Nations Singapore Cyber Fellowship (UNSCF) the following month, reflecting its sustained commitment to multilateral capacity building .

—

#

Key Institutional Proposals: The Voluntary Fund, the Portal, and Fellowship Programmes

Several concrete institutional mechanisms received broad support across the session. The UN Voluntary Fund for ICT Security Capacity Building was widely endorsed as a priority. South Africa stated that it looks forward to further discussions on the development and operationalisation of the fund . Malawi welcomed its establishment, noting that for many developing countries “meaningful participation in this process depends not only on political will, but also on all the availability of practical support” . Iran argued that advancing the fund “should be one of the first priorities of the DTG-2,” citing paragraph 58 of the OEWG final report as the agreed basis for this . Guyana supported both the fund and the portal .

The most significant announcement of the session came from India, which revealed that it will “be providing the entire funding towards the operationalization of this portal as a portal of the United Nations, so that concrete, tangible action can finally follow years of discussion” . India noted that the proposal for the portal was originally an Indian initiative first tabled in 2022 and was ultimately endorsed by the General Assembly through Resolution 80-16 . India described the portal as comprising “a repository of resources, a capacity-building calendar, a needs-based catalogue of opportunities, and an interactive discussion board,” with CERT India undertaking the technical consultancy work required for the portal’s testing and infrastructure development . India emphasised that it sees “genuine and lasting value in this portal if properly used and populated by member states with actionable needs-based information” and believes it can “play a meaningful role in bridging the capacity gap that continues to separate developed and developing states in the domain of ICT security provided it is treated by all of us as a living tool rather than a static repository” .