Draft – editorial review pending. As of 27 September 2026.

The “framework of responsible State behaviour in the use of ICTs” is the term used in UN documents for a set of consensus outcomes developed since 2010 in the UN First Committee track. It consists of four elements: the applicability of international law, voluntary non-binding norms of responsible State behaviour, confidence-building measures, and capacity-building. The eleven norms in paragraph 13 of the 2015 GGE report (A/70/174) are its core; the General Assembly called upon Member States to be guided by that report in resolution 70/237. The framework was reaffirmed and elaborated by the 2021 OEWG and GGE reports and by the final report of the OEWG 2021–2025. It is referred to in debates on the protection of critical infrastructure, attribution of cyber incidents and the limits of State cyber operations in peacetime.

• A/70/174, para. 13(a)–(k) – Eleven voluntary norms, including: cooperation to increase stability and security (a); considering all relevant information in the event of ICT incidents (b); not knowingly allowing one's territory to be used for internationally wrongful acts using ICTs ©; respect for human rights, including the right to privacy (e); protection of critical infrastructure (g); responding to requests for assistance (h); supply-chain integrity and preventing the proliferation of malicious ICT tools (i); responsible reporting of vulnerabilities (j); not harming the information systems of authorised emergency response teams (k).
• A/70/174, para. 13(f) – A State should not conduct or knowingly support ICT activity contrary to its obligations under international law that intentionally damages critical infrastructure or otherwise impairs the use and operation of critical infrastructure to provide services to the public.
• A/70/174, para. 28 – Lists how international law applies, including State sovereignty, peaceful settlement of disputes, non-intervention, and the principles of humanity, necessity, proportionality and distinction.
• A/76/135 (2021) – Adds an agreed understanding of each of the eleven norms and notes that international humanitarian law applies only in situations of armed conflict.
• OEWG final report 2025 (A/80/257, Annex I) – Reaffirms the framework and sets out the elements of the permanent Global Mechanism; the Global Points of Contact Directory and related communication template are among the confidence-building measures referred to in the report.

The norms are cited by States in public attributions of cyber operations, in particular norm 13(f) on critical infrastructure. States disagree on several points: some States, including the Russian Federation and others, have proposed a legally binding instrument on international information security; many other States hold that existing international law, complemented by voluntary norms, is sufficient. How international humanitarian law applies to ICT operations in armed conflict and how rules on State responsibility and attribution apply remain under discussion. National positions on international law are compiled in UN Doc. A/76/136. The Global Mechanism operates by consensus.

• 2025-07-11: The OEWG 2021–2025 adopted its final report by consensus, including the establishment of a permanent Global Mechanism with annual substantive plenary sessions, two dedicated thematic groups (one on norms, threats and international law-related topics, one on capacity-building) and periodic review conferences (first review conference timing [to be verified]) (A/80/257, Annex I).
• 2025-12-01: GA resolution 80/16 endorsed the final report, requested the Secretary-General to support the Global Mechanism commencing in 2026 and to support a Global ICT Security Cooperation and Capacity-Building Portal (A/RES/80/16).
• 2026-03-30/31: Organizational session of the Global Mechanism in New York; Ambassador Egriselda López (El Salvador) elected Chair (Ministry of Foreign Affairs of Japan; UNODA).
• 2026-07-20/24: First substantive plenary session of the Global Mechanism (UNODA).
• 2026-12-07/11: Meetings of the dedicated thematic groups scheduled (hybrid format) (Letter from the Chair-designate, 19 March 2026).

• charter
• friendly_relations
• cybercrime_convention
• cyber_sanctions
• nis2_cer
• germany
• tallinn_manual
• nc3

• UN Doc. A/70/174 – Report of the GGE (2015), accessed 2026-09-27
• UN Doc. A/76/135 – Report of the GGE (2021), accessed 2026-09-27
• UN Doc. A/75/816 – Report of the OEWG (2021), accessed 2026-09-27
• UN Doc. A/80/257 – containing the final report of the OEWG 2021–2025, accessed 2026-09-27
• UN Doc. A/RES/80/16 (1 December 2025), accessed 2026-09-27
• UNODA – Developments in the field of information and telecommunications in the context of international security, accessed 2026-09-27
• UNODA Meetings Place – Global Mechanism on ICTs, Plenary (2026), accessed 2026-09-27
• Letter from the Chair-designate of the Global Mechanism, 19 March 2026, accessed 2026-09-27
• Ministry of Foreign Affairs of Japan – United Nations Global Mechanism establishment meeting on cybersecurity, accessed 2026-09-27

• 2026-09-27: Entry created (draft).