Towards the Design of a Collaborative Cybersecurity Networked Organisation: Identification and Prioritisation of Governance Needs and Objectives

Abstract

The effective response to the proliferation and growing diversity and sophistication of cyber threats requires a broad spectrum of competencies, human, technological and financial resources that are in the powers of very few countries. The European Union is addressing this challenge through an initiative to establish one or more cybersecurity competence networks. A number of existing technologies can support collaboration in networked organisations; however, network governance remains a challenge. The study presented in this article aimed to identify and prioritise network governance issues. Towards that purpose, qualitative and quantitative methods were applied in the analysis of norms and regulations, statutory documents of existing networks, academic sources and interviews with representatives of funding organisations and potential major customers. The comprehensiveness and complementarity of these primary sources allowed to identify 33 categories of governance issues and group them in four tiers, indicative of the respective priority level. The results of the study are currently used to inform and orient the development of alternative models for governance of a cybersecurity network and a set of criteria for their evaluation. They will support informed decision-making on the most appropriate governance model of a future networked organisation, evolving from a project consortium.

A Governance Model of a Collaborative Networked Organization for Cybersecurity Research

“…This process goes in parallel with the governance needs and objectives assessment for the establishment of a CNO in the area of cybersecurity. 21 Most probably the future ECHO governance model will include both a central governance body and regional (or sectoral) centres bringing together academia, industry, cybersecurity practitioners and end-users. This approach should guarantee integration of ECHO CNO in the future EU cybersecurity landscape as regards the EU Regulation 630 for establishing the European Cybersecurity Industrial, Technology and Research Competence Centre and the Network of National Coordination Centres.…”

Governance Consulting Services and Tools: Transition Planning and Implementation for Collaborative Networked Organisations in the Cyber Domain

“…And while there are several technologies that can support such collaboration from operational point of view, the governance aspects of such networks remain challenging. 5 All four pilot projects funded under the EU's Horizon 2020 -ECHO, Sparta, CyberSec4Europe and Concordia -engaged separately and jointly in exploring the appropriate governance models in response to the EU calls for a sustainable and effective cybersecurity ecosystem. Each of the projects developed its own approach to governance challenges, documented and published on the projects' websites.…”

“…Two Convergence events were held in 2020 and 2022 with the participation of relevant bodies to share achievements and discuss future alignment, including in the governance area. 7 The approach to the governance challenges employed by ECHO was marked by a systematic review of available best practices and theoretical advancements, 8 assessment of governance needs and objectives, 5 definition of alternatives and selection of applicable governance model. 9 The decisionmaking process at each step aimed to involve and engage all ECHO partner organisations, while reaching out to relevant stakeholders wherever possible.…”

“…One of the focus areas of ECHO project lies in design of a governance model and its implementation for a complex collaborative network of excellence centres in several EU Member states and several non-EU partners in Ukraine and North Macedonia. Exploring different existing models 5 , a comprehensive approach was developed. It covers the whole cycle -development of governance model alternatives, their assessment and selection of the appropriate alternative, detailed process and organisational design, transition and change management planning, maturity assessment from current operating model to initial operating capability and final operating capability of target operating model.…”

Business, Organisational and governance modalities of collaborative cybersecurity networks

“…This mix of methods allows us to approach the topic of governance from multiple angles enabling a more rounded and thorough examination of the issue in relation to the ECHO project's objectives and the network that will emerge from it. Specifically, this means identifying best-practices in terms of elaborating and implementing governance models of CNOs; collating and clustering examples of good business and governance models of current well-functioning networks in order to propose potential alternatives in the context of the developing ECHO research; and guiding the prioritisation of governance needs and objectives [16].…”