Cybersecurity is often considered a technical challenge. This Disarmament Week, it is worth recalling that when a serious cyber incident affects critical infrastructure, essential public services or government operations, its consequences can quickly extend into legal, economic, security or diplomatic domains. Effective responses often require cybersecurity agencies, law enforcement, critical infrastructure operators and high-level decision makers to work together.
Consider a cyber incident that disrupts a country’s electricity supply. The national cybersecurity agency must assess the technical situation, law enforcement may open an investigation, the ministry of foreign affairs may need to consider whether the incident has an international dimension, and the ministry of energy must work closely with the operator to restore essential services. Each institution may have its own plan. The question is: how well can these plans function together in practice?
Testing national arrangements before a real crisis hits
National cybersecurity strategies, legislation and incident-response frameworks provide essential foundations, and many countries have made important progress in developing them. Yet written frameworks cannot anticipate every operational dependency or point of friction between the institutions responsible for applying them, such as:
- Who leads?
- What information can be shared?
- When does an information and communication technology (ICT) incident become a public-safety or national security concern?
- How do technical, legal, policy and law-enforcement decisions fit together?
These issues often become visible only when institutions work through a crisis scenario together.
Implementation is therefore a capability in its own right. National arrangements need to be tested and rehearsed in a low-risk environment before a real crisis occurs. This helps stakeholders identify gaps, clarify roles, strengthen information sharing, and build the working relationships needed for a coordinated response. Because institutions, risks and legal frameworks differ from country to country, this work must be tailored to national realities.
An Asia-Pacific success story
UNIDIR’s cyber capacity-building initiative across Asia-Pacific supports countries in strengthening national preparedness, testing institutional arrangements and improving coordination in ways tailored to their specific contexts.
The trainings conducted were not technical cyber drills, but strategic tabletop exercises. In line with a whole-of-government and whole-of-society approach, they brought together stakeholders including cybersecurity agencies, law enforcement, ministries of foreign affairs, critical infrastructure operators and senior decision makers.
Since May 2025, UNIDIR – with support from Global Affairs Canada – has successfully delivered national capacity-building trainings in eight countries: Thailand, Lao People’s Democratic Republic, Indonesia, the Philippines, Pakistan, Malaysia, Cambodia and Viet Nam, alongside a dedicated thematic training programme in Thailand.
To ensure that each training programme responds to the specific national context, UNIDIR follows a three-phase approach. This reflects the principles for ICT capacity-building agreed by Member States in the UN Open-ended Working Group on ICT Security, including that capacity-building should be demand-driven, nationally owned and tailored to national needs and priorities.
- The first phase combined research and consultations with government institutions and other national stakeholders. Its purpose was to understand the priorities of partner countries alongside their unique national threat landscapes and national designations of critical infrastructure, institutional and legislative arrangements, capabilities, and future plans.
- The second phase built on these findings through capacity-building programmes co-designed with national authorities, which included the strategic tabletop exercises. These exercises allowed participants to apply national legislation, institutional arrangements and the framework of responsible State behaviour in the use of ICTs to realistic cybersecurity scenarios. By testing how a response would operate in practice, these exercises helped participants surface coordination gaps, information-sharing challenges and overlapping responsibilities before an incident occurs.
- The ongoing third phase provides targeted, in-depth support in areas identified during the exercises. These include cyber crisis management and strategic communication, implementation of the framework, national approaches to attribution, responses consistent with international law, cybersecurity workforce development and whole-of-government coordination.
From a single exercise to a national framework in Thailand
UNIDIR’s deepening collaboration with the Government of Thailand is an example of how tailored, sustained engagement can move from testing arrangements to concretely supporting implementation of the framework.
In May 2025, UNIDIR and Thailand’s National Cyber Security Agency delivered a tailored cyber capacity-building and policy training programme, including a tabletop exercise simulating an ICT incident targeting vital energy infrastructure. Based on research on national cyber-related legislation and cyber incident response framework, the exercise helped national authorities identify practical steps to further operationalize the framework.
UNIDIR then worked with Thailand to develop a tailored follow-up training programme, delivered in July 2026 in partnership with the Office of the National Security Council, National Cyber Security Agency and Ministry of Foreign Affairs. It explored how selected elements of the framework could be translated into national policies, institutional processes and operational practices.
The training also convened technical, policy, law enforcement and diplomatic communities to allow them to address a challenge that none of them could effectively address on their own. As a result, Thai authorities are developing a national framework to further implement specific elements of the framework of responsible State behaviour.
This progression illustrates the value of capacity-building as a sustained process rather than a one-off event. It also reflects a straightforward principle of UNIDIR’s approach:
Effective capacity-building cannot be designed from afar. It must be grounded in national institutional, legislative and policy contexts, and guided by the priorities of the countries it seeks to support.
What’s next?
As cyber threats evolve, their effects increasingly cross institutional boundaries. Ransomware can disrupt essential services and economic activity; supply-chain compromises can involve government, industry and international partners; and emerging technologies, including AI and quantum, can create new challenges for security and governance. No single institution or community of practice can address these challenges alone.
UNIDIR’s cyber capacity-building supports countries to turn national frameworks and international commitments into practical cooperation. It strengthens the relationships, shared understanding and institutional habits that allow national frameworks to function when they are needed most.
UNIDIR will continue to expand its engagement across the Asia-Pacific region, working with partner countries to deliver tailored training, scenario-based exercises and support that respond to evolving national priorities and cyber threats. Through its recently established Centre of Excellence on AI, Peace and Security, UNIDIR will also extend its capacity-building work to the field of artificial intelligence.
